EUVD-2018-2804

Malware in sbrugna...

KONGTOP DVR后门分析(CVE-2018-10734)

前言 在康拓DVR中，存在一个Telnet后门，可以导致监控设备被控制甚至内网被渗透的风险。 下面来分析一下这个后门,没有什么技术含量。 漏洞分析 后门存于在Telnetd文件中，Telnetd负责开启telnet并提供服务，在这里我们可以看到在开了Telnet服务后，对用户的连接进行了监听，如果登录的用户长时间不操作就会登录超时，然后是一系列的服务准备处理函数。 在我们启用了Telnetd服务后，也就是开启了telnet后，程序会判断启动程序是否在终端机器里面运行，如果是则进行下一步，否则就会退出，输出UNKNOW。 在通过了本机环境验证后，程序会开始提取用户的登录数据，并保存在内存中...

Default credentials

KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a PrintPassword function call in certain circumstances...

CVE-2018-10734

KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a PrintPassword function call in certain circumstances...

CVE-2018-10734

CVE-2018-10734 affects KONGTOP DVR models A303, A403, D303, D305, and D403. A backdoor in the Telnetd/related components allows a Print_Password path to disclose login passwords under certain conditions, enabling information disclosure and potential device compromise via the Telnet interface. The...

CVE-2018-10734

KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a PrintPassword function call in certain circumstances...

CVE-2018-10734: Exposure of Sensitive Information to an Unauthorized Actor

KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a PrintPassword function call in certain circumstances...