iniNet SpiderControl SCADA Web Server Service 2.02 – Insecure File Permissions

• Exploit Database
• 123 阅读

• 作者： LiquidWorm
  日期： 2015-12-08
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38903/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93

  iniNet SpiderControl SCADA Web Server Service 2.02 Insecure File Permissions     Vendor: iniNet Solutions GmbH Product web page: http://www.spidercontrol.net Affected version: 2.02.0000   Summary: Modular and automated engineering is provided for HMI and SCADA. The tools are developed to join a large range of engineering modules together quickly. We modularize our software, as the mechanics of a system are modularized today. Easy to visualize with a few clicks.   Desc: SpiderControl SCADA Web Server Service suffers from an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the &apos;C&apos; flag (Change) for &apos;Everyone&apos; and &apos;Authenticated Users&apos; group making the entire directory &apos;WWW&apos; and its files and sub-dirs world-writable.   Tested on: Microsoft Windows 7 Professional SP1 (EN) Microsoft Windows 7 Ultimate SP1 (EN)     Vulnerability discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2015-5284 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5284.php     22.10.2015   --     C:\WWW>dir Volume in drive C is Windows Volume Serial Number is 56F3-8688   Directory of C:\WWW   22/10/201510:54<DIR>. 22/10/201510:54<DIR>.. 22/10/201510:55<DIR>HMI 07/02/200823:41 147,968 libnodave.dll 22/10/201510:54<DIR>Manual 07/07/201512:03 1,687,552 SCADAControlPanel.exe 07/07/201512:03 203,776 ScadaWindowsService.exe 22/10/201510:54 3,092 unins000.dat 22/10/201510:53 719,496 unins000.exe 07/07/201512:07 793,088 ZelsWebServ.dll 22/10/201510:54 1,546 ZelsWebServ.xml 22/10/201510:5538,696 ZelsWebServ_log.txt 8 File(s)3,595,214 bytes 4 Dir(s)77,683,298,304 bytes free   C:\WWW>cacls *.exe C:\WWW\SCADAControlPanel.exe Everyone:C BUILTIN\Administrators:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Users:(ID)R NT AUTHORITY\Authenticated Users:(ID)C   C:\WWW\ScadaWindowsService.exe Everyone:C BUILTIN\Administrators:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Users:(ID)R NT AUTHORITY\Authenticated Users:(ID)C   C:\WWW\unins000.exe BUILTIN\Administrators:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Users:(ID)R NT AUTHORITY\Authenticated Users:(ID)C     ---     C:\Users\joxy>sc qc SCADAServer [SC] QueryServiceConfig SUCCESS   SERVICE_NAME: SCADAServer TYPE : 110WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL: 1 NORMAL BINARY_PATH_NAME : C:\WWW\ScadaWindowsService.exe LOAD_ORDER_GROUP : TAG: 0 DISPLAY_NAME : SCADA Server DEPENDENCIES : SERVICE_START_NAME : LocalSystem