updating the Hootoo writeup with some WIP IPCam notes
This commit is contained in:
Conor Horan-Kates
parent
eb09d9d8d0
commit
a6cf118018
693
hootoo/README.md
693
hootoo/README.md
@ -17,6 +17,8 @@ hoo2
|
|||||||
- [nmap](#nmap)
|
- [nmap](#nmap)
|
||||||
- [TripMate Nano](#tripmate-nano)
|
- [TripMate Nano](#tripmate-nano)
|
||||||
- [nmap](#nmap)
|
- [nmap](#nmap)
|
||||||
|
- [HooToo IPCam](#hootoo-ipcam)
|
||||||
|
- [nmap](#nmap)
|
||||||
|
|
||||||
i was initially interested in the HooToo TripMate Titan when someone on Twitter (thought it was @davepell, but can't find the tweet now) saying it was a great way to share battery/network/data from a single device.
|
i was initially interested in the HooToo TripMate Titan when someone on Twitter (thought it was @davepell, but can't find the tweet now) saying it was a great way to share battery/network/data from a single device.
|
||||||
|
|
||||||
@ -35,6 +37,7 @@ name|model|description|version|rooted?|services|vulnerabilities
|
|||||||
[TripMate](http://www.hootoo.com/hootoo-tripmate-ht-tm01-wireless-router.html)|HT-TM01|NAS/WiFi bridge/battery| firmware: `2.000.022`|yes|`telnet`, `http (80, 81)`|same as TripMate Titan
|
[TripMate](http://www.hootoo.com/hootoo-tripmate-ht-tm01-wireless-router.html)|HT-TM01|NAS/WiFi bridge/battery| firmware: `2.000.022`|yes|`telnet`, `http (80, 81)`|same as TripMate Titan
|
||||||
[TripMate Elite](http://www.hootoo.com/hootoo-tripmate-elite-ht-tm04-wireless-portable-router.html)|HT-TM06|NAS/WiFi bridge/battery/outlet|firmware: `2.000.004`|no|`http (80, 81)`|easily guessable default passwords, HTTP - variety
|
[TripMate Elite](http://www.hootoo.com/hootoo-tripmate-elite-ht-tm04-wireless-portable-router.html)|HT-TM06|NAS/WiFi bridge/battery/outlet|firmware: `2.000.004`|no|`http (80, 81)`|easily guessable default passwords, HTTP - variety
|
||||||
[TripMate Nano](http://www.hootoo.com/hootoo-tripmate-nano-ht-tm02-wireless-portable-router.html)|HT-TM02|NAS/WiFi bridge| firmware: `2.000.018`|yes|`telnet`, `http (80, 81)`, `unknown 85`|same as TripMate Titan
|
[TripMate Nano](http://www.hootoo.com/hootoo-tripmate-nano-ht-tm02-wireless-portable-router.html)|HT-TM02|NAS/WiFi bridge| firmware: `2.000.018`|yes|`telnet`, `http (80, 81)`, `unknown 85`|same as TripMate Titan
|
||||||
|
[Hootoo IPCam]()|RT_IPC6000|IP camera| firmware: `V2.5.5.2505-S50-HTA-B20151208B` |yes|`telnet`, `http`, `RTSP 554`|almost the same as TripMate Titan
|
||||||
|
|
||||||
while both TripMate Titan and TripMate are running the same version of firmware, and have the same services exposed, the web interfaces are very different.
|
while both TripMate Titan and TripMate are running the same version of firmware, and have the same services exposed, the web interfaces are very different.
|
||||||
|
|
||||||
@ -257,3 +260,693 @@ PORT STATE SERVICE VERSION
|
|||||||
85/tcp open tcpwrapped
|
85/tcp open tcpwrapped
|
||||||
Service Info: Host: TM02; OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
Service Info: Host: TM02; OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Hootoo IPCam
|
||||||
|
name|value
|
||||||
|
----|-----
|
||||||
|
model|RT_IPC6000
|
||||||
|
firmware|`V2.5.5.2505-S50-HTA-B20151208B`
|
||||||
|
features|IP camera with a surprisingly high level of configuration
|
||||||
|
app|[http://10.10.10.254](http://10.10.10.254)
|
||||||
|
|
||||||
|
while this device appears to be running a similar firmware/OS as the TripMate devices, and has similar services exposed, could not login via telnet with `root` or `admin`
|
||||||
|
|
||||||
|
the user specification page allows freeform username specification, tried to set `root`s password, but either failed, or was given a misleading error message from telnet.
|
||||||
|
|
||||||
|
the backup functionality here exposes a similar hole (configuration/files unrelated to user settings) as TripMate devices, but has a very different structure/content:
|
||||||
|
|
||||||
|
```
|
||||||
|
.
