Open Sesame (Dlink - CVE-2012-4046)

A couple weeks ago a vulnerability was posted for the dlink DCS-9xx series of cameras. The author of the disclosure found that the setup application that comes with the camera is able to send a specifically crafted request to a camera on the same network and receive its password in plaintext. I figured this was a good chance to do some analysis and figure out exactly how the application carried out this functionality and possibly create a script to pull the password out of a camera.

The basic functionality of the application is as follows:

• Application sends out a UDP broadcast on port 5978
• Camera sees the broadcast on port 5978 and inspects the payload – if it sees that the initial part of the payload contains "FF FF FF FF FF FF" it responds (UDP broadcast port 5978) with an encoded payload with its own MAC address
• Application retrieves the camera's response and creates another UDP broadcast but this time it sets the payload to contain the target camera's MAC address, this encoded value contains the command to send over the password
• Camera sees the broadcast on port 5978 and checks that it is meant for it by inspecting the MAC address that has been specified in the payload, it responds with an encoded payload that contains its password (base64 encoded)

After spending some time with the application in a debugger I found what looked like it was responsible for the decoding of the encoded values that are passed:

super exciting screen shot.

After spending some time documenting the functionality I came up with the following notes (messy wall of text):

	Command	Comments
	.JGE SHORT 0A729D36	; stage1
	./MOV EDX,DWORD PTR SS:[LOCAL.2]	; set EDX to our 1st stage half decoded buffer
	.|MOV ECX,DWORD PTR SS:[LOCAL.4]	; set ECX to our current count/offset
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our base64 encoded payload
	.|MOVSX EAX,BYTE PTR DS:[EAX]	; set EAX to the current value in our base64 payload
	.|MOV AL,BYTE PTR DS:[EAX+0A841934]	; set EAX/AL to a hardcoded offset of its value table is at 0a841934
	.|MOV BYTE PTR DS:[ECX+EDX],AL	; ECX = Offset, EDX = start of our half-decoded buffer, write our current byte there
	.|INC DWORD PTR SS:[LOCAL.4]	; increment our offset/count
	.|INC DWORD PTR SS:[LOCAL.3]	; increment our base64 buffer to next value
	.|MOV EDX,DWORD PTR SS:[LOCAL.4]	; set EDX to our counter
	.|CMP EDX,DWORD PTR SS:[ARG.2]	; compare EDX (counter) to our total size
	.\JL SHORT 0A729D13	; jump back if we have not finished half decoding our input value
	.MOV ECX,DWORD PTR SS:[ARG.3]	; Looks like this will point at our decoded buffer
	.MOV DWORD PTR SS:[LOCAL.5],ECX	; set Arg5 to our decoded destination
	.MOV EAX,DWORD PTR SS:[LOCAL.2]	; set EAX to our half-decoded buffer
	.MOV DWORD PTR SS:[LOCAL.3],EAX	; set arg3 to point at our half-decoded buffer
	.MOV EDX,DWORD PTR SS:[ARG.4]	; ???? 1500 decimal
	.XOR ECX,ECX	; clear ECX
	.MOV DWORD PTR DS:[EDX],ECX	; clear out arg4 value
	.XOR EAX,EAX	; clear out EAX
	.MOV DWORD PTR SS:[LOCAL.6],EAX	; clear out local.6
	.JMP SHORT 0A729DAE	; JUMP
	./MOV EDX,DWORD PTR SS:[LOCAL.3]	; move our current half-decoded dword position into EDX
	.|MOV CL,BYTE PTR DS:[EDX]	; move our current byte into ECX (CL) (dword[0])
	.|SHL ECX,2	; shift left 2 dword[0]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; move our current dword position into EAX
	.|MOVSX EDX,BYTE PTR DS:[EAX+1]	; move our current dword position + 1 (dword[1]) into EDX
	.|SAR EDX,4	; shift right 4 dword[1]
	.|ADD CL,DL	; add (shift left 2 dword[0]) + (shift right 4 dword[1])
	.|MOV EAX,DWORD PTR SS:[LOCAL.5]	; set EAX to our current decoded buffer position
	.|MOV BYTE PTR DS:[EAX],CL	; write our decoded (dword[0]) value to or decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; increment our position in the decoded buffer
