Hi,

I have just uploaded an exploit for DATAC RealWin 2.0, a SCADA software used in small/medium installations. The version available for download is likely an old one so newer versions may, or may not, be vulnerable. Note that the server is affected by other flaws, but this one is pretty clear and 100% reliable.

The bug is a classic stack overflow while processing a specially crafted FC_INFOTAG/SET_CONTROL packet. RealWin server accepts connections from FlewWin clients which use a propietary protocol. We can exploit this flaw from remote without having valid credentials .

.text:0042BFFE                 call    sub_419690 ; Get Packet.PayloadLen

.text:0042C003                 movzx   ecx, ax
.text:0042C006                 mov     edx, ecx
.text:0042C008                 shr     ecx, 2
.text:0042C00B                 mov     esi, ebx

.text:0042C00D                 lea     edi, [esp+638h+var_2E0]
.text:0042C014                 rep movsd
.text:0042C016                 mov     ecx, edx
.text:0042C018                 and     ecx, 3

.text:0042C01B                 rep movsb