Directory Traversal in 7-Technologies IGSS dc.exe

This repository contains a single Metasploit exploit module targeting 7-Technologies IGSS 9 Data Server and Data Collector services (CVE-2011-1565, CVE-2011-1566). The exploit abuses vulnerabilities in the packet handling of these services to upload and execute arbitrary code on the target Windows system. The attack is performed in two stages: first, the payload (a Windows EXE) is sent in chunks to the Data Server on TCP port 12401 using specially crafted Write packets; second, an EXE packet is sent to the Data Collector on TCP port 12397, instructing it to execute the uploaded payload. The exploit is operational and leverages Metasploit's payload generation and delivery mechanisms. The main file is written in Ruby and follows the standard Metasploit module structure. No hardcoded IPs or domains are present, but the exploit targets specific TCP ports and file paths on the victim system.

This repository contains a single Metasploit module (modules/exploits/windows/scada/igss_exec_17.rb) that exploits a remote command injection vulnerability (CVE-2011-1566) in 7-Technologies Interactive Graphical SCADA System (IGSS) v9.00. The exploit abuses a directory traversal flaw in the IGSS dc.exe process, accessible over TCP port 12397. By sending a specially crafted packet with opcode 0x17, the module is able to execute arbitrary system commands on the target Windows system using cmd.exe. The payload is customizable and executed as the user running the vulnerable process. The module is written in Ruby and is designed for use within the Metasploit framework. No hardcoded IP addresses or domains are present, but the exploit targets a specific TCP port and file path on the remote system.