|
||||||
|
├── mnt
|
||||||
|
│ └── config
|
||||||
|
│ ├── exclude.lst
|
||||||
|
│ ├── ipcamera
|
||||||
|
│ │ ├── TZ
|
||||||
|
│ │ ├── adsl.conf
|
||||||
|
│ │ ├── bt656
|
||||||
|
│ │ │ ├── config_av.ini
|
||||||
|
│ │ │ ├── config_enc.ini
|
||||||
|
│ │ │ ├── config_md.ini
|
||||||
|
│ │ │ ├── config_mpmng.ini
|
||||||
|
│ │ │ └── config_od.ini
|
||||||
|
│ │ ├── conf_1080p
|
||||||
|
│ │ │ ├── config_cfgaccess.ini
|
||||||
|
│ │ │ ├── config_devm.ini
|
||||||
|
│ │ │ └── config_mpmng.ini
|
||||||
|
│ │ ├── conf_720p
|
||||||
|
│ │ │ ├── config_cfgaccess.ini
|
||||||
|
│ │ │ ├── config_devm.ini
|
||||||
|
│ │ │ └── config_mpmng.ini
|
||||||
|
│ │ ├── conf_960p
|
||||||
|
│ │ │ ├── config_cfgaccess.ini
|
||||||
|
│ │ │ ├── config_devm.ini
|
||||||
|
│ │ │ └── config_mpmng.ini
|
||||||
|
│ │ ├── conf_TrigOprt.ini
|
||||||
|
│ │ ├── conf_jsy
|
||||||
|
│ │ │ └── jsy.ini
|
||||||
|
│ │ ├── conf_tutk
|
||||||
|
│ │ │ └── tutk.ini
|
||||||
|
│ │ ├── config_alarmweb.ini
|
||||||
|
│ │ ├── config_button.ini
|
||||||
|
│ │ ├── config_capability.ini
|
||||||
|
│ │ ├── config_cd.ini
|
||||||
|
│ │ ├── config_cfgaccess.ini
|
||||||
|
│ │ ├── config_devm.ini
|
||||||
|
│ │ ├── config_electricity.ini
|
||||||
|
│ │ ├── config_emng.ini
|
||||||
|
│ │ ├── config_enc_workmode.ini
|
||||||
|
│ │ ├── config_ioalm.ini
|
||||||
|
│ │ ├── config_ircut.ini
|
||||||
|
│ │ ├── config_led.ini
|
||||||
|
│ │ ├── config_log.ini
|
||||||
|
│ │ ├── config_mail.ini
|
||||||
|
│ │ ├── config_maintenance.ini
|
||||||
|
│ │ ├── config_mtmng.ini
|
||||||
|
│ │ ├── config_mwalm.ini
|
||||||
|
│ │ ├── config_notify.ini
|
||||||
|
│ │ ├── config_ntp.ini
|
||||||
|
│ │ ├── config_osd.ini
|
||||||
|
│ │ ├── config_piclevel.ini
|
||||||
|
│ │ ├── config_playaudio.ini
|
||||||
|
│ │ ├── config_ptz.ini
|
||||||
|
│ │ ├── config_rec.ini
|
||||||
|
│ │ ├── config_recmng.ini
|
||||||
|
│ │ ├── config_rfidlist.ini
|
||||||
|
│ │ ├── config_server.ini
|
||||||
|
│ │ ├── config_snap_function.ini
|
||||||
|
│ │ ├── config_snap_mng.ini
|
||||||
|
│ │ ├── config_soundalm.ini
|
||||||
|
│ │ ├── config_sysalm.ini
|
||||||
|
│ │ ├── config_timer_mng.ini
|
||||||
|
│ │ ├── config_upnp.ini
|
||||||
|
│ │ ├── config_user.ini
|
||||||
|
│ │ ├── config_usergroup.ini
|
||||||
|
│ │ ├── ddns.conf
|
||||||
|
│ │ ├── ddns_enable.conf
|
||||||
|
│ │ ├── factory.conf
|
||||||
|
│ │ ├── fwup.conf
|
||||||
|
│ │ ├── hi_nvt_config
|
||||||
|
│ │ │ ├── audio_encoder_configuration.ini
|
||||||
|
│ │ │ ├── audio_source.ini
|
||||||
|
│ │ │ ├── audio_source_configuration.ini
|
||||||
|
│ │ │ ├── profile.ini
|
||||||
|
│ │ │ ├── ptz_configuration.ini
|
||||||
|
│ │ │ ├── scopes_list.ini
|
||||||
|
│ │ │ ├── video_encoder_configuration.ini
|
||||||
|
│ │ │ ├── video_source.ini
|
||||||
|
│ │ │ └── video_source_configuration.ini
|
||||||
|
│ │ ├── ipc1080p
|
||||||
|
│ │ │ ├── config_av.ini
|
||||||
|
│ │ │ ├── config_enc.ini
|