	.|MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current dword position
	.|MOV CL,BYTE PTR DS:[EDX+1]	; set ECX to dword[1]
	.|SHL ECX,4	; left shift 4 dword[1]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current dword position
	.|MOVSX EDX,BYTE PTR DS:[EAX+2]	; set EDX to dword[2]
	.|SAR EDX,2	; shift right 2 dword[2]
	.|ADD CL,DL	; add (left shift 4 dword[1]) + (right shift 2 dword[2])
	.|MOV EAX,DWORD PTR SS:[LOCAL.5]	; set EAX to our next spot in the decoded buffer
	.|MOV BYTE PTR DS:[EAX],CL	; write our decoded value into our decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.|MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current half-decoded dword
	.|MOV CL,BYTE PTR DS:[EDX+2]	; set ECX dword[2]
	.|SHL ECX,6	; shift left 6 dword[2]
	.|MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current half-decoded dword
	.|ADD CL,BYTE PTR DS:[EAX+3]	; add dword[2] + dword[3]
	.|MOV EDX,DWORD PTR SS:[LOCAL.5]	; set EDX to point at our next spot in our decoded buffer
	.|MOV BYTE PTR DS:[EDX],CL	; write our decoded byte to our decoded buffer
	.|INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.|ADD DWORD PTR SS:[LOCAL.3],4	; increment our encoded buffer to point at our next dword
	.|MOV ECX,DWORD PTR SS:[ARG.4]	; set ECX to our current offset?
	.|ADD DWORD PTR DS:[ECX],3	; add 3 to our current offset?
	.|ADD DWORD PTR SS:[LOCAL.6],4	; add 4 to our byte counter??
	.|MOV EAX,DWORD PTR SS:[ARG.2]	; move total size into EAX
	.|ADD EAX,-4	; subtract 4 from total size
	.|CMP EAX,DWORD PTR SS:[LOCAL.6]	; compare our total bytes to read bytes
	.\JG SHORT 0A729D50	; jump back if we are not done
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our last DWORD of encoded buffer
	.MOVSX ECX,BYTE PTR DS:[EDX+3]	; set ECX to dword[3] last byte of our half-decoded dword (dword + 3)
	.INC ECX	; increment the value of dword[3]
	.JE SHORT 0A729E1E
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to our current half-decoded dword
	.MOV DL,BYTE PTR DS:[EAX]	; set EDX (DL) to dword[0]
	.SHL EDX,2	; shift left 2 dword[0]
	.MOV ECX,DWORD PTR SS:[LOCAL.3]	; set ECX to our current encoded dword position
	.MOVSX EAX,BYTE PTR DS:[ECX+1]	; set EAX to dword[1]
	.SAR EAX,4	; shift right 4 dword[1]
	.ADD DL,AL	; add (shifted left 2 dword[0]) + (shifted right 4 dword[1])
	.MOV ECX,DWORD PTR SS:[LOCAL.5]	; set ECX to point at our next spot in our decoded buffer
	.MOV BYTE PTR DS:[ECX],DL	; write our decoded value (EDX/DL) to our decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to point at our dword
	.MOV AL,BYTE PTR DS:[EDX+1]	; set EAX/AL to dword[1]
	.SHL EAX,4	; shift left 4 dword[1]
	.MOV EDX,DWORD PTR SS:[LOCAL.3]	; set EDX to our current dword
	.MOVSX ECX,BYTE PTR DS:[EDX+2]	; set ECX to dword[2]
	.SAR ECX,2	; shift right 2 dword[2]
	.ADD AL,CL	; add (shifted left 4 dword[1]) + (shifted right 2 dword[2])
	.MOV EDX,DWORD PTR SS:[LOCAL.5]	; set EDX to point at our current spot in our decoded buffer
	.MOV BYTE PTR DS:[EDX],AL	; write our decoded value to the decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; move to the next spot in our decoded buffer
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; set EAX to point at our current dword
	.MOV CL,BYTE PTR DS:[EAX+2]	; set ECX/CL to dword[2]
	.SHL ECX,6	; shift left 6 dword[2]
	.MOV EAX,DWORD PTR SS:[LOCAL.3]	; point EAX at our current dword
	.ADD CL,BYTE PTR DS:[EAX+3]	; add dword[3] + (shifted left 6 dword[2])
	.MOV EDX,DWORD PTR SS:[LOCAL.5]	; point EDX at our current decoded buffer
	.MOV BYTE PTR DS:[EDX],CL	; write our decoded value to the decoded buffer
	.INC DWORD PTR SS:[LOCAL.5]	; increment our deocded buffer
	.MOV ECX,DWORD PTR SS:[ARG.4]	; set ECX to our current offset?
	.ADD DWORD PTR DS:[ECX],3	; add 4 for our current byte counter?
	.JMP 0A729EA6	; jump

Translated into english: the application first uses a lookup table to translate every byte in the input string, to do this it uses the value of the current byte as an offset into the table.  After it is done with "stage1" it traverses the translated input buffer a dword at a time and does some bit shifting and addition to fully decode the value. The following roughly shows the "stage2" routine:

(Dword[0] << 2) + (Dword[1] >> 4) = unencoded byte 1 

(Dword[1] << 4) + (Dword[2] >> 2) = unencoded byte 2 

(Dword[2] << 6) + Dword[3] = unencoded byte 3

I then confirmed that this routine worked on an "encoded" value that went over the wire from the application to the camera. After confirming the encoding scheme worked, I recreated the network transaction the application does with the camera to create a stand alone script that will retrieve the password from a camera that is on the same lan as the "attacker". The script can be found here, thanks to Jason Doyle for the original finding (@jasond0yle ).

Continue reading

1. Hacker Tools For Mac
2. Hacking Tools Kit
3. Hacker Search Tools
4. Best Pentesting Tools 2018
5. Hacker Tools Software
6. Physical Pentest Tools
7. Kik Hack Tools
8. Pentest Tools Free
9. Hacker Tools Software
10. Hacker Tools List
11. Hacker Tools Online
12. Hacking Tools Github
13. Tools Used For Hacking
14. Hack And Tools
15. Hack Website Online Tool
16. Pentest Tools For Android
17. Pentest Tools Website
18. Pentest Tools For Android
19. Hacking Apps
20. Hacker Tools For Mac
21. Best Hacking Tools 2019
22. Hacking Tools Online
23. Pentest Tools Github
24. Hack Tools For Mac
25. Hacker Tools 2019
26. Pentest Tools Android
27. Pentest Tools Framework
28. Pentest Tools Windows
29. Hacker Tools Free Download
30. Pentest Tools Download
31. Hacking Tools Download
32. Hacker Tools For Mac
33. Black Hat Hacker Tools
34. Easy Hack Tools
35. Hacking Tools Usb
36. How To Install Pentest Tools In Ubuntu
37. Underground Hacker Sites
38. How To Install Pentest Tools In Ubuntu
39. Computer Hacker
40. Hacks And Tools
41. Hack Tools Download
42. Hacker Tools Hardware
43. Hacking Tools Download
44. Bluetooth Hacking Tools Kali
45. Hacks And Tools
46. Hacker Techniques Tools And Incident Handling
47. Hacking Tools Free Download
48. Hacker Tools Hardware
49. Hacker Tools Apk
50. Easy Hack Tools
51. How To Make Hacking Tools
52. Pentest Tools Review
53. Hacker
54. Hacking Tools Name
55. Hacking Tools For Windows 7
56. Hacker Tools Online
57. Hack Tools For Pc
58. Hacking Tools Usb
59. Hackrf Tools
60. Hacker Tool Kit
61. Pentest Tools List
62. Hacking Tools Mac
63. Tools Used For Hacking
64. World No 1 Hacker Software
65. Hack Website Online Tool
