deardaniel/secdata-raw huggingface dataset:
Metasploit Module: CitectSCADA/CitectFacilities ODBC Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/citect_scada_odbc.rb
Platform: win
Disclosure date: 2008-06-11
References: CVE-2008-2639, BID-29634, OSVDB-46105, URL-http://www.coresecurity.com/content/citect-scada-odbc-service-vulnerability, URL-http://www.auscert.org.au/render.html?it=9433, URL-http://www.citect.com/documents/news_and_media/pr-citect-address-security.pdf

Description:
This module exploits a stack buffer overflow in CitectSCADA's ODBC daemon.
          This has only been tested against Citect v5, v6 and v7.
Metasploit Module: Advantech WebAccess Webvrpcs Service Opcode 80061 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/advantech_webaccess_webvrpcs_bof.rb
Platform: win
Disclosure date: 2017-11-02
References: ZDI-17-938, CVE-2017-14016, URL-https://ics-cert.us-cert.gov/advisories/ICSA-17-306-02

Description:
This module exploits a stack buffer overflow in Advantech WebAccess 8.2.
          By sending a specially crafted DCERPC request, an attacker could overflow
          the buffer and execute arbitrary code.
Metasploit Module: DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin_scpc_initialize_rf.rb
Platform: win
Disclosure date: 2010-10-15
References: OSVDB-68812, CVE-2010-4142, URL-http://aluigi.altervista.org/adv/realwin_1-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-10-313-01

Description:
This module exploits a stack buffer overflow in DATAC Control
          International RealWin SCADA Server 2.0 (Build 6.1.8.10).
          By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
Metasploit Module: DaqFactory HMI NETB Request Overflow
Type: exploit
Path: modules/exploits/windows/scada/daq_factory_bof.rb
Platform: win
Disclosure date: 2011-09-13
References: CVE-2011-3492, OSVDB-75496, URL-http://aluigi.altervista.org/adv/daqfactory_1-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-264-01

Description:
This module exploits a stack buffer overflow in Azeotech's DaqFactory
          product. The specific vulnerability is triggered when sending a specially crafted
          'NETB' request to port 20034. Exploitation of this vulnerability may take a few
          seconds due to the use of egghunter.  This vulnerability was one of the 14
          releases discovered by researcher Luigi Auriemma.
Metasploit Module: SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/codesys_web_server.rb
Platform: win
Disclosure date: 2011-12-02
References: CVE-2011-5007, OSVDB-77387, URL-http://aluigi.altervista.org/adv/codesys_1-adv.txt, EDB-18187, URL-https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-11-336-01A, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-12-006-01

Description:
This module exploits a remote stack buffer overflow vulnerability in
          3S-Smart Software Solutions product CoDeSys Scada Web Server Version
          1.1.9.9. This vulnerability affects versions 3.4 SP4 Patch 2 and
          earlier.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.1\r\nHost: #{rhost}\r\n\r\n")
    res = sock.get_once
    disconnect

    # Can't flag the web server as vulnerable, because it doesn't
    # give us a version
    vprint_line(res.to_s)
    if res.to_s =~ /3S_WebServer/
      return Exploit::CheckCode::Detected('3S CoDeSys web server detected')
    else
      return Exploit::CheckCode::Safe('3S CoDeSys web server not detected')
    end
  end
Metasploit Module: Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/yokogawa_bkbcopyd_bof.rb
Platform: win
Disclosure date: 2014-03-10
References: URL-http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf, URL-https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities, CVE-2014-0784

Description:
This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
          exists in the service BKBCopyD.exe when handling specially crafted packets. This module has
          been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3.

Check method (fingerprinting):
pkt = build_probe
    res = send_pkt(pkt)
    if valid_response?(res)
      return Exploit::CheckCode::Detected('Yokogawa BKBCopyD service detected')
    end

    Exploit::CheckCode::Safe('Yokogawa BKBCopyD service not detected')
  end
Metasploit Module: Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/procyon_core_server.rb
Platform: win
Disclosure date: 2011-09-08
References: CVE-2011-3322, OSVDB-75371, URL-http://www.stratsec.net/Research/Advisories/Procyon-Core-Server-HMI-Remote-Stack-Overflow

Description:
This module exploits a vulnerability in the coreservice.exe component of Proycon
          Core Server <= v1.13. While processing a password, the application
          fails to do proper bounds checking before copying data into a small buffer on the stack.
          This causes a buffer overflow and allows to overwrite a structured exception handling
          record on the stack, allowing for unauthenticated remote code execution.  Also, after the
          payload exits, Coreservice.exe should automatically recover.