||||||
|
│ │ │ ├── config_md.ini
|
||||||
|
│ │ │ ├── config_mpmng.ini
|
||||||
|
│ │ │ └── config_od.ini
|
||||||
|
│ │ ├── ipc6000
|
||||||
|
│ │ │ ├── config_av.ini
|
||||||
|
│ │ │ ├── config_enc.ini
|
||||||
|
│ │ │ ├── config_md.ini
|
||||||
|
│ │ │ ├── config_mpmng.ini
|
||||||
|
│ │ │ └── config_od.ini
|
||||||
|
│ │ ├── ipcam_upnp.xml
|
||||||
|
│ │ ├── keypara.ini
|
||||||
|
│ │ ├── network
|
||||||
|
│ │ │ ├── interfaces.old
|
||||||
|
│ │ │ ├── netfaces
|
||||||
|
│ │ │ ├── resolv.conf
|
||||||
|
│ │ │ ├── setfixnet.sh
|
||||||
|
│ │ │ ├── wifi.conf
|
||||||
|
│ │ │ ├── wifidev.conf
|
||||||
|
│ │ │ ├── wpa_supp.conf
|
||||||
|
│ │ │ └── zcip.script
|
||||||
|
│ │ ├── onvif.ini
|
||||||
|
│ │ ├── p2p.conf
|
||||||
|
│ │ ├── p2p_stream.ini
|
||||||
|
│ │ ├── savetime.conf
|
||||||
|
│ │ └── webserver.conf
|
||||||
|
│ └── usr
|
||||||
|
│ ├── bin
|
||||||
|
│ │ └── ddnsrun -> /usr/sbin/ddns/ddnsrun.3322
|
||||||
|
│ ├── etc
|
||||||
|
│ │ └── sensor.conf
|
||||||
|
│ └── lib
|
||||||
|
│ ├── libSensor.so -> /usr/lib/libsns_ov9712a.so
|
||||||
|
│ └── libonvif.so -> /usr/lib/libonvif_def.so
|
||||||
|
└── tree
|
||||||
|
|
||||||
|
17 directories, 98 files
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
modified `exclude.lst` to try and pull in the right functionality:
|
||||||
|
|
||||||
|
```
|
||||||
|
NOT_config_devs.ini
|
||||||
|
NOT_config_net.ini
|
||||||
|
NOT_config_priv.ini
|
||||||
|
NOT_wifi.ini
|
||||||
|
NOT_ifattr
|
||||||
|
NOT_ddns_tvs.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
and restored it back to the device:
|
||||||
|
|
||||||
|
```
|
||||||
|
the ipcam will be restore. Are you sure?
|
||||||
|
```
|
||||||
|
|
||||||
|
no new functionality was exposed via nmap and still couldn't log in over telnet, but a second backup confirmed that my 'settings' were restored correctly. time to find another avenue.
|
||||||
|
|
||||||
|
`/mnt/config/ipcamera/network/wifi.conf` contains the current WiFI SSID/password:
|
||||||
|
```
|
||||||
|
wifienable="1"
|
||||||
|
wifiessid=TEST-WIFI
|
||||||
|
wifikeytype=3
|
||||||
|
wifiwhichkey=0
|
||||||
|
wifikey="TEST-WIFI"
|
||||||
|
```
|
||||||
|
|
||||||
|
`/mnt/config/ipcamera/config_server.ini` looks has an interesting block:
|
||||||
|
```ini
|
||||||
|
;
|
||||||
|
;[mctp]
|
||||||
|
;port = 8001
|
||||||
|
;
|
||||||
|
;[devs]
|
||||||
|
;port = 8002
|
||||||
|
;
|
||||||
|
;[es]
|
||||||
|
;port = 8003
|
||||||
|
;
|
||||||
|
```
|
||||||
|
|
||||||
|
`/mnt/config/ipcamera/config_mtmng.ini` appears to be what we're looking for:
|
||||||
|
```ini
|
||||||
|
[rtspsvr]
|
||||||
|
enable = 1
|
||||||
|
lisnport = 554
|
||||||
|
max_conn_num = 32
|
||||||
|
udp_sendport_min = 5000
|
||||||
|
udp_sendport_min = 6000
|
||||||
|
com_id = 012345678901234567890123
|
||||||
|
|
||||||
|
[httpsvr]
|
||||||
|
enable = 1
|
||||||
|
lisnport = 8800
|
||||||
|
max_conn_num = 32
|
||||||
|
...
