# 通过 S7comm 协议发送特制 PDU（概念性验证，需使用专用工具）
# 此处使用 Python 脚本替代
python3 cve_2020_15782_check.py 192.168.1.100

#!/usr/bin/env python3
"""CVE-2020-15782 漏洞检测脚本 - Siemens S7-1500 内存保护绕过"""
import socket
import struct
import sys

def build_s7comm_connect():
    """构建 S7comm COTP 连接请求"""
    cotp = bytes([
        0x03, 0x00, 0x00, 0x16,
        0x11, 0xD0, 0x01, 0x00,
        0x01, 0x00, 0x01, 0x00,
        0xC1, 0x02, 0x01, 0x00,
        0xC2, 0x02, 0x01, 0x02,
        0xC0, 0x01, 0x09
    ])
    return cotp

def build_s7comm_setup():
    """构建 S7comm PDU Setup 请求"""
    s7 = bytes([
        0x03, 0x00, 0x00, 0x19,
        0x02, 0xF0, 0x80, 0x32,
        0x01, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x08, 0x00,
        0x00, 0x00, 0x00, 0xF0,
        0x00, 0x00, 0x01, 0x00,
        0x01, 0x00
    ])
    return s7

def check_vulnerability(target, port=102):
    """检测目标是否存在 CVE-2020-15782 漏洞"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target, port))

        sock.send(build_s7comm_connect())
        resp = sock.recv(1024)
        if not resp:
            sock.close()
            return False

        sock.send(build_s7comm_setup())
        resp = sock.recv(1024)

        if len(resp) > 0 and resp[0] == 0x03:
            sock.close()
            return True

        sock.close()
        return False
    except Exception as e:
        print(f"[!] 连接错误: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)

    target = sys.argv[1]
    result = check_vulnerability(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2020-15782 S7-1500 内存保护绕过")

id: CVE-2020-15782

info:
  name: Siemens S7-1500 内存保护绕过
  author: x7peeps
  severity: critical
  description: Siemens SIMATIC S7-1200/S7-1500 PLC 存在内存保护绕过漏洞，远程未认证攻击者可通过端口102/tcp向设备写入任意数据
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15782
    - https://www.cisa.gov/news-events/ics-advisories/icsa-20-164-01
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-15782
    cwe-id: CWE-119
  tags: cve,cve2020,siemens,s7-1500,ics,ot,rce

tcp:
  - inputs:
      - data: "0300001611d0010001000100c1020100c2020102c00109"
        read: 1024
        host: "{{Hostname}}"

    host: "{{Hostname}}"
    port: 102

    matchers:
      - type: word
        part: body
        words:
          - "0300"

# 上传恶意追踪文件到 S7-1500 Web 界面
curl -k -X POST "https://TARGET/web/cgi-bin/tracing" \
  -H "Content-Type: multipart/form-data" \
  -F "tracefile=@malicious_trace.trc"

#!/usr/bin/env python3
"""CVE-2025-40943 漏洞检测脚本 - Siemens S7-1500 追踪文件注入"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测目标 Web 界面是否可访问且存在追踪文件上传接口"""
    url = f"https://{target}/web/"
    try:
        r = requests.get(url, verify=False, timeout=10)
        if r.status_code == 200 and "SIMATIC" in r.text:
            trace_url = f"https://{target}/web/cgi-bin/tracing"
            r2 = requests.get(trace_url, verify=False, timeout=10)
            if r2.status_code != 404:
                return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2025-40943 S7-1500 追踪文件注入")

id: CVE-2025-40943

info:
  name: Siemens S7-1500 追踪文件代码注入
  author: x7peeps
  severity: high
  description: Siemens SIMATIC S7-1500 Web界面追踪文件导入存在代码注入漏洞
  reference:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-04
  classification:
    cve-id: CVE-2025-40943
  tags: cve,cve2025,siemens,s7-1500,ics,code-injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/"
      - "{{BaseURL}}/web/cgi-bin/tracing"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SIMATIC"
      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""CVE-2019-6575 检测脚本 - Siemens OPC UA DoS"""
import socket
import sys

def check(target, port=4840):
    """发送畸形 OPC UA Hello 请求检测漏洞"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        hello = b'\x00' * 1024
        sock.send(hello)

