CVE-2010-4142
DATAC RealWin <= 2.0 Build 6.1.8.10 - Stack-Based Buffer Overflow via Long SCPC Packet
Title source: llmExploitation Summary
EIP tracks 8 public exploits for CVE-2010-4142.
PoCs published by Metasploit, blake, Luigi Auriemma, including Metasploit module exploits/windows/scada/realwin_scpc_txtevent.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in DATAC RealWin SCADA Server via a crafted packet sent to port 912. It leverages SEH overwrite and a hardcoded return address to achieve remote code execution.
Description
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPC_INITIALIZE, (2) SCPC_INITIALIZE_RF, or (3) SCPC_TXTEVENT packet. NOTE: it was later reported that 1.06 is also affected by one of these requests.
Exploits (8)
This Metasploit module exploits a stack buffer overflow in DATAC RealWin SCADA Server via a crafted packet sent to port 912. It leverages SEH overwrite and a hardcoded return address to achieve remote code execution.
This exploit targets a stack buffer overflow in DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) via a crafted packet sent to port 912. It leverages SEH overwrite to achieve remote code execution.
This exploit targets a stack buffer overflow in DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) via a crafted packet sent to port 912. It leverages a pivot and return address to execute arbitrary payloads, achieving remote code execution.
This exploit targets a buffer overflow vulnerability in RealWin SCADA System 1.06 by overwriting the SEH (Structured Exception Handler) and executing a shell_bind_tcp payload. It sends a crafted payload to trigger the overflow and achieve remote code execution.
The exploit demonstrates a stack-based buffer overflow in DATAC RealWin SCADA server via two vulnerable functions (SCPC_INITIALIZE and SCPC_TXTEVENT) on port 912. The PoC uses crafted input to trigger overflows via sprintf and strcpy, leading to potential remote code execution.
This Metasploit module exploits a stack buffer overflow in DATAC RealWin SCADA Server by sending a crafted packet to trigger arbitrary code execution. It uses a pivot and return address to redirect execution flow to the payload.
This Metasploit module exploits a stack buffer overflow in DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) via a crafted SCPC_INITIALIZE packet. It leverages SEH overwrite to achieve remote code execution.
This Metasploit module exploits a stack buffer overflow in DATAC RealWin SCADA Server by sending a crafted packet to trigger arbitrary code execution via SEH overwrite. It targets a specific DLL version and includes payload handling for Windows systems.