Open Sesame (Dlink - CVE-2012-4046)

A couple weeks ago a vulnerability was posted for the dlink DCS-9xx series of cameras. The author of the disclosure found that the setup application that comes with the camera is able to send a specifically crafted request to a camera on the same network and receive its password in plaintext. I figured this was a good chance to do some analysis and figure out exactly how the application carried out this functionality and possibly create a script to pull the password out of a camera.

The basic functionality of the application is as follows:

• Application sends out a UDP broadcast on port 5978
• Camera sees the broadcast on port 5978 and inspects the payload – if it sees that the initial part of the payload contains "FF FF FF FF FF FF" it responds (UDP broadcast port 5978) with an encoded payload with its own MAC address
• Application retrieves the camera's response and creates another UDP broadcast but this time it sets the payload to contain the target camera's MAC address, this encoded value contains the command to send over the password
• Camera sees the broadcast on port 5978 and checks that it is meant for it by inspecting the MAC address that has been specified in the payload, it responds with an encoded payload that contains its password (base64 encoded)

After spending some time with the application in a debugger I found what looked like it was responsible for the decoding of the encoded values that are passed:

super exciting screen shot.

After spending some time documenting the functionality I came up with the following notes (messy wall of text):

	Command	Comments
	.JGE SHORT 0A729D36	; stage1
	./MOV EDX,DWORD PTR SS:[LOCAL.2]	; set EDX to our 1st stage half decoded buffer
	.|MOV ECX,DWORD PTR SS:[LOCAL.4]	; set ECX to our current count/offset
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our base64 encoded payload
	.|MOVSX EAX,BYTE PTR DS:[EAX]	; set EAX to the current value in our base64 payload
	.|MOV AL,BYTE PTR DS:[EAX+0A841934]	; set EAX/AL to a hardcoded offset of its value table is at 0a841934
	.|MOV BYTE PTR DS:[ECX+EDX],AL	; ECX = Offset, EDX = start of our half-decoded buffer, write our current byte there
	.|INC DWORD PTR SS:[LOCAL.4]	; increment our offset/count
	.|INC DWORD PTR SS:[LOCAL.3]	; increment our base64 buffer to next value
	.|MOV EDX,DWORD PTR SS:[LOCAL.4]	; set EDX to our counter
	.|CMP EDX,DWORD PTR SS:[ARG.2]	; compare EDX (counter) to our total size
	.\JL SHORT 0A729D13	; jump back if we have not finished half decoding our input value
	.MOV ECX,DWORD PTR SS:[ARG.3]	; Looks like this will point at our decoded buffer
	.MOV DWORD PTR SS:[LOCAL.5],ECX	; set Arg5 to our decoded destination
	.MOV EAX,DWORD PTR SS:[LOCAL.2]	; set EAX to our half-decoded buffer
	.MOV DWORD PTR SS:[LOCAL.3],EAX	; set arg3 to point at our half-decoded buffer
	.MOV EDX,DWORD PTR SS:[ARG.4]	; ???? 1500 decimal
	.XOR ECX,ECX	; clear ECX
	.MOV DWORD PTR DS:[EDX],ECX	; clear out arg4 value
	.XOR EAX,EAX	; clear out EAX
	.MOV DWORD PTR SS:[LOCAL.6],EAX	; clear out local.6
	.JMP SHORT 0A729DAE	; JUMP
	./MOV EDX,DWORD PTR SS:[LOCAL.3]	; move our current half-decoded dword position into EDX
	.|MOV CL,BYTE PTR DS:[EDX]	; move our current byte into ECX (CL) (dword[0])
	.|SHL ECX,2	; shift left 2 dword[0]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; move our current dword position into EAX
	.|MOVSX EDX,BYTE PTR DS:[EAX+1]	; move our current dword position + 1 (dword[1]) into EDX
	.|SAR EDX,4	; shift right 4 dword[1]
	.|ADD CL,DL	; add (shift left 2 dword[0]) + (shift right 4 dword[1])
	.|MOV EAX,DWORD PTR SS:[LOCAL.5]	; set EAX to our current decoded buffer position
	.|MOV BYTE PTR DS:[EAX],CL	; write our decoded (dword[0]) value to or decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; increment our position in the decoded buffer