        try:
            resp = sock.recv(256)
            if len(resp) == 0:
                return True
        except socket.timeout:
            return True

        sock.close()
        return False
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2019-6575 OPC UA DoS")

id: CVE-2019-6575

info:
  name: Siemens OPC UA 拒绝服务
  author: x7peeps
  severity: high
  description: Siemens多款产品OPC UA服务端存在拒绝服务漏洞
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-6575
  classification:
    cvss-score: 7.5
    cve-id: CVE-2019-6575
  tags: cve,cve2019,siemens,opc-ua,denial-of-service,ics

tcp:
  - inputs:
      - data: "00000000"
        read: 512
    host: "{{Hostname}}"
    port: 4840
    matchers:
      - type: binary
        binary:
          - "0000"

#!/usr/bin/env python3
"""CVE-2022-45789 检测脚本 - Schneider Modicon Modbus认证绕过"""
import socket
import struct
import sys

def check_modbus(target, port=502):
    """检测 Modbus 设备是否暴露且未设置应用密码保护"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        mbap = struct.pack('>HHHBB', 0x0001, 0x0000, 0x0006, 0x01, 0x03)
        payload = mbap + struct.pack('>HH', 0x0000, 0x0001)
        sock.send(payload)

        resp = sock.recv(1024)
        sock.close()

        if len(resp) >= 9 and resp[7] == 0x03:
            exc_code = resp[8] if len(resp) > 8 else None
            if exc_code is None or exc_code == 0x00:
                return True
            elif exc_code in (0x02, 0x08):
                return False
            return True
        return False
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check_modbus(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2022-45789 Modicon Modbus认证绕过")

id: CVE-2022-45789

info:
  name: Schneider Modicon Modbus认证绕过
  author: x7peeps
  severity: high
  description: Schneider Electric Modicon PLC存在Modbus协议认证绕过漏洞，可通过捕获重放攻击执行未授权操作
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45789
    - https://www.cisa.gov/news-events/ics-advisories/icsa-23-227-01
  classification:
    cvss-score: 8.1
    cve-id: CVE-2022-45789
    cwe-id: CWE-294
  tags: cve,cve2022,schneider,modicon,modbus,auth-bypass,ics

tcp:
  - host:
      - "{{Hostname}}"
    port: 502
    inputs:
      - data: "000100000006010300000001"
        read: 1024
    matchers:
      - type: binary
        binary:
          - "0303"

#!/usr/bin/env python3
"""CVE-2022-45788 检测脚本 - Schneider Modicon 未授权RCE"""
import socket
import sys

def check(target, port=502):
    """检测 Modicon PLC 是否响应未认证的功能码请求"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        # 功能码 43 (Read Device Identification)
        mbap = b'\x00\x01\x00\x00\x00\x06\x01\x2b'
        payload = mbap + b'\x0e\x01\x00'
        sock.send(payload)

        resp = sock.recv(1024)
        sock.close()

        if len(resp) > 9 and resp[7] == 0x2b:
            return True
        return False
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2022-45788 Modicon 未授权RCE")

id: CVE-2022-45788

info:
  name: Schneider Modicon 未授权RCE
  author: x7peeps
  severity: high
  description: Schneider Electric Modicon PLC存在未授权远程代码执行漏洞
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45788
  classification:
    cvss-score: 7.5
    cve-id: CVE-2022-45788
  tags: cve,cve2022,schneider,modicon,rce,ics

tcp:
  - host:
      - "{{Hostname}}"
    port: 502
    inputs:
      - data: "000100000006012b0e0100"
        read: 1024
    matchers:
      - type: binary
        binary:
          - "2b"

