106 lines
No EOL
4.7 KiB
Text
106 lines
No EOL
4.7 KiB
Text
iniNet SpiderControl PLC Editor Simatic 6.30.04 Insecure File Permissions
|
|
|
|
|
|
Vendor: iniNet Solutions GmbH
|
|
Product web page: http://www.spidercontrol.net
|
|
Affected version: 6.30.04 (Build 6300400)
|
|
|
|
Summary: Modular and automated engineering is provided for HMI and
|
|
SCADA. The tools are developed to join a large range of engineering
|
|
modules together quickly. We modularize our software, as the mechanics
|
|
of a system are modularized today. Easy to visualize with a few clicks.
|
|
|
|
Desc: SpiderControl PLC Editor Simatic suffers from an elevation of
|
|
privileges vulnerability which can be used by a simple user that can
|
|
change the executable file with a binary of choice. The vulnerability
|
|
exist due to the improper permissions, with the 'F' flag (Full) for
|
|
'Everyone' group, and 'C' flag (Change) for 'Authenticated Users' group
|
|
making the entire directory 'PLCEditorSimatic_6300400' and its files
|
|
and sub-dirs world-writable.
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
Microsoft Windows 7 Ultimate SP1 (EN)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5283
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5283.php
|
|
|
|
|
|
22.10.2015
|
|
|
|
--
|
|
|
|
|
|
C:\SpiderControl\PLCEditorSimatic_6300400>cacls PLCEditorSimatic.exe
|
|
C:\SpiderControl\PLCEditorSimatic_6300400\PLCEditorSimatic.exe Everyone:(ID)F
|
|
BUILTIN\Administrators:(ID)F
|
|
NT AUTHORITY\SYSTEM:(ID)F
|
|
BUILTIN\Users:(ID)R
|
|
NT AUTHORITY\Authenticated Users:(ID)C
|
|
|
|
|
|
C:\SpiderControl\PLCEditorSimatic_6300400>dir
|
|
Volume in drive C is Windows
|
|
Volume Serial Number is 56F3-8688
|
|
|
|
Directory of C:\SpiderControl\PLCEditorSimatic_6300400
|
|
|
|
22/10/2015 10:10 <DIR> .
|
|
22/10/2015 10:10 <DIR> ..
|
|
09/05/2012 14:03 379 fontconfig.txt
|
|
22/10/2015 10:10 <DIR> HTML5Comp
|
|
22/10/2015 10:10 <DIR> HWSpecific
|
|
24/06/2015 18:42 386,812 IMasterSimatic6_30_04.jar
|
|
22/10/2015 10:10 <DIR> ImportNConvertComp
|
|
22/10/2015 10:10 <DIR> MacroDlgComp
|
|
22/10/2015 10:10 <DIR> MacroDlgRuntime
|
|
22/10/2015 10:10 <DIR> MacroLib
|
|
22/10/2015 10:10 <DIR> MacroLibTempFiles
|
|
26/04/2005 15:26 320 MsgBox.teq
|
|
22/10/2015 10:10 <DIR> News_ReleaseNotes
|
|
06/06/2012 11:06 81 PLCEditorExtraBatch.bat
|
|
11/01/2013 12:29 727 PLCEditorKey.spl
|
|
02/07/2015 22:58 7,997,440 PLCEditorSimatic.exe
|
|
26/11/2014 19:04 3,806 PLCPPOCheckCfgSimaticPLC.xml
|
|
02/07/2015 18:25 2,958,336 PLC_FontGenerator.exe
|
|
22/10/2015 10:10 <DIR> Projects
|
|
17/06/2015 10:58 34,275 PropWndDescript.xml
|
|
25/04/2014 16:55 104,254 s7api.jar
|
|
18/05/2015 12:28 42,478 ScadaDescript.xml
|
|
10/01/2011 15:09 208 ScadaPPOList.csv
|
|
22/10/2015 10:10 <DIR> SCUtils
|
|
09/02/2015 13:27 8,242 SimaticDefaultSpiderHWProfile.shp
|
|
01/07/2015 16:36 2,693,569 SimaticPLCHelp.chm
|
|
22/10/2015 10:30 <DIR> SimulateRuntime
|
|
22/10/2015 10:10 <DIR> SimulationComp
|
|
06/09/2012 11:13 65,536 SpiderLink1.dll
|
|
06/09/2012 11:13 65,536 SpiderLink2.dll
|
|
06/09/2012 11:13 65,536 SpiderLink3.dll
|
|
06/09/2012 11:13 65,536 SpiderLink4.dll
|
|
02/07/2015 18:26 265,216 SpiderObserver.dll
|
|
02/07/2015 18:25 269,824 SpiderOPCBrowser.dll
|
|
02/07/2015 23:42 483,328 SPSVarSelectorCsv.dll
|
|
02/07/2015 18:26 430,080 SPSVarSelectorTpy.dll
|
|
22/10/2015 10:10 <DIR> SVGComp
|
|
22/10/2015 10:10 86,988 unins000.dat
|
|
22/10/2015 10:10 736,929 unins000.exe
|
|
10/01/2011 15:05 28 ZelsCfg.csv
|
|
22/10/2015 10:10 <DIR> ZipComp
|
|
25 File(s) 16,765,464 bytes
|
|
16 Dir(s) 77,686,059,008 bytes free
|
|
|
|
C:\SpiderControl\PLCEditorSimatic_6300400>cd ..
|
|
|
|
C:\SpiderControl>cacls PLCEditorSimatic_6300400
|
|
C:\SpiderControl\PLCEditorSimatic_6300400 Everyone:(OI)(CI)F
|
|
BUILTIN\Administrators:(ID)F
|
|
BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
|
|
NT AUTHORITY\SYSTEM:(ID)F
|
|
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
|
|
BUILTIN\Users:(OI)(CI)(ID)R
|
|
NT AUTHORITY\Authenticated Users:(ID)C
|
|
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C |