Ctrlk
Edit

Argus Surveillance DVR

Argus Surveillance DVR 4.0.0.0 exposes a web interface that can be vulnerable to unauthenticated directory traversal. On Windows targets, this can expose SSH keys and Argus configuration files with recoverable credentials.

Discovery

Look for Argus on the HTTP service, often on TCP/8080:

Useful indicators:

22/tcp   open  ssh          Bitvise WinSSHD 8.48
8080/tcp open  http-proxy
|_http-title: Argus Surveillance DVR
|_http-generator: Actual Drawing 6.0 (http://www.pysoft.com) [PYSOFTWARE]

The web panel may expose users without authentication:

http://TARGET:8080/Users.html

Observed users:

Administrator
Viewer

Directory Traversal

SearchSploit entry:

searchsploit argus
searchsploit -m windows_x86/webapps/45296.txt

The Argus WEBACCOUNT.CGI endpoint can read arbitrary files through the RESULTPAGE parameter:

Expected proof:

Read the Windows hosts file the same way:

Steal SSH Key

Use the exposed users to target Windows profile SSH keys. The Viewer user's key was readable:

Argus Stored Credentials

From the low-privileged shell, search ProgramData for password values:

Argus credentials were stored in:

Relevant values:

Use the Argus weak password encryption exploit to decode stored passwords:

Administrator Shell

Use the recovered password with runas from cmd.exe. See Recovered Local Admin Credentials for the general TTP.

Catch the shell:

Successful shell:

References

  • https://www.exploit-db.com/exploits/45296

  • https://www.exploit-db.com/exploits/50130

PreviousBaGetNextGitea

Last updated