Exploitation Summary
EIP tracks 5 public exploits for CVE-2011-1567.
PoCs published by Metasploit, Luigi Auriemma, Luigi Auriemma, Lincoln, including Metasploit module exploits/windows/scada/igss9_igssdataserver_rename.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in 7-Technologies IGSS 9 IGSSdataServer via the 'Rename', 'Delete', or 'Add' commands. It uses an egghunter to locate the payload in memory due to limited stack space.
Description
Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted (1) ListAll, (2) Write File, (3) ReadFile, (4) Delete, (5) RenameFile, and (6) FileInfo commands in an 0xd opcode; (7) the Add, (8) ReadFile, (9) Write File, (10) Rename, (11) Delete, and (12) Add commands in an RMS report templates (0x7) opcode; and (13) 0x4 command in an STDREP request (0x8) opcode to TCP port 12401.
Exploits (5)
This Metasploit module exploits a buffer overflow in 7-Technologies IGSS 9 IGSSdataServer via the 'Rename', 'Delete', or 'Add' commands. It uses an egghunter to locate the payload in memory due to limited stack space.
This Metasploit module exploits a stack overflow in 7-Technologies IGSS <= v9.00.00 b11063 via a malformed ListAll command, allowing unauthenticated remote code execution by overwriting a structured exception handling record.
The exploit demonstrates multiple vulnerabilities in IGSSdataServer.exe, including directory traversal and remote stack overflows via crafted packets sent to port 12401. Proof-of-concept code is provided for downloading, uploading, and executing arbitrary files, as well as triggering buffer overflows.
This Metasploit module exploits a buffer overflow in 7-Technologies IGSS 9 IGSSdataServer via the 'Rename' command, achieving remote code execution through a multi-stage attack involving an egghunter and ROP chain.
This Metasploit module exploits a stack-based buffer overflow in 7-Technologies IGSS IGSSdataServer.exe (CVE-2011-1567) via a malformed ListAll command, allowing unauthenticated remote code execution. It uses ROP chains and an egghunter to bypass DEP and execute arbitrary payloads.