#!/usr/bin/env python3
"""CVE-2024-11737 检测脚本 - Schneider Modicon M241/M251"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 Modicon M241/M251 Web 管理界面"""
    urls = [
        f"https://{target}/",
        f"http://{target}/",
    ]
    for url in urls:
        try:
            r = requests.get(url, verify=False, timeout=10, allow_redirects=True)
            if r.status_code == 200:
                if "Modicon" in r.text or "M241" in r.text or "M251" in r.text or "Machine" in r.text:
                    return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2024-11737 Modicon M241/M251")

id: CVE-2024-11737

info:
  name: Schneider Modicon M241/M251 高危漏洞
  author: x7peeps
  severity: critical
  description: Schneider Electric Modicon M241/M251存在CVSS 9.8的高危漏洞
  reference:
    - https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/
  classification:
    cvss-score: 9.8
    cve-id: CVE-2024-11737
  tags: cve,cve2024,schneider,modicon,ics,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "Modicon"
          - "M241"
          - "M251"
        condition: or

#!/usr/bin/env python3
"""CVE-2023-3595 检测脚本 - Rockwell ControlLogix RCE"""
import socket
import struct
import sys

def check(target, port=44818):
    """检测 EtherNet/IP 通信模块是否暴露"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        # Ethernet/IP List Identity request
        encaps = struct.pack('<HHIIQ', 0x0063, 24, 0x00000000, 0x00000000, 0)
        sock.send(encaps)

        resp = sock.recv(1024)
        sock.close()

        if len(resp) >= 24:
            cmd = struct.unpack('<H', resp[0:2])[0]
            if cmd == 0x0063:
                return True
        return False
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2023-3595 ControlLogix RCE")

id: CVE-2023-3595

info:
  name: Rockwell ControlLogix EtherNet/IP RCE
  author: x7peeps
  severity: critical
  description: Rockwell Automation Allen-Bradley ControlLogix 1756-EN2*/EN3* 通信模块存在越界写入漏洞，可导致远程代码执行
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3595
    - https://www.cisa.gov/news-events/ics-advisories/icsa-23-193-01
  classification:
    cvss-score: 9.8
    cve-id: CVE-2023-3595
    cwe-id: CWE-787
  tags: cve,cve2023,rockwell,controllogix,enip,rce,ics

tcp:
  - host:
      - "{{Hostname}}"
    port: 44818
    inputs:
      - data: "6300180000000000000000000000000001000000"
        read: 1024
    matchers:
      - type: binary
        binary:
          - "6300"

#!/usr/bin/env python3
"""CVE-2023-3596 检测脚本 - Rockwell ControlLogix DoS"""
import socket
import struct
import sys

def check(target, port=44818):
    """检测 ControlLogix EN4 模块是否暴露 EtherNet/IP"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        encaps = struct.pack('<HHIIQ', 0x0063, 24, 0, 0, 0)
        sock.send(encaps)
        resp = sock.recv(1024)
        sock.close()

        return len(resp) >= 24
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2023-3596 ControlLogix DoS")

id: CVE-2023-3596

info:
  name: Rockwell ControlLogix 拒绝服务
  author: x7peeps
  severity: high
  description: Rockwell Allen-Bradley ControlLogix 1756-EN4* 通信模块存在DoS漏洞
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3596
  classification:
    cvss-score: 7.5
    cve-id: CVE-2023-3596
  tags: cve,cve2023,rockwell,controllogix,denial-of-service,ics

tcp:
  - host:
      - "{{Hostname}}"
    port: 44818
    inputs:
      - data: "6300180000000000000000000000000001000000"
        read: 1024
    matchers:
      - type: binary
        binary:
          - "6300"

#!/usr/bin/env python3
"""CVE-2024-6242 检测脚本 - Rockwell Trusted Slot绕过"""
import socket
import struct
import sys

def check(target, port=44818):
    """检测 ControlLogix 设备是否暴露 CIP 服务"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        encaps = struct.pack('<HHIIQ', 0x0063, 24, 0, 0, 0)
        sock.send(encaps)
        resp = sock.recv(2048)
        sock.close()

        if len(resp) >= 24:
            return True
        return False
    except Exception:
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2024-6242 Trusted Slot绕过")

id: CVE-2024-6242

info:
  name: Rockwell ControlLogix Trusted Slot绕过
  author: x7peeps
  severity: high
  description: Rockwell Automation ControlLogix 1756 Trusted Slot安全特性可被绕过，导致未授权CIP命令执行
  reference:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-09
  classification:
    cvss-score: 8.4
    cve-id: CVE-2024-6242
  tags: cve,cve2024,rockwell,controllogix,auth-bypass,ics

tcp:
  - host:
      - "{{Hostname}}"
    port: 44818
    inputs:
      - data: "6300180000000000000000000000000001000000"
        read: 1024
    matchers:
      - type: binary
        binary:
          - "6300"

