84 lines
No EOL
2 KiB
Text
84 lines
No EOL
2 KiB
Text
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: Cogent DataHub
|
|
http://www.cogentdatahub.com/Products/Cogent_DataHub.html
|
|
Versions: <= 7.1.1.63
|
|
Platforms: Windows
|
|
Bug: stack unicode overflow
|
|
Exploitation: remote
|
|
Date: 13 Sep 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bug
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
DataHub is a software for the SCADA and automation sector.
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
2) Bug
|
|
======
|
|
|
|
|
|
The server/service listens on the ports 4052 and 4053, the only
|
|
difference is that the second port uses SSL while the first one is in
|
|
plain-text.
|
|
|
|
Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function
|
|
exploitable through the "domain", "report_domain", "register_datahub",
|
|
"slave" and some other commands:
|
|
|
|
00440442 |. 50 |PUSH EAX ; string
|
|
00440443 |. 68 64854900 |PUSH CogentDa.00498564 ; "Domain"
|
|
00440448 |. 8D8D 00FFFFFF |LEA ECX,DWORD PTR SS:[EBP-100]
|
|
0044044E |. 68 A42F4900 |PUSH CogentDa.00492FA4 ; "%s.%s"
|
|
00440453 |. 51 |PUSH ECX ; stack buffer
|
|
00440454 |. FF15 B4F44800 |CALL DWORD PTR DS:[<&MSVCR90._swprintf>]
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/cogent_1.dat
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat
|
|
|
|
nc SERVER 4052 < cogent_1.dat
|
|
|
|
port 4053 uses the same protocol via SSL.
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |