HBGK DVR 3.0.0 build20161206 - Authentication Bypass

2017-09-24T00:00:00
ID EDB-ID:42931
Type exploitdb
Reporter Exploit-DB
Modified 2017-09-24T00:00:00

Description

HBGK DVR 3.0.0 build20161206 - Authentication Bypass. Webapps exploit for Hardware platform

                                        
                                            # Exploit Title: HBGK DVR V3.0.0 build20161206  - Authentication Bypass
# Date: 24-09-2017
# Vendor Homepage: http://www.hbgk.net/en/
# Exploit Author: RAT - ThiefKing
# Contact: https://www.facebook.com/cctvsuperpassword
# Website: http://tromcap.com
# Category: webapps
# Tested on: V2.3.1 build20160927, V3.0.0 build20161206
# Shodan Dork: NVR Webserver

1. Description
- Any registered user can login when edit cookie userInfo

2. Proof of Concept
- When login successful: DVR save cookie : userInfo + webport with 
value: base64 encode (user:pass)
Ex: http://dvr-domain.dynns.com:85 --> When login successful (user: 
admin, pass: admin), DVR will save cookie: userInfo85 with value 
YWRtaW46YWRtaW4= (admin:admin <-- base64 decode)
But Dvr not check pass with cookie. When not yet login, you add a 
cookie: userInfoXX (xx : web port) with value base64 encode (admin: any 
words). And go url: http://dvr-domain.dynns.com:XX/doc/page/main.asp. It 
will Authentication Bypass

3. Solution:
Update to Firmware version V3.0.0 build20170925