Weak Password Encryption in Argus Surveillance DVR v4.0

This repository is a small standalone Python proof-of-concept/operational credential recovery tool for Argus Surveillance DVR 4.0. It contains two files: a README with usage guidance and one executable script, exploit.py. The script is not a remote code execution exploit and does not contact any network services; instead, it performs local offline decryption/decoding of a password value extracted from the target software's configuration. The core capability is a hardcoded substitution table that maps 4-character hexadecimal-like tokens to plaintext characters, including digits, uppercase letters, lowercase letters, and many special characters. The operator supplies the encrypted password string as a command-line argument. The script validates that exactly one argument is provided and that the input length is divisible by 4, then iterates over the ciphertext in 4-character blocks, translates each block via the lookup table, prints per-block decoding results, and finally outputs the reconstructed plaintext password. The main fingerprintable artifact is the Windows file path C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini, identified in both the README and code comments as the location where the encrypted password can be obtained. There are no URLs, IPs, domains, registry keys, or C2-style endpoints in the code. Overall, the repository's purpose is credential disclosure against Argus Surveillance DVR 4.0 installations where an attacker or analyst already has local access to the stored encrypted password. Because it includes a working decoder and produces plaintext credentials directly, it is best characterized as an operational local/file-based exploit utility rather than a detection script.

Repository contains a small C proof-of-concept for CVE-2022-25012 (Argus Surveillance DVR v4.0 weak password encryption). Structure: (1) README.md with compilation and usage example; (2) pocland.c implementing an offline decoder. Core behavior: the program takes a single command-line argument (a hash/encrypted password string), validates that its length is a multiple of 4, then iterates over the string in 4-character chunks. Each chunk is looked up in a hardcoded mapping_table (MapEntry array) that maps 4-hex-character tokens (e.g., "B4A1", "ECB4", "F539") to a single plaintext character (digits, uppercase/lowercase letters, and '!'). Unknown segments decode to '?'. The decoded characters are concatenated and printed as the recovered password. No networking, remote code execution, or device interaction is implemented; it is a local forensic/credential-recovery utility that relies on obtaining the Argus DVR hash string from some external source (device config, database, capture, etc.).

This repository provides a proof-of-concept (PoC) exploit for CVE-2022-25012, targeting Argus Surveillance DVR 4.0. The main file, 'decode.py', is a Python script that demonstrates the weak password encryption vulnerability in the product. The script contains a hardcoded mapping of encrypted hash segments to their corresponding characters, allowing a user to decode a password hash (as used by the DVR software) into the original plaintext password. The script is standalone, does not interact with the network, and requires the user to supply a password hash (currently hardcoded in the script) to decode. There are no network endpoints or external resources referenced. The repository structure is simple, containing only a README, a .gitattributes file, and the exploit script. The exploit demonstrates the vulnerability but does not automate extraction of hashes from the DVR; it is focused on decoding already obtained hashes.

This repository contains a Python proof-of-concept exploit for CVE-2022-25012, a weak password encryption vulnerability in Argus Surveillance DVR 4.0 (Windows). The main script, CVE-2022-25012.py, implements a decoding routine that maps the application's custom password hash encoding back to plaintext. To use the exploit, an attacker must obtain the encoded password hash from the configuration file (DVRParams.ini) on the target system. The script then outputs the decoded password. The repository includes a README with usage instructions and background, and a LICENSE file. The exploit demonstrates the vulnerability but does not provide a payload for remote code execution or privilege escalation; it is focused on password recovery via local file access.