|
||||||
|
[owspsvr]
|
||||||
|
enable = 1
|
||||||
|
max_conn_num = 4
|
||||||
|
server_ipaddr = "192.168.1.18"
|
||||||
|
server_port = 15960
|
||||||
|
username = "admin"
|
||||||
|
password = "admin"
|
||||||
|
quality = 1 ;0:32K,1:64K,2:128K,3:512K
|
||||||
|
companyIdentity = "LT4a7a46c5571ce"
|
||||||
|
...
|
||||||
|
[langtaodev]
|
||||||
|
server_ipaddr = "61.139.77.71"
|
||||||
|
server_port = 15961
|
||||||
|
username = "ip700"
|
||||||
|
password = "00"
|
||||||
|
deviceid = 1929
|
||||||
|
versionMajor = 2
|
||||||
|
versionMinor = 1
|
||||||
|
mediaType = 1 ;1:VIDEO,2;VIDEO & AUDIO
|
||||||
|
devideModule = 2 ; 1:MODULE_MASTER, 2:MODULE_PARSVE
|
||||||
|
chnId = 11 ;chnID: 011
|
||||||
|
|
||||||
|
[langtaodev-scdx1]
|
||||||
|
server_ipaddr = "61.139.77.71"
|
||||||
|
server_port = 15961
|
||||||
|
username = "ip700"
|
||||||
|
password = "00"
|
||||||
|
deviceid = 1929
|
||||||
|
versionMajor = 2
|
||||||
|
versionMinor = 1
|
||||||
|
mediaType = 1 ;1:VIDEO,2;VIDEO & AUDIO
|
||||||
|
devideModule = 2 ; 1:MODULE_MASTER, 2:MODULE_PARSVE
|
||||||
|
chnId = 11 ;chnID: 011
|
||||||
|
```
|
||||||
|
|
||||||
|
that last part is a bit concerning - whois `61.139.77.71`?
|
||||||
|
|
||||||
|
```
|
||||||
|
$ host 61.139.77.71
|
||||||
|
Host 71.77.139.61.in-addr.arpa. not found: 3(NXDOMAIN)
|
||||||
|
$ ping -c 3 61.139.77.71
|
||||||
|
PING 61.139.77.71 (61.139.77.71): 56 data bytes
|
||||||
|
Request timeout for icmp_seq 0
|
||||||
|
Request timeout for icmp_seq 1
|
||||||
|
Request timeout for icmp_seq 2
|
||||||
|
--- 61.139.77.71 ping statistics ---
|
||||||
|
3 packets transmitted, 0 packets received, 100.0% packet loss
|
||||||
|
```
|
||||||
|
|
||||||
|
`/mnt/config/ipcamera/config_log.ini` shows that syslog is disabled:
|
||||||
|
```ini
|
||||||
|
lenmsg = "512 ";Ӧ<><D3A6><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ij<EFBFBD><C4B3><EFBFBD>
|
||||||
|
syslog = "n " ;<3B>Ƿ<EFBFBD><C7B7><EFBFBD><EFBFBD>ϵͳ<CFB5><CDB3>־
|
||||||
|
savefile = "y " ;<3B>Ƿ<EFBFBD><C7B7><EFBFBD>ļ<EFBFBD>;
|
||||||
|
filename = "/bin/vs/log/debuglog.txt ";
|
||||||
|
filemaxsize = "500 ";<3B><><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<2C><>KBΪ<42><CEAA>λ
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
enabling it blindly, but also looking for a way to get the file on disk
|
||||||
|
|
||||||
|
after a few modifications:
|
||||||
|
|
||||||
|
```
|
||||||
|
nmap 192.168.42.24 -PN -sV -p 1-65535
|
||||||
|
|
||||||
|
Starting Nmap 6.46 ( http://nmap.org ) at 2016-07-16 13:53 PDT
|
||||||
|
Nmap scan report for 192.168.42.24
|
||||||
|
Host is up (0.0085s latency).
|
||||||
|
Not shown: 65528 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
23/tcp open telnet Busybox telnetd
|
||||||
|
80/tcp open http thttpd 2.25b 29dec2003
|
||||||
|
554/tcp open rtsp?
|
||||||
|
1018/tcp open soap gSOAP soap 2.8
|
||||||
|
1235/tcp open unknown
|
||||||
|
8840/tcp open unknown
|
||||||
|
41477/tcp open unknown
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
### nmap
|
||||||
|
```
|
||||||
|
Starting Nmap 6.46 ( http://nmap.org ) at 2016-07-16 10:46 PDT
|
||||||
|
Nmap scan report for 192.168.42.24
|
||||||
|
Host is up (0.0100s latency).
|
||||||
|
Not shown: 997 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
23/tcp open telnet Busybox telnetd
|
||||||
|
80/tcp open http thttpd 2.25b 29dec2003
|
||||||
|
554/tcp open rtsp?