	.|MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current dword position
	.|MOV CL,BYTE PTR DS:[EDX+1]	; set ECX to dword[1]
	.|SHL ECX,4	; left shift 4 dword[1]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current dword position
	.|MOVSX EDX,BYTE PTR DS:[EAX+2]	; set EDX to dword[2]
	.|SAR EDX,2	; shift right 2 dword[2]
	.|ADD CL,DL	; add (left shift 4 dword[1]) + (right shift 2 dword[2])
	.|MOV EAX,DWORD PTR SS:[LOCAL.5]	; set EAX to our next spot in the decoded buffer
	.|MOV BYTE PTR DS:[EAX],CL	; write our decoded value into our decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.|MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current half-decoded dword
	.|MOV CL,BYTE PTR DS:[EDX+2]	; set ECX dword[2]
	.|SHL ECX,6	; shift left 6 dword[2]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current half-decoded dword
	.|ADD CL,BYTE PTR DS:[EAX+3]	; add dword[2] + dword[3]
	.|MOV EDX,DWORD PTR SS:[LOCAL.5]	; set EDX to point at our next spot in our decoded buffer
	.|MOV BYTE PTR DS:[EDX],CL	; write our decoded byte to our decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.|ADD DWORD PTR SS:[LOCAL.3],4	; increment our encoded buffer to point at our next dword
	.|MOV ECX,DWORD PTR SS:[ARG.4]	; set ECX to our current offset?
	.|ADD DWORD PTR DS:[ECX],3	; add 3 to our current offset?
	.|ADD DWORD PTR SS:[LOCAL.6],4	; add 4 to our byte counter??
	.|MOV EAX,DWORD PTR SS:[ARG.2]	; move total size into EAX
	.|ADD EAX,-4	; subtract 4 from total size
	.|CMP EAX,DWORD PTR SS:[LOCAL.6]	; compare our total bytes to read bytes
	.\JG SHORT 0A729D50	; jump back if we are not done
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our last DWORD of encoded buffer
	.MOVSX ECX,BYTE PTR DS:[EDX+3]	; set ECX to dword[3] last byte of our half-decoded dword (dword + 3)
	.INC ECX	; increment the value of dword[3]
	.JE SHORT 0A729E1E
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current half-decoded dword
	.MOV DL,BYTE PTR DS:[EAX]	; set EDX (DL) to dword[0]
	.SHL EDX,2	; shift left 2 dword[0]
	.MOV ECX,DWORD PTR SS:[LOCAL.3]	; set ECX to our current encoded dword position
	.MOVSX EAX,BYTE PTR DS:[ECX+1]	; set EAX to dword[1]
	.SAR EAX,4	; shift right 4 dword[1]
	.ADD DL,AL	; add (shifted left 2 dword[0]) + (shifted right 4 dword[1])
	.MOV ECX,DWORD PTR SS:[LOCAL.5]	; set ECX to point at our next spot in our decoded buffer
	.MOV BYTE PTR DS:[ECX],DL	; write our decoded value (EDX/DL) to our decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to point at our dword
	.MOV AL,BYTE PTR DS:[EDX+1]	; set EAX/AL to dword[1]
	.SHL EAX,4	; shift left 4 dword[1]
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current dword
	.MOVSX ECX,BYTE PTR DS:[EDX+2]	; set ECX to dword[2]
	.SAR ECX,2	; shift right 2 dword[2]
	.ADD AL,CL	; add (shifted left 4 dword[1]) + (shifted right 2 dword[2])
	.MOV EDX,DWORD PTR SS:[LOCAL.5]	; set EDX to point at our current spot in our decoded buffer
	.MOV BYTE PTR DS:[EDX],AL	; write our decoded value to the decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to point at our current dword
	.MOV CL,BYTE PTR DS:[EAX+2]	; set ECX/CL to dword[2]
	.SHL ECX,6	; shift left 6 dword[2]
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; point EAX at our current dword
	.ADD CL,BYTE PTR DS:[EAX+3]	; add dword[3] + (shifted left 6 dword[2])
	.MOV EDX,DWORD PTR SS:[LOCAL.5]	; point EDX at our current decoded buffer
	.MOV BYTE PTR DS:[EDX],CL	; write our decoded value to the decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; increment our deocded buffer
	.MOV ECX,DWORD PTR SS:[ARG.4]	; set ECX to our current offset?
	.ADD DWORD PTR DS:[ECX],3	; add 4 for our current byte counter?
	.JMP 0A729EA6	; jump