Check method (fingerprinting):
connect
    res = (sock.get_once || '').chomp  # This gives us string "----------------------------"
    res = (sock.get_once || '').chomp  # This gives us the actual software version
    disconnect

    if res =~ /Core Command Interface V1\.(.*)2/
      return Exploit::CheckCode::Appears('Procyon Core Server detected')
    end

    return Exploit::CheckCode::Safe('Procyon Core Server not detected')
  end
Metasploit Module: Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/factorylink_vrn_09.rb
Platform: win
Disclosure date: 2011-03-21
References: OSVDB-72815, URL-http://aluigi.altervista.org/adv/factorylink_4-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-091-01

Description:
This module exploits a stack buffer overflow in FactoryLink 7.5, 7.5 SP2,
          and 8.0.1.703.  By sending a specially crafted packet, an attacker may be able to
          execute arbitrary code due to the improper use of a vsprintf() function while
          processing the user-supplied text field.  Originally found and posted by
          Luigi Auriemma.
Metasploit Module: Sielco Sistemi Winlog Buffer Overflow 2.07.14 - 2.07.16
Type: exploit
Path: modules/exploits/windows/scada/winlog_runtime_2.rb
Platform: win
Disclosure date: 2012-06-04
References: BID-53811, CVE-2012-3815, OSVDB-82654, EDB-18986, URL-http://www.s3cur1ty.de/m1adv2012-001, URL-http://www.sielcosistemi.com/en/download/public/winlog_lite.html

Description:
This module exploits a buffer overflow in Sielco Sistem Winlog <= 2.07.16.
          When sending a specially formatted packet to the Runtime.exe service on port 46824,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/yokogawa_bkhodeq_bof.rb
Platform: win
Disclosure date: 2014-03-10
References: URL-http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf, URL-https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities, CVE-2014-0783

Description:
This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
          exists in the service BKHOdeq.exe when handling specially crafted packets. This module has
          been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows
          2003 SP2.

Check method (fingerprinting):
# It forces an huge allocation, which should fail,
    # and return back an error answer from the server
    # while parsing the packet header.
    pkt = build_pkt(0xffffffff)
    res = send_pkt(pkt)
    if valid_response?(res)
      return Exploit::CheckCode::Detected('Yokogawa BKHOdeq service detected')
    end

    Exploit::CheckCode::Safe('Yokogawa BKHOdeq service not detected')
  end
Metasploit Module: Iconics GENESIS32 Integer Overflow Version 9.21.201.01
Type: exploit
Path: modules/exploits/windows/scada/iconics_genbroker.rb
Platform: win
Disclosure date: 2011-03-21
References: OSVDB-72817, URL-http://aluigi.org/adv/genesis_4-adv.txt, URL-https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-11-080-02

Description:
The GenBroker service on port 38080 is affected by three integer overflow
          vulnerabilities while handling opcode 0x4b0, which is caused by abusing the
          the memory allocations needed for the number of elements passed by the client.
          This results unexpected behaviors such as direct registry calls, memory location
          calls, or arbitrary remote code execution.  Please note that in order to ensure
          reliability, this exploit will try to open calc (hidden), inject itself into the
          process, and then open up a shell session.  Also, DEP bypass is supported.
Metasploit Module: Sielco Sistemi Winlog Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/winlog_runtime.rb
Platform: win
Disclosure date: 2011-01-13
References: CVE-2011-0517, OSVDB-70418, URL-http://aluigi.org/adv/winlog_1-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-017-02