|
||||||
|
```
|
||||||
|
|
||||||
|
nmap was able to get traffic back from `554`, but it was an unrecognized fingerprint:
|
||||||
|
|
||||||
|
```
|
||||||
|
SF-Port554-TCP:V=6.46%I=7%D=7/16%Time=578A72F1%P=x86_64-apple-darwin13.1.0
|
||||||
|
SF:%r(GetRequest,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCache-Control:\
|
||||||
|
SF:x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(RTSPRequest,6F
|
||||||
|
SF:,"RTSP/1\.0\x20200\x20OK\r\nServer:\x20HiIpcam/V100R003\x20VodServer/1\
|
||||||
|
SF:.0\.0\r\nPublic:\x20OPTIONS,\x20DESCRIBE,\x20SETUP,\x20TEARDOWN,\x20PLA
|
||||||
|
SF:Y\r\n\r\n")%r(GenericLines,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCa
|
||||||
|
SF:che-Control:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(H
|
||||||
|
SF:TTPOptions,6F,"RTSP/1\.0\x20200\x20OK\r\nServer:\x20HiIpcam/V100R003\x2
|
||||||
|
SF:0VodServer/1\.0\.0\r\nPublic:\x20OPTIONS,\x20DESCRIBE,\x20SETUP,\x20TEA
|
||||||
|
SF:RDOWN,\x20PLAY\r\n\r\n")%r(RPCCheck,4E,"RTSP/1\.0\x20400\x20Bad\x20Requ
|
||||||
|
SF:est\r\nCache-Control:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\
|
||||||
|
SF:r\n")%r(DNSVersionBindReq,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCac
|
||||||
|
SF:he-Control:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(DN
|
||||||
|
SF:SStatusRequest,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCache-Control:
|
||||||
|
SF:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(Help,4E,"RTSP
|
||||||
|
SF:/1\.0\x20400\x20Bad\x20Request\r\nCache-Control:\x20no-cache\r\nServer:
|
||||||
|
SF:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(SSLSessionReq,4E,"RTSP/1\.0\x20400\x
|
||||||
|
SF:20Bad\x20Request\r\nCache-Control:\x20no-cache\r\nServer:\x20Hisilicon\
|
||||||
|
SF:x20Ipcam\r\n\r\n")%r(Kerberos,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\
|
||||||
|
SF:nCache-Control:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%
|
||||||
|
SF:r(SMBProgNeg,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCache-Control:\x
|
||||||
|
SF:20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(X11Probe,4E,"RT
|
||||||
|
SF:SP/1\.0\x20400\x20Bad\x20Request\r\nCache-Control:\x20no-cache\r\nServe
|
||||||
|
SF:r:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(FourOhFourRequest,4E,"RTSP/1\.0\x2
|
||||||
|
SF:0400\x20Bad\x20Request\r\nCache-Control:\x20no-cache\r\nServer:\x20Hisi
|
||||||
|
SF:licon\x20Ipcam\r\n\r\n")%r(LPDString,4E,"RTSP/1\.0\x20400\x20Bad\x20Req
|
||||||
|
SF:uest\r\nCache-Control:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n
|
||||||
|
SF:\r\n")%r(LDAPBindReq,4E,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nCache-Co
|
||||||
|
SF:ntrol:\x20no-cache\r\nServer:\x20Hisilicon\x20Ipcam\r\n\r\n")%r(SIPOpti
|
||||||
|
SF:ons,79,"RTSP/1\.0\x20200\x20OK\r\nServer:\x20HiIpcam/V100R003\x20VodSer
|
||||||
|
SF:ver/1\.0\.0\r\nCseq:\x2042\r\nPublic:\x20OPTIONS,\x20DESCRIBE,\x20SETUP
|
||||||
|
SF:,\x20TEARDOWN,\x20PLAY\r\n\r\n");
|
||||||
|
Service Info: Host: RT-IPC
|
||||||
|
```
|
||||||
|
|
||||||
|
scanning harder, we see:
|
||||||
|
|
||||||
|
```
|
||||||
|
nmap 192.168.42.24 -PN -sV -p 1-65535
|
||||||
|
|
||||||
|
Starting Nmap 6.46 ( http://nmap.org ) at 2016-07-16 13:33 PDT
|
||||||
|
Nmap scan report for 192.168.42.24
|
||||||
|
Host is up (0.011s latency).
|
||||||
|
Not shown: 65528 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
23/tcp open telnet Busybox telnetd
|
||||||
|
80/tcp open http thttpd 2.25b 29dec2003
|
||||||
|
554/tcp open rtsp?
|
||||||
|
1018/tcp open soap gSOAP soap 2.8
|
||||||
|
1235/tcp open unknown
|
||||||
|
8840/tcp open unknown
|
||||||
|
47056/tcp open unknown
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
nmap 192.168.42.24 -PN -sV -p 1-65535
|
||||||
|
|
||||||
|
Starting Nmap 6.46 ( http://nmap.org ) at 2016-07-16 13:53 PDT
|
||||||
|
Nmap scan report for 192.168.42.24
|
||||||
|
Host is up (0.0085s latency).