Translated into english: the application first uses a lookup table to translate every byte in the input string, to do this it uses the value of the current byte as an offset into the table.  After it is done with "stage1" it traverses the translated input buffer a dword at a time and does some bit shifting and addition to fully decode the value. The following roughly shows the "stage2" routine:

(Dword[0] << 2) + (Dword[1] >> 4) = unencoded byte 1 

(Dword[1] << 4) + (Dword[2] >> 2) = unencoded byte 2 

(Dword[2] << 6) + Dword[3] = unencoded byte 3

I then confirmed that this routine worked on an "encoded" value that went over the wire from the application to the camera. After confirming the encoding scheme worked, I recreated the network transaction the application does with the camera to create a stand alone script that will retrieve the password from a camera that is on the same lan as the "attacker". The script can be found here, thanks to Jason Doyle for the original finding (@jasond0yle ).

Related articles

• Hacking Time
• Growth Hacking Marketing
• What Is Growth Hacking
• Defcon Hacking
• Computer Hacking
• Hacking Simulator
• Curso De Growth Hacking
• Fake Hacking

Read More

Airpwn: A Wireless Packet Injector

"Airpwn is a framework for 802.11 (wireless) packet injection. Airpwn listens to incoming wireless packets, and if the data matches a pattern specified in the config files, custom content is injected "spoofed" from the wireless access point. From the perspective of the wireless client, airpwn becomes the server." read more...

Website: http://airpwn.sourceforge.net

Related news

1. Hacking Online Games
2. Wifi Hacking App
3. Marketing Growth Hacking
4. Hacking Bluetooth Speaker
5. Hacker En Español
6. Crack Definicion
7. Hacking Wifi
8. Reddit Hacking
9. Hacking The System
10. Significado De Hacker
11. Paginas De Hackers
12. Growth Hacking Libro
13. Hacking Netflix Account
14. Tecnicas De Hacking
15. Hacking Code
16. Hacker En Español

Read More

Facebook Plans To Launch Its Own Cryptocurrency

Facebook Plans To Launch Its Own Cryptocurrency

Facebook Plans To Launch Its Own Cryptocurrency

The social network giant, Facebook is going through a bad phase with lots of ups and down. The recent scandal with Cambridge Analytica has caused the world's largest social network giant Facebook to change its stance on user privacy and to be more transparent about its use of the data it collects.

Since then, some social networks based in Blockchain have been popularized, namely Sphere, Steemit, and Howdoo. However, recently, something unusual announcement is announced by the social network giant Facebook itself, in which Facebook stated that it is investing in a Blockchain-based solution development team, but, the purpose of the project is not yet known.

It was with a post on the Facebook page that David Marcus confirmed his departure from the Messenger team and the creation of a small group dedicated to finding solutions based on the potential of Blockchain technology for Facebook.

David Marcus has not given much detail on the work he will do with his new group, saying only that they will study Blockchain from scratch so that they can use this revolutionary technology for Facebook.

"I'm setting up a small group to explore how to leverage Blockchain across Facebook, starting from scratch," stated David Marcus.

Despite being connected to Facebook's Messenger since 2014, David Marcus is no novice in these financial issues related to money transfers. In addition to having introduced the possibility of P2P payments in Messenger itself, David Marcus was President of PayPal and CEO of Zong, a company dedicated to payments on mobile devices.

However, his experience in this segment does not allow us to conclude that Facebook will create or support a crypto coin, but, it also doesn't mean that it will launch or support any crypto coin of its own. Blockchain technology has become famous thanks to crypto-coins, especially Bitcoin, but its potential expands dramatically to other areas.

The potential of Blockchain goes from the crypto-coins to the creation of real ecosystems online, supported by the users of the network. Sharing and storing data is a legacy that Blockchain allows you to explore and maybe the fact that Facebook will use it in your favor.

The lead post in Messenger was then handed over to Stan Chudnovsky, who now heads one of the most widely used communication services around the world, alongside WhatsApp.

Rumors also point out that James Everingham and Kevin Weil, both from Instagram, will also join David Marcus in this new onslaught of Facebook to one of today's most acclaimed technologies.