Description:
This module exploits a buffer overflow in Sielco
          Sistem Winlog <= 2.07.00. When sending a specially formatted
          packet to the Runtime.exe service, an attacker may be able to
          execute arbitrary code.
Metasploit Module: mySCADA myPRO Manager Unauthenticated Command Injection (CVE-2024-47407)
Type: exploit
Path: modules/exploits/windows/scada/mypro_mgr_cmd.rb
Platform: win
Disclosure date: 2024-11-21
Authors: Michael Heinzl
References: URL-https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07, CVE-2024-47407
Targets: Windows_Fetch

Description:
Unauthenticated Command Injection in MyPRO Manager <= v1.2 from mySCADA.
          The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of the myscada9 administrative user that is automatically added by the product.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'assets/index-Aup6jYxO.js')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return CheckCode::Unknown('Connection failed')
    end

    if res.to_s =~ /const v="([^"]+)"/
      version = ::Regexp.last_match(1)
      vprint_status('Version retrieved: ' + version)
      if Rex::Version.new(version) <= Rex::Version.new('1.2')
        return CheckCode::Appears("Version #{version} appears vulnerable")
      end

      return CheckCode::Safe("Version #{version} is not vulnerable")
    end
    return CheckCode::Unknown('Could not determine version')
  end
Metasploit Module: Measuresoft ScadaPro Remote Command Execution
Type: exploit
Path: modules/exploits/windows/scada/scadapro_cmdexe.rb
Platform: win
Disclosure date: 2011-09-16
References: CVE-2011-3497, OSVDB-75490, BID-49613, URL-http://aluigi.altervista.org/adv/scadapro_1-adv.txt, URL-http://us-cert.gov/control_systems/pdf/ICS-ALERT-11-256-04.pdf, URL-http://www.measuresoft.net/news/post/Inaccurate-Reports-of-Measuresoft-ScadaPro-400-Vulnerability.aspx

Description:
This module allows remote attackers to execute arbitrary commands on the
          affected system by abusing via Directory Traversal attack when using the
          'xf' command (execute function). An attacker can execute system() from
          msvcrt.dll to upload a backdoor and gain remote code execution. This
          vulnerability affects version 4.0.0 and earlier.
Metasploit Module: MOXA Device Manager Tool 2.1 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/moxa_mdmtool.rb
Platform: win
Disclosure date: 2010-10-20
References: CVE-2010-4741, OSVDB-69027, URL-http://www.reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-10-301-01A

Description:
This module exploits a stack buffer overflow in MOXA MDM Tool 2.1.
          When sending a specially crafted MDMGw (MDM2_Gateway) response, an
          attacker may be able to execute arbitrary code.
Metasploit Module: InduSoft Web Studio Arbitrary Upload Remote Code Execution
Type: exploit
Path: modules/exploits/windows/scada/indusoft_webstudio_exec.rb
Platform: win
Disclosure date: 2011-11-04
References: CVE-2011-4051, OSVDB-77179, BID-50675, ZDI-11-330

Description:
This module exploits a lack of authentication and authorization on the InduSoft
          Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to
          the filesystem, by abusing the functions provided by the software.

          The module uses the Windows Management Instrumentation service to execute an
          arbitrary payload on vulnerable installations of InduSoft Web Studio on Windows pre
          Vista. It has been successfully tested on InduSoft Web Studio 6.1 SP6 over Windows
          XP SP3 and Windows 2003 SP2.

Check method (fingerprinting):
connect

    # Get Application version
    data = [0x14].pack("C")
    sock.put(data)
    app_info = sock.get_once
    disconnect

    if app_info =~ /InduSoft Web Studio v6\.1/
      return Exploit::CheckCode::Appears('InduSoft Web Studio v6.1 detected')
    elsif app_info =~ /InduSoft Web Studio/
      return Exploit::CheckCode::Detected('InduSoft Web Studio detected but version not confirmed vulnerable')
    end

    return Exploit::CheckCode::Safe('InduSoft Web Studio not detected')
  end
Metasploit Module: DIAEnergie SQL Injection (CVE-2024-4548)
Type: exploit
Path: modules/exploits/windows/scada/diaenergie_sqli.rb
Platform: win
Disclosure date: 2024-05-06
References: URL-https://www.tenable.com/security/research/tra-2024-13, CVE-2024-4548
Targets: Windows_Fetch