66. Hacker Security Tools
67. Wifi Hacker Tools For Windows
68. Black Hat Hacker Tools
69. Growth Hacker Tools
70. Hacking Tools
71. Hacking Tools For Windows Free Download
72. Pentest Tools Subdomain
73. Hacker Tools For Mac
74. Hak5 Tools
75. Hacking Tools For Mac
76. Hacking Tools Name
77. Hacking Tools Mac
78. Pentest Tools Nmap
79. Hack Tools Online
80. Pentest Tools For Mac
81. Hack Apps
82. Hacking Tools For Kali Linux
83. Pentest Tools For Android
84. Github Hacking Tools
85. Hack Tools For Mac
86. Hacking Apps
87. How To Make Hacking Tools
88. Hack Tools Online
89. Hacker Tools List
90. Hack And Tools
91. Pentest Tools Alternative
92. Install Pentest Tools Ubuntu
93. Hacker Tools 2019
94. Hacker Tools 2019
95. Pentest Tools Apk
96. Kik Hack Tools
97. Pentest Tools Online
98. Pentest Tools Linux
99. Pentest Automation Tools
100. Tools Used For Hacking
101. Underground Hacker Sites
102. Pentest Tools Free
103. Pentest Tools Tcp Port Scanner
104. Hacking Tools For Pc
105. Nsa Hack Tools Download
106. Hack Tool Apk
107. Tools Used For Hacking
108. Hacking Tools Windows
109. Hacker Tools List
110. Nsa Hack Tools Download
111. Hackrf Tools
112. Hacker Tools Online
113. Hack Tools 2019
114. What Is Hacking Tools
115. Pentest Tools Framework
116. Game Hacking
117. Hacks And Tools
118. Pentest Tools Linux
119. Pentest Reporting Tools
120. Physical Pentest Tools
121. Hacker Tool Kit
122. Hack Tools
123. Hacking Tools Windows
124. Hack And Tools
125. Pentest Tools Url Fuzzer
126. Best Hacking Tools 2019
127. Pentest Box Tools Download
128. Hacking Tools Mac
129. Pentest Recon Tools
130. Wifi Hacker Tools For Windows
131. Hacking Tools
132. Pentest Tools List
133. Hacking Tools And Software
134. Hacking Tools Windows
135. Hacker Tools Windows
136. Hacking Tools For Games
137. Hacks And Tools
138. Hack Tools Mac
139. Usb Pentest Tools
140. Ethical Hacker Tools
141. New Hack Tools
142. Hacks And Tools
143. Pentest Tools Linux
144. Pentest Reporting Tools
145. Nsa Hack Tools Download
146. Hacking Tools Software
147. Pentest Tools Tcp Port Scanner
148. Hacking Tools Windows
149. Pentest Tools Review
150. Hack Tools For Pc
151. Pentest Tools Github
152. Hacking Tools Usb
153. Hacker Search Tools
154. Tools Used For Hacking
155. Hacker Tools Linux
156. Black Hat Hacker Tools
157. Hacker Tools Apk
158. Hack Tools For Pc
159. World No 1 Hacker Software
160. Pentest Tools Kali Linux
161. Hack Tools For Windows
162. Hacker Tools For Windows
163. Pentest Automation Tools
164. Pentest Tools Windows
165. Hack Tools Mac
166. Hacking App
167. Hacking Tools For Windows
168. Tools 4 Hack
169. Hacking Tools Software
170. Hacking Tools For Pc
171. Pentest Tools Nmap