Exploit-DB #17885
Description: sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-09-23
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Sunway ForceControl
              http://www.sunwayland.com.cn/pro.asp
Versions:     <= 6.1 sp3 with AngelServer and WebServer updated
Platforms:    Windows
Bugs:         various stack overflows
              directory traversals
              third party ActiveX code execution
              various Denials of Service
Exploitation: remote
Date:         22 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


ForceControl is a chinese SCADA/HMI software.


#######################################################################

=======
2) Bugs
=======

-----------------------------
A] AngelServer stack overflow
-----------------------------

Signed comparison in packet 8 of AngelServer that leads to a stack
overflow:

  004022E1   > B9 19000000       MOV ECX,19
  004022E6   . 33C0              XOR EAX,EAX
  004022E8   . 8D7C24 24         LEA EDI,DWORD PTR SS:[ESP+24]
  004022EC   . 83FE 64           CMP ESI,64                     ; our value
  004022EF   . F3:AB             REP STOS DWORD PTR ES:[EDI]
  004022F1   . 0F8D E7000000     JGE AngelSer.004023DE          ; signed
  004022F7   . 8BCE              MOV ECX,ESI
  004022F9   . 8D75 0C           LEA ESI,DWORD PTR SS:[EBP+C]
  004022FC   . 8BD1              MOV EDX,ECX
  004022FE   . 8D7C24 24         LEA EDI,DWORD PTR SS:[ESP+24]
  00402302   . C1E9 02           SHR ECX,2                      ; memcpy
  00402305   . F3:A5             REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
  00402307   . 8BCA              MOV ECX,EDX
  00402309   . 8D4424 24         LEA EAX,DWORD PTR SS:[ESP+24]
  0040230D   . 83E1 03           AND ECX,3
  00402310   . 50                PUSH EAX
  00402311   . F3:A4             REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
  00402313   . 8B8C24 A0000000   MOV ECX,DWORD PTR SS:[ESP+A0]
  0040231A   . E8 A1FDFFFF       CALL AngelSer.004020C0
  0040231F   . E9 BA000000       JMP AngelSer.004023DE


--------------------------------
B] WebServer directory traversal
--------------------------------

Through the usage of a 3-dots pattern it's possible to download the
files located in the disk of the project used by WebServer.


--------------------------------------------
C] various Denials of Service in AngelServer
--------------------------------------------

The AngelServer program is affected by various problems that lead to
Denial of Service effects:

- exception handler due to unallocable memory through packet 6
- invalid memory read access during memcpy through packet 6
- whole system reboot through packet 6
- endless loop during the handling of the interfaces through packet 6
- whole system reboot through packet 7


-------------------------------------
D] third party ActiveX code execution
-------------------------------------

This software is bundled with the "Cell Software"'s YRWXls.ocx ActiveX
component (BD9E5104-2F20-4A9F-AB14-82D558FF374E version 5.3.7.321 which
is the latest) and it's affected by a vulnerability in the Login method:

  eax=886641aa ebx=02c55aac ecx=015ebd5c edx=886641ab esi=886641aa edi=015ebd88
  eip=02c01db2 esp=015ebd10 ebp=02c867c0 iopl=0         nv up ei ng nz na pe nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010286
  YRWXls!DllRegisterServer+0x2ab62:
  02c01db2 8a08            mov     cl,byte ptr [eax]          ds:0023:886641aa=??
  0:008> gn
  (a1c.e00): Access violation - code c0000005 (first chance)
  First chance exceptions are reported before any exception handling.
  This exception may be expected and handled.
  eax=00000000 ebx=00000000 ecx=6ed9b6fc edx=7c8285f6 esi=00000000 edi=00000000
  eip=6ed9b6fc esp=015eb948 ebp=015eb968 iopl=0         nv up ei pl zr na pe nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
  6ed9b6fc ??              ???

No additional research has been performed on the vulnerability, anyway
in my test it's necessary to load any other unsafe ActiveX component
first (tested on Windows 2003).


-------------------------------------
E] stack overflow in SNMP NetDBServer
-------------------------------------

Stack overflow caused by the copying of data chunks in a stack buffer:

  0040303A  |. 66:8B40 0A     MOV AX,WORD PTR DS:[EAX+A]        ; chunks
  0040303E  |. 0FBFC0         MOVSX EAX,AX
  00403041  |. 3BC7           CMP EAX,EDI
  00403043  |. 0F8E AC000000  JLE SNMP_Net.004030F5
  00403049  |. 894424 14      MOV DWORD PTR SS:[ESP+14],EAX
  0040304D  |> B9 10000000    /MOV ECX,10
  00403052  |. 33C0           |XOR EAX,EAX
  00403054  |. 8D7C24 2C      |LEA EDI,DWORD PTR SS:[ESP+2C]
  00403058  |. 83C3 02        |ADD EBX,2
  0040305B  |. F3:AB          |REP STOS DWORD PTR ES:[EDI]
  0040305D  |. 8B46 2C        |MOV EAX,DWORD PTR DS:[ESI+2C]
  00403060  |. 43             |INC EBX
  00403061  |. 8D7C24 2C      |LEA EDI,DWORD PTR SS:[ESP+2C]
  00403065  |. 66:8B6C18 FD   |MOV BP,WORD PTR DS:[EAX+EBX-3]   ; chunk num
  0040306A  |. 8A4C18 FF      |MOV CL,BYTE PTR DS:[EAX+EBX-1]   ; chunk size
  0040306E  |. 884C24 20      |MOV BYTE PTR SS:[ESP+20],CL
  00403072  |. 8D3418         |LEA ESI,DWORD PTR DS:[EAX+EBX]
  00403075  |. 8B5424 20      |MOV EDX,DWORD PTR SS:[ESP+20]
  00403079  |. 81E2 FF000000  |AND EDX,0FF
  0040307F  |. 8BCA           |MOV ECX,EDX
  00403081  |. 03DA           |ADD EBX,EDX                      ; concatenate
  00403083  |. 8BC1           |MOV EAX,ECX
  00403085  |. C1E9 02        |SHR ECX,2