|
||||||
|
Not shown: 65528 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
23/tcp open telnet Busybox telnetd
|
||||||
|
80/tcp open http thttpd 2.25b 29dec2003
|
||||||
|
554/tcp open rtsp?
|
||||||
|
1018/tcp open soap gSOAP soap 2.8
|
||||||
|
1235/tcp open unknown
|
||||||
|
8840/tcp open unknown
|
||||||
|
41477/tcp open unknown
|
||||||
|
```
|
||||||
|
|
||||||
|
looking at packet captures, we see:
|
||||||
|
|
||||||
|
```
|
||||||
|
GET /cgi-bin/hi3510/checkuser.cgi?&-name=admin&-passwd=admin&-time=1468691201459 HTTP/1.1
|
||||||
|
Host: 192.168.42.24
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Referer: http://192.168.42.24/web/index.html
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
HTTP/1.0 200 OK
|
||||||
|
Content-Type:text/html
|
||||||
|
|
||||||
|
var check="1";
|
||||||
|
var authLevel ="255";
|
||||||
|
```
|
||||||
|
|
||||||
|
indicating a successful login, which sets a cookie:
|
||||||
|
```
|
||||||
|
Cookie: language=en; username=YWRtaW4%3D; password=YWRtaW4%3D; authLevel=255
|
||||||
|
```
|
||||||
|
|
||||||
|
so 8 characters, final being `=`, likely padding giving us `YWRtaW4=`. a quick base64 decode shows that we're effectively passing passwords in the clear:
|
||||||
|
|
||||||
|
```
|
||||||
|
$ echo YWRtaW4= | base64 -dD
|
||||||
|
Jul 16 14:15:32 mba base64[75917] <Info>: Read 9 bytes.
|
||||||
|
Jul 16 14:15:32 mba base64[75917] <Info>: Decoded to 5 bytes.
|
||||||
|
Jul 16 14:15:32 mba base64[75917] <Info>: Wrote 5 bytes.
|
||||||
|
admin
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
POST /web/cgi-bin/hi3510/param.cgi HTTP/1.1
|
||||||
|
Host: 192.168.42.24
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: http://192.168.42.24/web/user.html
|
||||||
|
Cookie: language=en; username=YWRtaW4%3D; password=YWRtaW4%3D; authLevel=255
|
||||||
|
Connection: keep-alive
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 283
|
||||||
|
|
||||||
|
cmd=updateuser&cururl=http%3A%2F%2F192.168.42.24%2Fweb%2Fuser.html&user0=admin%3Aadmin%3A255%3AAdmin&user1=guest%3Aguest%3A3%3AGuest&user2=root%3Afoobarbaz%3A3%3ANormal&user3=%3A%3A3%3ANormal&user4=%3A%3A3%3ANormal&user5=%3A%3A3%3ANormal&user6=%3A%3A3%3ANormal&user7=%3A%3A3%3ANormal
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
GET /tmpfs/config_backup.bin HTTP/1.1
|
||||||
|
Host: 192.168.42.24
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: http://192.168.42.24/web/initializemain.html
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Server: thttpd/2.25b 29dec2003
|
||||||
|
Content-Type: application/octet-stream
|
||||||
|
Date: Sat, 16 Jul 2016 18:03:12 GMT
|
||||||
|
Last-Modified: Sat, 16 Jul 2016 18:03:12 GMT
|
||||||
|
Accept-Ranges: bytes
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 25098
|
||||||
|
```
|
||||||
|
|
||||||
|
getting the backup file from the web UI doesn't require/pass a cookie at all
|
||||||
|
|
||||||
|
```
|
||||||
|
GET /cgi-bin/hi3510/ptzleft.cgi?&-chn=0&-speed=31&-randoma8b9ctime=%221468693040013%22 HTTP/1.1
|
||||||
|
Host: 192.168.42.24
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Referer: http://192.168.42.24/web/index.html
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
HTTP/1.0 200 OK
|
||||||
|
Content-Type:text/html
|
||||||
|
|
||||||
|
call ptz funtion success
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
amusing typo in an API method:
|
||||||
|
|
||||||
|
```
|
||||||
|
GET /web/cgi-bin/hi3510/param.cgi?cmd=getsdcareInfo HTTP/1.1
|
||||||
|
Host: 192.168.234.1
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:46.0) Gecko/20100101 Firefox/46.0
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: http://192.168.234.1/web/storage.html
|
||||||
|
Cookie: language=en; auto login=0; username=YWRtaW4%3D; password=YWRtaW4%3D; authLevel=255
|
||||||
|
Connection: keep-alive
|
||||||
|
Pragma: no-cache
|
||||||
|
Cache-Control: no-cache
|
||||||
|
|
||||||
|
HTTP/1.0 200 OK
|
||||||
|
Content-Type:text/html
|
||||||
|
|
||||||
|
sdstatus="out";
|
||||||
|
sdfreespace="0 ";
|
||||||
|
sdtotalspace="0 ";
|
||||||
|
```
|
||||||
|
|
||||||
|
more non-cookie based requests, this time for wireless network scanning:
|
||||||
|
```
|
||||||
|
GET /cgi-bin/scanwifi.cgi?cmd=scanwifi.cgi&-time=%221465316774370%22 HTTP/1.1
|
||||||
|
Host: 192.168.234.1
|
||||||
