Exploit-DB #18166
Description: Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-11-28
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Siemens SIMATIC WinCC flexible (Runtime)
              http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx
Versions:     2008 SP2 + security patch 1
Platforms:    Windows
Bugs:         A] HmiLoad strings stack overflow
              B] HmiLoad directory traversal
              C] HmiLoad various Denials of Service
              D] miniweb directory traversal
              E] miniweb arbitrary memory read access
Exploitation: remote
Date:         28 Nov 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"WinCC flexible is ideal for use as a Human Machine Interface (HMI) in
any machine or process-level application in plant, machine and
series-machine construction. WinCC flexible is designed for all sectors
of industry and offers engineering software for all SIMATIC HMI
operator panels, from the smallest Micro Panel to the Multi Panel, as
well as runtime visualization software for PC-based single-user systems
running under Windows XP / Windows 7."

HmiLoad is a stand-alone tool that should be manually added to the
startup folder for automatically start it everytime:
http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=32813727&load=treecontent&lang=en&siteid=cseus&aktprim=0&objaction=csview&extranet=standard&viewreg=WW


#######################################################################

=======
2) Bugs
=======


The bugs are referred to HmiLoad in Transfer mode, where it listens on
port 4410.

---------------------------------
A] HmiLoad strings stack overflow
---------------------------------

The functions that read data and unicode strings (32 bit size plus
data) are affected by a stack overflow during the copying of the input
data in a limited buffer trusting the size value provided by the
client.
Code execution may be possible if the attacker is able to modify the
memory after the input data (0x400 bytes) using other types of packets
and then sending a big string size for raising an invalid read
access exeption with the corrupted SEH:

  0040EFAB  |. FF76 18        PUSH DWORD PTR DS:[ESI+18]        ; /n
  0040EFAE  |. 8D46 1C        LEA EAX,DWORD PTR DS:[ESI+1C]     ; |
  0040EFB1  |. 50             PUSH EAX                          ; |src
  0040EFB2  |. 8D85 E8FBFFFF  LEA EAX,DWORD PTR SS:[EBP-418]    ; |
  0040EFB8  |. 50             PUSH EAX                          ; |dest
  0040EFB9  |. E8 2C480000    CALL <JMP.&MSVCR80.memcpy>        ; \memcpy
  ...and...
  0040F03C  |. FF76 04        PUSH DWORD PTR DS:[ESI+4]         ; /n
  0040F03F  |. 8D46 08        LEA EAX,DWORD PTR DS:[ESI+8]      ; |
  0040F042  |. 50             PUSH EAX                          ; |src
  0040F043  |. 8D85 E8FBFFFF  LEA EAX,DWORD PTR SS:[EBP-418]    ; |
  0040F049  |. 50             PUSH EAX                          ; |dest
  0040F04A  |. E8 9B470000    CALL <JMP.&MSVCR80.memcpy>        ; \memcpy


------------------------------
B] HmiLoad directory traversal
------------------------------

The server is affected by a directory traversal vulnerability that
allows access (read, write and delete) to any file on the disk outside
the expected directory.


-------------------------------------
C] HmiLoad various Denials of Service
-------------------------------------

The server is affected by various problems that allow an attacker to
stop or crash it in various ways.
They are not much interesting and useful so it's not important to go
deeper in their details.


------------------------------
D] miniweb directory traversal
------------------------------

miniweb.exe is a program that listens on ports 80 and 443 when started.
Through the usage of encoded backslashes and directory traversal
patterns is possible to download the files outside the download
directory.


---------------------------------------
E] miniweb arbitrary memory read access
---------------------------------------

miniweb is affected by a weird vulnerability that allows an attacker to
crash the server due to the access to an arbitrary invalid memory zone
during the check of the extension of the requested file.

When it handles the HTTP POST requests it checks if the first byte of
the URI is equal to 0xfa in which case it considers the URI as a binary
sequence of data composed by two 32bit integer numbers used for taking
a new URI from the arbitrary memory address calculated on the second
number or on the sum of both:

  004425E0  /$ 8B4424 04      MOV EAX,DWORD PTR SS:[ESP+4]  ; URI_to_binary
  004425E4  |. 85C0           TEST EAX,EAX
  004425E6  |. 75 01          JNZ SHORT Miniweb.004425E9
  004425E8  |. C3             RETN
  004425E9  |> 8038 FA        CMP BYTE PTR DS:[EAX],0FA
  004425EC  |. 75 03          JNZ SHORT Miniweb.004425F1
  004425EE  |. 8B40 04        MOV EAX,DWORD PTR DS:[EAX+4]
  004425F1  \> C3             RETN
  ...
  0041AA38  |. 8B1D B0714500  MOV EBX,DWORD PTR DS:[<&MSVCR80.strncmp>]
  0041AA3E  |. 83C4 04        ADD ESP,4
  0041AA41  |. 8BE8           MOV EBP,EAX
  0041AA43  |. 33F6           XOR ESI,ESI
  0041AA45  |> 8B86 988D4500  /MOV EAX,DWORD PTR DS:[ESI+458D98]
  0041AA4B  |. 3BE8           |CMP EBP,EAX
  0041AA4D  |. 7C 1B          |JL SHORT Miniweb.0041AA6A
  0041AA4F  |. 8B96 948D4500  |MOV EDX,DWORD PTR DS:[ESI+458D94]
  0041AA55  |. 50             |PUSH EAX
  0041AA56  |. 52             |PU