Yokogawa Centum CS 3000 BKHOdeq Remote Buffer Overflow Exploit

This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000 by using its BKHOdeq.exe service.



The BKHOdeq.exe service, started when running the FCS / Test Function listens by default on TCP/20109, TCP/20171 and UDP/1240. By sending a specially crafted packet to the port TCP/20171 it is possible to trigger a stack based buffer overflow which allows execution of arbitrary code with the privileges of the CENTUM user.