Description:
SQL injection vulnerability in DIAEnergie <= v1.10 from Delta Electronics.
          This vulnerability can be exploited by an unauthenticated remote attacker to gain arbitrary code execution through a SQL injection vulnerability in the CEBC service. The commands will get executed in the context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      connect
      sock.put 'Who is it?'
      res = sock.get || ''
    rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown('Connection failed')
    ensure
      disconnect
    end

    if res.empty?
      vprint_status('Received an empty response.')
      return Exploit::CheckCode::Unknown('Received an empty response')
    end

    vprint_status('Who is it response: ' + res.to_s)
    version_pattern = /\b\d+\.\d+\.\d+\.\d+\b/
    version = res.match(version_pattern)

    if version.nil?
      return Exploit::CheckCode::Detected('DIAEnergie service detected but could not determine version')
    end

    vprint_status('Version retrieved: ' + version[0])

    unless Rex::Version.new(version[0]) <= Rex::Version.new('1.10.1.8610')
      return CheckCode::Safe("Version #{version[0]} is not vulnerable")
    end

    return CheckCode::Appears("Version #{version[0]} appears vulnerable")
  end
Metasploit Module: Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/delta_ia_commgr_bof.rb
Platform: win
Disclosure date: 2018-07-02
References: CVE-2018-10594, BID-104529, ZDI-18-586, ZDI-18-588, EDB-44965, URL-https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01

Description:
This module exploits a stack based buffer overflow in Delta Electronics Delta Industrial
          Automation COMMGR 1.08. The vulnerability exists in COMMGR.exe when handling specially
          crafted packets. This module has been tested successfully on Delta Electronics Delta
          Industrial Automation COMMGR 1.08 over
          Windows XP SP3,
          Windows 7 SP1, and
          Windows 8.1.
Metasploit Module: mySCADA MyPRO Authenticated Command Injection (CVE-2023-28384)
Type: exploit
Path: modules/exploits/windows/scada/mypro_cmdexe.rb
Platform: win
Disclosure date: 2022-09-22
Authors: Michael Heinzl
References: URL-https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06, CVE-2023-28384
Targets: Windows_Fetch

Description:
Authenticated Command Injection in MyPRO <= v8.28.0 from mySCADA.
          The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'l.fcgi'),
        'vars_post' => {
          't' => '98'
        }
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return CheckCode::Unknown('Connection failed')
    end

    if res && res.code == 200
      data = res.get_json_document
      version = data['V']
      if version.nil?
        return CheckCode::Unknown('Version field not found in response')
      else
        vprint_status('Version retrieved: ' + version)
      end

      if Rex::Version.new(version) <= Rex::Version.new('8.28')
        return CheckCode::Appears("Version #{version} appears vulnerable")
      else
        return CheckCode::Safe("Version #{version} is not vulnerable")
      end
    else
      return CheckCode::Unknown('Unexpected response from target')
    end
  end
Metasploit Module: SCADA 3S CoDeSys Gateway Server Directory Traversal
Type: exploit
Path: modules/exploits/windows/scada/codesys_gateway_server_traversal.rb
Platform: win
Disclosure date: 2013-02-02
References: CVE-2012-4705, OSVDB-90368, URL-http://ics-cert.us-cert.gov/pdf/ICSA-13-050-01-a.pdf

Description:
This module exploits a directory traversal vulnerability that allows arbitrary
          file creation, which can be used to execute a mof file in order to gain remote
          execution within the SCADA system.
Metasploit Module: Interactive Graphical SCADA System Remote Command Injection
Type: exploit
Path: modules/exploits/windows/scada/igss_exec_17.rb
Platform: win
Disclosure date: 2011-03-21
References: CVE-2011-1566, OSVDB-72349, URL-http://aluigi.org/adv/igss_8-adv.txt

Description:
This module abuses a directory traversal flaw in Interactive
          Graphical SCADA System v9.00. In conjunction with the traversal
          flaw, if opcode 0x17 is sent to the dc.exe process, an attacker
          may be able to execute arbitrary system commands.
Metasploit Module: Siemens FactoryLink 8 CSService Logging Path Param Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/factorylink_csservice.rb
Platform: win
Disclosure date: 2011-03-25
References: OSVDB-72812, URL-http://aluigi.altervista.org/adv/factorylink_1-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-091-01

