####################################################################### Luigi Auriemma Application: DATAC RealWin http://www.dataconline.com/software/realwin.php http://www.realflex.com Versions: <= 2.0 (Build 6.1.8.10) Platforms: Windows Bugs: A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF B] stack overflow in SCPC_TXTEVENT Exploitation: remote, versus server Date: 15 Oct 2010 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== "RealWin is a SCADA server package for medium / small applications." ####################################################################### ======= 2) Bugs ======= ----------------------------------------------------------- A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF ----------------------------------------------------------- The service of the server running on port 912 is vulnerable to a stack based buffer-overflow caused by the usage of sprintf() for building a particular string with the data supplied by the attacker: sprintf( stack_buffer, "C:\\Program Files\\...path_of_RealWin...\\data\\crt\\fwd\\tel\\%s.%d", attacker_string, attacker_16bit_number); ---------------------------------- B] stack overflow in SCPC_TXTEVENT ---------------------------------- The same server is vulnerable also to another stack based overflow caused by the usage of strcpy() with the data supplied by the attacker. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/realwin_1.zip nc SERVER 912 < realwin_1a.dat nc SERVER 912 < realwin_1b.dat nc SERVER 912 < realwin_1c.dat ####################################################################### ====== 4) Fix ====== No fix. #######################################################################