Lorex LH300 Series – ActiveX Buffer Overflow (PoC)

Exploit Database
99 阅读

作者： Pedro Ribeiro

日期： 2015-01-18
类别：
- dos
平台：
- hardware
来源：https://www.exploit-db.com/exploits/43891/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

Disclosure: 09/01/2014 / Last updated: 18/01/2015

Hi,

I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems.

The company is Lorex Technologies, a major video surveillance manufacturer that is very popular in the US and East Asia. Their affected product range is the EDGE series, which has 16 products in it. I have confirmed that all 16 are vulnerable at this point in time. These security DVR's are remotely accessible, and when you access it on a Windows computer with Internet Explorer, they try to install the vulnerable ActiveX control INetViewX. The Lorex manual[1] instructs the user to blindly accept the ActiveX control install when prompted.

The full list of devices, as well as links to the firware download, can be found in [2]. Their products offer remote video viewing capabilities, and you can find some of them on Shodan[3].

The buffer overflow can be triggered by a really long string (10000+ characters) in the HTTP_PORT parameter. The instruction pointer can be very easily controlled in XP by the characters 109 to 113 in the string. Please refer to the PoC file lorex-testcase.html. You will see that the HTTP_PORT parameter is composed of D's, apart from chars 109 to 113 which are four A's. If you open this file in IE after installing the control, you will see that IE will crash with an EIP of 0x41414141. Changing the four A's to any other value will cause EIP to crash on that value.

The list below tells a better story about what is affected and how it can be controlled:

Win XP SP3 with IE6 - Fully exploitable as described

Win XP SP3 with IE8 - Could not get it to crash (????)

Win 7 x64 with IE10 fully patched - Fully exploitable, though not as easy as for XP (see analyze -v [4] and !exploitable [5] outputs)

To verify this vulnerability you can download and extract the firmware using binwalk (http://code.google.com/p/binwalk/). To do so, please follow the instructions in [6], and then install the ActiveX control in INetViewProj1_02030330.cab.

I have contacted Lorex and they initially said they would fix it, but went radio silent shortly afterwards.

17.11.2013 - Initial contact via support page

18.11.2013 - Email to sales, no response.

21.11.2013 - Second email to sales, received response by sales saying they will forward it to technical support and get back to me.

04.12.2013 - Third email to sales saying that technical support never contacted me back. No response.

08.01.2014 - MITRE assigns CVE-2014-1201 to this issue.

09.01.2014 - Public disclosure.

All references can be found at:

https://github.com/pedrib/PoC/blob/master/lorexActivex/lorex-report.txt

Proof of concept:

https://raw.githubusercontent.com/pedrib/PoC/master/lorexActivex/lorex-testcase.html

Regards,

Pedro Ribeiro (pedrib@gmail.com)

Agile Information Security

-------------------------

[1] Lorex manual for LH300 series

-------------------------

http://www.lorextechnology.com/downloads/security-dvr/LH300-Series/LH300_SERIES_MANUAL_EN_R2_web.pdf

-------------------------

[2] List of vulnerable device families and URL for firmware download

-------------------------

LH340-Series 960H security video recorder Edge 3 series (2 devices affected)

http://www.lorextechnology.com/downloads/security-dvr/LH340-Series/LH340_SERIES_FIRMWARE_8CH_11.19.85_1FE3A.zip

LH330-Series Security DVR system Edge2 series (3 devices affected)

http://www.lorextechnology.com/downloads/security-dvr/LH330-Series/LH330_SERIES_FIRMWARE_8CH_11.17.38-33_1D97A.zip

LH320-Series Surveillance DVR Edge+ series (5 devices affected)

http://www.lorextechnology.com/downloads/security-dvr/LH300-Series/LH300_SERIES_FIRMWARE_4CH_7-35-28-1B26E.zip

LH310-Series DVR for surveillance cameras Edge series (6 devices affected)

http://www.lorextechnology.com/downloads/security-dvr/LH300-Series/LH300_SERIES_FIRMWARE_4CH_7-35-28-1B26E.zip

-------------------------

[3] Shodan link for Lorex DVR's

-------------------------

https://scanhub.shodan.io/scanhub-demo/search?q=%28os.name%3A%22LOREX+SECURITY+DVR%22%29+AND+os.name.name_facet%3A%22Lorex+Security+DVR%22

-------------------------

[4] Win 7 x64 IE10 Analyze -v output

-------------------------

FOLLOWUP_IP:

INetViewProj1!Inetviewimpl1Finalize+563d

09a7f911 f2aerepne scas byte ptr es:[edi]

APP:iexplore.exe

PRIMARY_PROBLEM_CLASS:WRONG_SYMBOLS

BUGCHECK_STR:APPLICATION_FAULT_WRONG_SYMBOLS

IP_ON_HEAP:0000000044444444

The fault address in not in any loaded module, please check your build's rebase

log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may

contain the address if it were loaded.

IP_IN_FREE_BLOCK: 44444444

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:from 0000000044444444 to 0000000009a7f911

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

04bbc724 44444444 44444444 44444444 44444444 INetViewProj1!Inetviewimpl1Finalize+0x563d

04bbc728 44444444 44444444 44444444 44444444 0x44444444

04bbc72c 44444444 44444444 44444444 44444444 0x44444444

04bbc730 44444444 44444444 44444444 44444444 0x44444444

04bbc734 44444444 44444444 44444444 44444444 0x44444444

-------------------------

[5] Win 7 x64 IE10 !exploitable output

-------------------------

0:008:x86> !exploitable

!exploitable 1.6.0.0

Exploitability Classification: EXPLOITABLE

Recommended Bug Title: Exploitable - Exception Handler Chain Corrupted starting at INetViewProj1!Inetviewimpl1Finalize+0x000000000000563d (Hash=0xe1e32303.0x6b2fc9c7)

Corruption of the exception handler chain is considered exploitable

-------------------------

[6] How to extract the vulnerable ActiveX control from the firmware image

-------------------------

wget http://www.lorextechnology.com/downloads/security-dvr/LH340-Series/LH340_SERIES_FIRMWARE_8CH_11.19.85_1FE3A.zip

unzip LH340_SERIES_FIRMWARE_8CH_11.19.85_1FE3A.zip

binwalk -e 62082\(lorex\)os_11.19.85_1FE3A.rom

cd _62082\(lorex\)os_11.19.85_1FE3A.rom.extracted/

7z x 6B2000

cd web

ls -la INetViewProj1_02030330.cab

<!--

COM Object - {05B550C0-E424-4F91-9928-EA970817BFC0} INetViewX Control

*******************************************************************************

COM Object Filename : E:\lorex-ocx\INetViewProj1_02030160.ocx

Major Version : 2

Minor Version : 3

Build Number: 1

Revision Number : 60

Product Version : 1.0.0.0

Product Name:

Company Name:

Legal Copyright :

Comments:

File Description:

File Version: 2.3.1.60

Internal Name :

Legal Trademarks:

Private Build : not found

Special Build : not found

Language: not found

*******************************************************************************

-->

</object>