More articles

1. Manual Del Hacker
2. Geekprank Hacking
3. Hacking Microsoft
4. Como Empezar En El Hacking

Read More

Entropy: Netwave And GoAhead IP Webcams Exploiting Tool

About Entropy Toolkit
   Entropy Toolkit is:

• A set of tools to exploit Netwave and GoAhead IP Webcams.
• A powerful toolkit for webcams penetration testing.

Entropy Toolkit's installationEntropy Toolkit's execution

Entropy Toolkit's examples:

• Example of exploiting a single webcam
  entropy -b 1 -i [webcam's ip address and port] -v
  Example: entropy -b 1 -i 192.168.1.100:80 -v
• Example of exploiting webcams from a list
  entropy -b 2 -l [file text] -v
  Example: entropy -b 2 -l iplist.txt -v
• Example of exploiting webcams using shodan
  entropy -b 2 -v --shodan [you shodan api key]
  Example: entropy -b 2 -v --shodan PSKINdQe1GyxGgecYz2191H2JoS9qvgD

Entropy Toolkit disclaimer:
   Usage of the Entropy Toolkit for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, federal, and international laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Entropy Toolkit license: MIT license.

Download Entropy Toolkit
(Sign up Windscribe for free, get full protection and stay anonymous
with the best free VPN. Read more here)Read more

1. Hacking Basico
2. El Hacker
3. Etica Hacker
4. Hacking Definicion
5. Hacking Games Online
6. Quiero Ser Hacker
7. Geekprank Hacking

Read More

RapidScan: The Multi-Tool Website Vulnerabilities Scanner With Artificial Intelligence

RapidScan's Features:

• One-step installation.
• Executes a multitude of security scanning tools, does other custom coded checks and prints the results spontaneously.
• Come of the tools include nmap, dnsrecon, wafw00f, uniscan, sslyze, fierce, lbd, theharvester, dnswalk, golismero etc executes under one entity.
• Saves a lot of time, indeed a lot time!
• Checks for same vulnerabilities with multiple tools to help you zero-in on false positives effectively.
• Legends to help you understand which tests may take longer time, so you can Ctrl+C to skip if needed.
• Association with OWASP Top 10 2017 on the list of vulnerabilities discovered. (under development)
• Critical, high, large, low and informational classification of vulnerabilities.
• Vulnerability definitions guides you what the vulnerability actually is and the threat it can pose
• Remediations tells you how to plug/fix the found vulnerability.
• Executive summary gives you an overall context of the scan performed with critical, high, low and informational issues discovered. (under development)
• Artificial intelligence to deploy tools automatically depending upon the issues found. for eg; automates the launch of wpscan and plecost tools when a wordpress installation is found. (under development)
• Detailed comprehensive report in a portable document format (*.pdf) with complete details of the scans and tools used. (under development)

For Your Infomation about RapidScan:

• Program is still under development, works and currently supports 80 vulnerability tests.
• Parallel processing is not yet implemented, may be coded as more tests gets introduced.

RapidScan supports checking for these vulnerabilities:

• DNS/HTTP Load Balancers & Web Application Firewalls. 
• Checks for Joomla, WordPress and Drupal
• SSL related Vulnerabilities (HEARTBLEED, FREAK, POODLE, CCS Injection, LOGJAM, OCSP Stapling).
• Commonly Opened Ports.
• DNS Zone Transfers using multiple tools (Fierce, DNSWalk, DNSRecon, DNSEnum).
• Sub-Domains Brute Forcing.
• Open Directory/File Brute Forcing.
• Shallow XSS, SQLi and BSQLi Banners.
• Slow-Loris DoS Attack, LFI (Local File Inclusion), RFI (Remote File Inclusion) & RCE (Remote Code Execution).

RapidScan's Requirements:

• Kali Linux, Parrot Security OS, BlackArch... Linux distros that based for pentesters and hackers.
• Python 2.7.x

RapidScan Installation:

RapidScan's screenshots:

RapidScan helping menu

RapidScan Intro

RapidScan Outro

How to contribute? If you want to contribute to the author. Read this.

Download RapidScan

More information

• Programa Hacker
• Hacking Definition
• House Hacking
• Curso Seguridad Informatica
• Aprender Hacking Desde Cero
• Hacker Significado
• Hacking Ethical
• Curso Hacking Gratis
• Hacking With Arduino

Read More