Argus Surveillance DVR
Argus Surveillance DVR 4.0.0.0 exposes a web interface that can be vulnerable to unauthenticated directory traversal. On Windows targets, this can expose SSH keys and Argus configuration files with recoverable credentials.
Discovery
Look for Argus on the HTTP service, often on TCP/8080:
Useful indicators:
22/tcp open ssh Bitvise WinSSHD 8.48
8080/tcp open http-proxy
|_http-title: Argus Surveillance DVR
|_http-generator: Actual Drawing 6.0 (http://www.pysoft.com) [PYSOFTWARE]The web panel may expose users without authentication:
http://TARGET:8080/Users.htmlObserved users:
Administrator
ViewerDirectory Traversal
SearchSploit entry:
searchsploit argus
searchsploit -m windows_x86/webapps/45296.txtThe Argus WEBACCOUNT.CGI endpoint can read arbitrary files through the RESULTPAGE parameter:
Expected proof:
Read the Windows hosts file the same way:
Steal SSH Key
Use the exposed users to target Windows profile SSH keys. The Viewer user's key was readable:
Argus Stored Credentials
From the low-privileged shell, search ProgramData for password values:
Argus credentials were stored in:
Relevant values:
Use the Argus weak password encryption exploit to decode stored passwords:
Administrator Shell
Use the recovered password with runas from cmd.exe. See Recovered Local Admin Credentials for the general TTP.
Catch the shell:
Successful shell:
References
https://www.exploit-db.com/exploits/45296
https://www.exploit-db.com/exploits/50130
Last updated