progea movicon / powerhmi 11.2.1085 – Multiple Vulnerabilities

• Exploit Database
• 120 阅读

• 作者： Luigi Auriemma
  日期： 2011-09-14
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17842/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136

  #######################################################################   Luigi Auriemma   Application:Progea Movicon / PowerHMI http://www.progea.com Versions: <= 11.2.1085 Platforms:Windows Bug:memory corruption Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web:aluigi.org     #######################################################################     1) Introduction 2) Bug 3) The Code 4) Fix     #######################################################################   =============== 1) Introduction ===============     Movicon is an italian SCADA/HMI software.     #######################################################################   ====== 2-1) Bug ======     When the software runs a project it listens on port 808 for accepting some HTTP requests.   The server is affected by a heap overflow caused by the usage of a negative Content-Length field which allows to corrupt the memory through "memcpy(heap_buffer, input, content_length_size)".     #######################################################################   =========== 3-1) The Code ===========     http://aluigi.org/poc/movicon_1.dat https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17842-1.dat   nc SERVER 808 < movicon_1.dat     #######################################################################   ====== 2-2) Bug ======     When the software runs a project it listens on port 808 for accepting some HTTP requests.   The server is affected by a heap overflow caused by the usage of a buffer of 8192 bytes for containing the incoming HTTP requests.     #######################################################################   =========== 3-2) The Code ===========     http://aluigi.org/testz/udpsz.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15707.zip   udpsz -T -b 0x61 SERVER 808 10000     #######################################################################   ====== 2-3) Bug ======     When the software runs a project it listens on port 808 for accepting some HTTP requests and on port 12233 for a particular "EIDP" protocol.   Through a too big size field in the "EIDP" packets tunnelled via the web service (doesn&apos;t seem possible to exploit the bug via the original port) it&apos;s possible to write a 0x00 byte in an arbitrary memory zone higher than 0x7fffffff:   00a29001 c6041100 mov byte ptr [ecx+edx],0ds:0023:80616161=??   This limitation could make the bug interesting only in some 64bit environments.     #######################################################################   =========== 3-3) The Code ===========     http://aluigi.org/poc/movicon_3.dat https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17842-3.dat   nc SERVER 808 < movicon_3.dat     #######################################################################   ====== 4) Fix ======     No fix.     #######################################################################