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:46.0) Gecko/20100101 Firefox/46.0
|
||||||
|
Accept: text/plain, */*; q=0.01
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Referer: http://192.168.234.1/web/wifi.html
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
HTTP/1.0 200 OK
|
||||||
|
Content-Type:text/plain
|
||||||
|
|
||||||
|
|
||||||
|
var ssid_1="bssid signal ssid";
|
||||||
|
var ssid_2="Sonic.net-972";
|
||||||
|
var ssid_3="Artein";
|
||||||
|
var ssid_4="Sonic-4443";
|
||||||
|
var ssid_5="sinL";
|
||||||
|
var ssid_6="Harrison Jones";
|
||||||
|
var ssid_7="";
|
||||||
|
var ssid_8="BiscuitHammer";
|
||||||
|
var ssid_9="NETGEAR56";
|
||||||
|
var ssid_10="NETGEAR52";
|
||||||
|
var ssid_11="House LANnister";
|
||||||
|
var ssid_12="elma";
|
||||||
|
var ssid_13="Purplepashmina";
|
||||||
|
var ssid_14="";
|
||||||
|
var ssid_15="Registry-2";
|
||||||
|
var ssid_16="KAM_Francisco_2G";
|
||||||
|
var ssid_17="bluthcompanyHQ";
|
||||||
|
var ssid_18="bluthcompanyGUEST";
|
||||||
|
var ssid_19="folsom942";
|
||||||
|
var ssid_20="PRIVATENETWORK";
|
||||||
|
var ssid_21="legofeel";
|
||||||
|
var ssid_22="Temple of Joseidon";
|
||||||
|
var ssid_23="xfinitywifi";
|
||||||
|
var ssid_24="MonkeyBrains.net";
|
||||||
|
var ssid_25="APZ-Guest";
|
||||||
|
var ssid_26="imaqtpie";
|
||||||
|
var ssid_27="citicomm";
|
||||||
|
var ssid_28="APZ";
|
||||||
|
var ssid_29="711";
|
||||||
|
var ssid_30="macchiato";
|
||||||
|
var ssid_31="Winternet is coming";
|
||||||
|
var ssid_32="Pretty fly for a Wifi";
|
||||||
|
var ssid_33="MU Guest";
|
||||||
|
var ssid_34="Jeff's Wi-Fi Network";
|
||||||
|
var ssid_35="";
|
||||||
|
var ssid_36="CYWD";
|
||||||
|
var ssid_37="HouseofEghbali";
|
||||||
|
var ssid_38="xfinitywifi";
|
||||||
|
var ssid_39="HP-Print-D7-ENVY 4500 series";
|
||||||
|
var ssid_40="TP-LINK_38BC";
|
||||||
|
var ssid_41="";
|
||||||
|
var ssid_42="seattlestyle";
|
||||||
|
var ssid_43="Celsus932";
|
||||||
|
var ssid_44="";
|
||||||
|
var ssid_45="";
|
||||||
|
var ssid_46="OwnYourData2.4";
|
||||||
|
var ssid_47="CGN3-78F8";
|
||||||
|
var ssid_48="Bespoke";
|
||||||
|
var ssid_49="ATT448";
|
||||||
|
var ssid_50="";
|
||||||
|
var ssid_51="";
|
||||||
|
var ssid_52="HP-Print-29-Officejet Pro 8600";
|
||||||
|
var ssid_53="YBL540 Office";
|
||||||
|
var ssid_54="Kelefant";
|
||||||
|
var ssid_55="SKNet";
|
||||||
|
var ssid_56="HOME-4688";
|
||||||
|
var ssid_57="ATT504";
|
||||||
|
var ssid_58="ATT3D637f3";
|
||||||
|
var ssid_59="ATT336";
|
||||||
|
var ssid_60="";
|
||||||
|
var ssid_61="xfinitywifi";
|
||||||
|
var ssid_62="xfinitywifi";
|
||||||
|
var ssid_63="jaljeera";
|
||||||
|
var ssid_64="DNG24";
|
||||||
|
var ssid_65="happy";
|
||||||
|
var ssid_66="xfinitywifi";
|
||||||
|
var signal_1="bssid";
|
||||||
|
var signal_2="255";
|
||||||
|
var signal_3="239";
|
||||||
|
var signal_4="229";
|
||||||
|
var signal_5="229";
|
||||||
|
var signal_6="198";
|
||||||
|
var signal_7="198";
|
||||||
|
var signal_8="188";
|
||||||
|
var signal_9="178";
|
||||||
|
var signal_10="168";
|
||||||
|
var signal_11="168";
|
||||||
|
var signal_12="168";
|
||||||
|
var signal_13="168";
|
||||||
|
var signal_14="168";
|
||||||
|
var signal_15="158";
|
||||||
|
var signal_16="158";
|
||||||
|
var signal_17="158";
|
||||||
|
var signal_18="158";
|
||||||
|
var signal_19="147";
|
||||||
|
var signal_20="147";
|
||||||
|
var signal_21="147";
|
||||||
|
var signal_22="147";
|
||||||
|
var signal_23="147";
|
||||||
|
var signal_24="147";
|
||||||
|
var signal_25="147";
|
||||||
|
var signal_26="137";
|
||||||
|
var signal_27="137";
|
||||||
|
var signal_28="137";
|
||||||
|
var signal_29="137";
|
||||||
|
var signal_30="137";
|
||||||
|
var signal_31="137";
|
||||||
|
var signal_32="137";
|
||||||
|
var signal_33="137";
|
||||||
|
var signal_34="137";
|
||||||
|
var signal_35="137";
|
||||||
|
var signal_36="137";
|
||||||
|
var signal_37="137";
|
||||||
|
var signal_38="137";
|
||||||
|
var signal_39="137";
|
||||||
|
var signal_40="127";
|
||||||
|
var signal_41="127";
|
||||||
|
var signal_42="127";
|
||||||
|
var signal_43="127";
|
||||||
|
var signal_44="127";
|
||||||
|
var signal_45="127";
|
||||||
|
var signal_46="127";
|
||||||
|
var signal_47="127";
|
||||||
|
var signal_48="127";
|
||||||
|
var signal_49="127";
|
||||||
