Sunluxy DVR backdoor

A couple of news items that recently caught my attention discussed backdoors found in network routers [1] [2]. I'll throw in something similar in case anyone is keeping track.

I picked up a Sunluxy CCTV DVR from ebay at the start of the year to record bluetits nesting in one of my bird boxes. Unfortunately both parents apparently succumbed to predation and the chicks perished but that is beside the point. The product itself was pretty good and unsurprisingly it has quite a few positive reviews on Amazon. Nothing unusual so far.

One thing that did annoy me slightly though was the way videos had to be exported. You had to manually export videos (to USB) on a day by day basis, which isn't really what I was after. I'd rather pull recordings for the last week or so over the network in one go but this didn't seem like an existing feature. Oh well, time to have a poke around!


Sunluxy itself appears to just be a front for the OEM JuanDVR. The sunluxy website is, well, very beta to say the least. Most links don't actually go anywhere and there are no firmware updates available. Poking around on the Juandvr site I found something that seemed pretty similar, but not exact. It was enough to start getting a feel of what was going on though.

Annoyingly, the box runs telnet but it is restricted to root and and the root password is only known to JuanDVR by the looks of things (you don't get to set it). From /etc/passwd it is clear the box only has user root (nice, single exploit to win the day). Incidentally, the /etc/passwd file looks like this:

root:$1$$Tq0vqGpgZ5IEA8LdEOI9F.:0:0::/root:/bin/sh

I didn't figure out the password, but then again, I didn't try cloudcracker.

Update: Chris has posted the password in the comments below.

Time to pop off the cover to check for debug points on the board. There were four helpful looking points and a quick probe later confirms them to be a 5V TTL serial port. Hooking up a USB to serial converter got me to some debugging output.

The debugging output was nice, but not overly helpful. Time to check the startup scripts to see if there was anything in there that could be taken advantage of. At this stage I also have access to U-Boot, so I could overwrite the image with a custom one, but that was being left as option of last resort purely because it had more chance of something going wrong.

Luckily, it looked like some code to facilitate testing had been left in the run_app.sh script:

echo "do you want to run app.out(y or n)?"
read -t 1 -n 1 char

insmod /lib/modules/2.6.24-rt1-hi3520v100/kernel/fs/nls/nls_cp936.ko

if [ "$char" == "n" ];then
        echo "Don't run program!"
else
        cd /root/dvr_app;./dvr_reset
        if [ "$?" == "0" ];then
                cd /root/dvr_app;./dvr_resource
                cd /root;./upnp_server &
                sleep 3
                cd /root/dvr_gui;./dvr_gui &
                cd /root/dvr_app;./dvr_app
        else
                echo "System reset!"
        fi
fi

So you have a 1 second window to hit 'n' during bootup to stop the main app running. Doing so brings you to a shell. This is handy to copy files onto USB for analysis but not exactly a practical way of getting root. The device isn't working as intended and any changes won't be preserved on the file system.

Cutting a long story short, the plan of attack was to reverse the cgi's in the hope of finding a bug that could be exploited to give me a root shell. The approach was to search for command injection vulnerabilities so a quick bit of readelf + grep showed that there were six binaries that linked to system(). Of those six, one didn't actually have ANY authorisation checks in place and it simply passed the parameters of the request straight into system(). Needless to say, that is a rather serious flaw considering these boxes are designed to allow access from outside the network and this is trivial to exploit.

Since Sunluxy don't appear to provide firmware updates and the generic ones from JuanDVR won't load onto a Sunluxy box (the signature in the header is different) it looks like users are going to be stuck for a while. I won't mention the name of the backdoor cgi for now as I'm waiting to hear back from Sunluxy.

I'm not suggesting these DVRs are going to be anywhere near as common as the routers mentioned above, but if you have one you probably want to reconsider allowing it through your firewall for now.