Description:
This module exploits a vulnerability found on Siemens FactoryLink 8. The
          vulnerability occurs when CSService.exe processes a CSMSG_ListFiles_REQ message,
          the user-supplied path first gets converted to ANSI format (CodePage 0), and then
          gets handled by a logging routine where proper bounds checking is not done,
          therefore causing a stack-based buffer overflow, and results arbitrary code execution.
Metasploit Module: DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin_scpc_initialize.rb
Platform: win
Disclosure date: 2010-10-15
References: OSVDB-68812, CVE-2010-4142, URL-http://aluigi.altervista.org/adv/realwin_1-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-10-313-01

Description:
This module exploits a stack buffer overflow in DATAC Control
          International RealWin SCADA Server 2.0 (Build 6.1.8.10).
          By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
Metasploit Module: RealWin SCADA Server DATAC Login Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin_on_fcs_login.rb
Platform: win
Disclosure date: 2011-03-21
References: CVE-2011-1563, OSVDB-72824, URL-http://aluigi.altervista.org/adv/realwin_2-adv.txt, URL-http://www.dataconline.com/software/realwin.php, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-110-01

Description:
This module exploits a stack buffer overflow in DATAC Control
          International RealWin SCADA Server 2.1 (Build 6.0.10.10) or
          earlier.  By sending a specially crafted On_FC_CONNECT_FCS_LOGIN
          packet containing a long username, an attacker may be able to
          execute arbitrary code.
Metasploit Module: DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin_scpc_txtevent.rb
Platform: win
Disclosure date: 2010-11-18
References: CVE-2010-4142, OSVDB-68812

Description:
This module exploits a stack buffer overflow in DATAC Control
          International RealWin SCADA Server 2.0 (Build 6.1.8.10).
          By sending a specially crafted packet,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Yokogawa CS3000 BKFSim_vhfd.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/yokogawa_bkfsim_vhfd.rb
Platform: win
Disclosure date: 2014-05-23
References: CVE-2014-3888, URL-http://jvn.jp/vu/JVNVU95045914/index.html, URL-http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0002E.pdf, URL-https://www.rapid7.com/blog/post/2014/07/07/r7-2014-06-disclosure-yokogawa-centum-cs-3000-bkfsimvhfdexe-buffer-overflow

Description:
This module exploits a stack based buffer overflow on Yokogawa CS3000. The vulnerability
          exists in the service BKFSim_vhfd.exe when using malicious user-controlled data to create
          logs using functions like vsprintf and memcpy in an insecure way. This module has been
          tested successfully on Yokogawa Centum CS3000 R3.08.50 over Windows XP SP3.
Metasploit Module: ICONICS WebHMI ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/iconics_webhmi_setactivexguid.rb
Platform: win
Disclosure date: 2011-05-05
References: CVE-2011-2089, OSVDB-72135, URL-http://www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf, EDB-17240, URL-https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-11-080-02

Description:
This module exploits a vulnerability found in ICONICS WebHMI's ActiveX control.
          By supplying a long string of data to the 'SetActiveXGUID' parameter, GenVersion.dll
          fails to do any proper bounds checking before this input is copied onto the stack,
          which causes a buffer overflow, and results arbitrary code execution under the context
          of the user.
Metasploit Module: DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin_on_fc_binfile_a.rb
Platform: win
Disclosure date: 2011-03-21
References: CVE-2011-1563, OSVDB-72826, BID-46937, URL-http://aluigi.altervista.org/adv/realwin_5-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-110-01

Description:
This module exploits a vulnerability found in DATAC Control International RealWin
          SCADA Server 2.1 and below. By supplying a specially crafted On_FC_BINFILE_FCS_*FILE
          packet via port 910, RealWin will try to create a file (which would be saved to
          C:\Program Files\DATAC\Real Win\RW-version\filename) by first copying the user-
          supplied filename with an inline memcpy routine without proper bounds checking, which
          results a stack-based buffer overflow, allowing arbitrary remote code execution.

          Tested version: 2.0 (Build 6.1.8.10)