#!/usr/bin/env python3
"""CVE-2023-6357 检测脚本 - ABB AC500 Shell函数注入"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 ABB AC500 V3 Web 管理界面"""
    try:
        r = requests.get(f"https://{target}/", verify=False, timeout=10)
        if r.status_code == 200:
            if "ABB" in r.text or "AC500" in r.text or "Automation Builder" in r.text:
                return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2023-6357 AC500 Shell注入")

id: CVE-2023-6357

info:
  name: ABB AC500 Shell函数注入
  author: x7peeps
  severity: high
  description: ABB AC500 V3 PLC存在Shell函数注入漏洞，认证后可执行OS命令
  reference:
    - https://library.e.abb.com/public/c0edc1621795405f9b464d9919b93eed/3ADR011377%20AC500%20V3%20-%20Multiple%20vulnerabilities.pdf
  classification:
    cvss-score: 8.8
    cve-id: CVE-2023-6357
    cwe-id: CWE-78
  tags: cve,cve2023,abb,ac500,command-injection,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "ABB"
          - "AC500"
        condition: or

#!/usr/bin/env python3
"""CVE-2024-12429/12430 组合链检测 - ABB AC500 目录遍历+命令执行"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 AC500 V3 Web 界面暴露"""
    try:
        endpoints = [
            f"https://{target}/web/visualization",
            f"https://{target}/",
        ]
        for url in endpoints:
            r = requests.get(url, verify=False, timeout=10)
            if r.status_code == 200:
                return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2024-12430 AC500 命令执行")

id: CVE-2024-12430

info:
  name: ABB AC500 命令执行
  author: x7peeps
  severity: critical
  description: ABB AC500 V3通过目录遍历+命令注入组合链可实现root权限命令执行
  reference:
    - https://library.e.abb.com/public/c0edc1621795405f9b464d9919b93eed/3ADR011377%20AC500%20V3%20-%20Multiple%20vulnerabilities.pdf
  classification:
    cve-id: CVE-2024-12430
  tags: cve,cve2024,abb,ac500,command-execution,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "ABB"

#!/usr/bin/env python3
"""CVE-2023-0636 / CVE-2024-6209 检测脚本 - ABB Cylon ASPECT"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 Cylon ASPECT 系统是否暴露"""
    try:
        r = requests.get(f"http://{target}/", verify=False, timeout=10)
        if r.status_code == 200 and ("Cylon" in r.text or "ASPECT" in r.text or "aspect" in r.text):
            return True
        r2 = requests.get(f"https://{target}/", verify=False, timeout=10)
        if r2.status_code == 200 and ("Cylon" in r2.text or "ASPECT" in r2.text):
            return True
    except Exception:
        pass
    return False

def check_file_disclosure(target):
    """CVE-2024-6209 文件泄露检测"""
    paths = [
        "/downloads/aspect.db",
        "/api/auth/users",
        "/config/users",
    ]
    for path in paths:
        try:
            url = f"http://{target}{path}"
            r = requests.get(url, verify=False, timeout=5)
            if r.status_code == 200 and len(r.text) > 100:
                return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2023-0636 Cylon ASPECT RCE")
    if result:
        fd = check_file_disclosure(sys.argv[1])
        print(f"[{'+' if fd else '-'}] {sys.argv[1]} - CVE-2024-6209 Cylon ASPECT 文件泄露")

id: CVE-2023-0636

info:
  name: ABB Cylon ASPECT 命令注入RCE
  author: x7peeps
  severity: critical
  description: ABB Cylon ASPECT楼宇自动化系统存在命令注入漏洞，可实现远程代码执行
  reference:
    - https://www.vulncheck.com/blog/exploring-abb-ics-vulns
  classification:
    cve-id: CVE-2023-0636
  tags: cve,cve2023,abb,cylon,aspect,rce,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Cylon"
          - "ASPECT"
        condition: or
      - type: status
        status:
          - 200