|
var signal_50="127";
|
||||||
|
var signal_51="127";
|
||||||
|
var signal_52="127";
|
||||||
|
var signal_53="117";
|
||||||
|
var signal_54="117";
|
||||||
|
var signal_55="117";
|
||||||
|
var signal_56="117";
|
||||||
|
var signal_57="117";
|
||||||
|
var signal_58="117";
|
||||||
|
var signal_59="117";
|
||||||
|
var signal_60="117";
|
||||||
|
var signal_61="117";
|
||||||
|
var signal_62="117";
|
||||||
|
var signal_63="107";
|
||||||
|
var signal_64="107";
|
||||||
|
var signal_65="107";
|
||||||
|
var signal_66="107";
|
||||||
|
var secret_1="bssid";
|
||||||
|
var secret_2="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_3="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_4="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_5="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_6="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_7="[WEP][ESS]";
|
||||||
|
var secret_8="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_9="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_10="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_11="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_12="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_13="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_14="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_15="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_16="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_17="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_18="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_19="[WPS][WEP][ESS]";
|
||||||
|
var secret_20="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_21="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_22="[WPA-PSK-CCMP][WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_23="[ESS]";
|
||||||
|
var secret_24="[ESS]";
|
||||||
|
var secret_25="[ESS]";
|
||||||
|
var secret_26="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_27="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_28="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_29="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_30="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_31="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_32="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_33="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_34="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_35="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_36="[WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_37="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][WPS][ESS]";
|
||||||
|
var secret_38="[ESS]";
|
||||||
|
var secret_39="[ESS]";
|
||||||
|
var secret_40="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_41="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_42="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_43="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_44="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_45="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_46="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][WPS][ESS]";
|
||||||
|
var secret_47="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_48="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_49="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_50="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_51="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_52="[ESS]";
|
||||||
|
var secret_53="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_54="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_55="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][WPS][ESS]";
|
||||||
|
var secret_56="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][WPS][ESS]";
|
||||||
|
var secret_57="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_58="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_59="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_60="[WPA-PSK-CCMP+TKIP][WPA2-PSK-CCMP+TKIP][ESS]";
|
||||||
|
var secret_61="[ESS]";
|
||||||
|
var secret_62="[ESS]";
|
||||||
|
var secret_63="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_64="[WPA2-PSK-CCMP][WPS][ESS]";
|
||||||
|
var secret_65="[WPA2-PSK-CCMP][ESS]";
|
||||||
|
var secret_66="[ESS]";
|
||||||
|
```
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue
Block a user