Exploit-DB #17024
Description: 7-Technologies IGSS 9.00.00.11059 - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2011-03-22
Author: Luigi Auriemma

Exploit:
Sources:
http://aluigi.org/adv/igss_1-adv.txt
http://aluigi.org/adv/igss_2-adv.txt
http://aluigi.org/adv/igss_3-adv.txt
http://aluigi.org/adv/igss_4-adv.txt
http://aluigi.org/adv/igss_5-adv.txt
http://aluigi.org/adv/igss_6-adv.txt
http://aluigi.org/adv/igss_7-adv.txt
http://aluigi.org/adv/igss_8-adv.txt

Advisory Archive: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17024-adv.tar.gz (igss_adv.tar.gz)
PoC Archive: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17024-poc.tar.gz (igss_poc.tar.gz)

#######################################################################

                             Luigi Auriemma

Application:  IGSS (Interactive Graphical SCADA System)
              http://www.igss.com
              http://www.7t.dk
Versions:     IGSSdataServer.exe <= 9.00.00.11063
Platforms:    Windows
Date:         21 Mar 2011 (found 10 Jan 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################

===============
Introduction
===============

IGSS (Interactive Graphical SCADA system) is a SCADA solution developed
by the 7-Technologies and used mainly in Denmark and US.

Informations from the vendor's website:
"IGSS is the complete automation software – a SCADA system for process
control and supervision - with a long row of releases since the start
of 7T 25 years ago.
At that time, 7T was the first company in the world to develop an
object oriented and mouse operated SCADA system under the name of
IGSS."


#######################################################################

Directory Traversal:

======
Bug
======

IGSSdataServer.exe is a server running on port 12401 active when the
project is started.

The opcode 0xd is used for the file operations that cover creation,
reading, writing, deleting, renaming and so on.

The server is affected by a directory traversal that gives the attacker
the possibility of downloading (command 0x3) or uploading and
overwriting (0x2) any file on the disk where the software is installed.

#######################################################################

===========
The Code
===========

http://aluigi.org/poc/igss_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17024-1.zip (igss_1.zip)

example for downloading c:\boot.ini:
  nc SERVER 12401 < igss_1a.dat

example for writing/overwriting the file c:\evil.bat
  nc SERVER 12401 < igss_1b.dat

#######################################################################

Remote Stack Overflow:

======
Bug
======

IGSSdataServer.exe is a server running on port 12401 active when the
project is started.

The opcode 0xd is used for the file operations that cover creation,
reading, writing, deleting, renaming and so on.

All the commands supported by this opcode except "FileReserve" (0x7)
are affected by different buffer overflow vulnerabilities caused by the
copying of the filename provided by the client in stack buffers of 256
bytes.

The following is the list of the copying functions for each command
(I don't remember the exact version from which I got them):

  "ListAll" (0x1)       00406e91
  "Write File" (0x2)    004071dd
  "ReadFile" (0x3)      004072fd
  "Delete" (0x4)        00406fad
  "RenameFile" (0x5)    00407094 and 004070cf
  "FileInfo" (0x6)      0040746f

#######################################################################

===========
The Code
===========

http://aluigi.org/poc/igss_2.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17024-2.zip (igss_2.zip)

  nc SERVER 12401 < igss_2a.dat
  nc SERVER 12401 < igss_2b.dat
  nc SERVER 12401 < igss_2c.dat
  nc SERVER 12401 < igss_2d.dat
  nc SERVER 12401 < igss_2e.dat
  nc SERVER 12401 < igss_2f.dat

#######################################################################

Remote Stack Overflow:

======
Bug
======

IGSSdataServer.exe is a server running on port 12401 active when the
project is started.

The opcode 0x7 is used for handling the RMS report templates and
through the "Add" command (0x4) is possible to exploit some buffer
overflows caused by the copying of the client strings in small stack
buffers:

  00409B4F   .  8D46 04       LEA EAX,DWORD PTR DS:[ESI+4]  ; string from offset 0x16 of the packet
  00409B52   .  8D5424 1A     LEA EDX,DWORD PTR SS:[ESP+1A]
  00409B56   .  83C4 0C       ADD ESP,0C
  00409B59   .  2BD0          SUB EDX,EAX
  00409B5B   .  EB 03         JMP SHORT 00409B60
  00409B5D      8D49 00       LEA ECX,DWORD PTR DS:[ECX]
  00409B60   >  8A08          MOV CL,BYTE PTR DS:[EAX]
  00409B62   .  880C02        MOV BYTE PTR DS:[EDX+EAX],CL
  00409B65   .  40            INC EAX
  00409B66   .  84C9          TEST CL,CL
  00409B68   .^ 75 F6         JNZ SHORT 00409B60
  00409B6A   .  8A46 71       MOV AL,BYTE PTR DS:[ESI+71]
  00409B6D   .  884424 0D     MOV BYTE PTR SS:[ESP+D],AL
  00409B71   .  8D46 2C       LEA EAX,DWORD PTR DS:[ESI+2C] ; from offset 0x3e
  00409B74   .  8D5424 36     LEA EDX,DWORD PTR SS:[ESP+36]
  00409B78   .  2BD0          SUB EDX,EAX
  00409B7A   .  8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
  00409B80   >  8A08          MOV CL,BYTE PTR DS:[EAX]
  00409B82   .  880C02        MOV BYTE PTR DS:[EDX+EAX],CL
  00409B85   .  40            INC EAX
  00409B86   .  84C9          TEST CL,CL
  00409B88   .^ 75 F6         JNZ SHORT 00409B80
  00409B8A   .  8D46 6C       LEA EAX,DWORD PTR DS:[ESI+6C] ; from offset 0x7e
  00409B8D   .  8D5424 76     LEA EDX,DWORD PTR SS:[ESP+76]
  00409B91   .  2BD0          SUB EDX,EAX
  00409B93   >  8A08          MOV CL,BYTE PTR DS:[EAX]
  00409B95   .  880C02        MOV BYTE PTR DS:[EDX+EAX],CL
  00409B98   .  40            INC EAX
  00409B99   .