CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 の POC コマンドインジェクション脆弱性。Hikvision 製品の一部の Web サーバに存在します。入力検証が不十分なため、攻撃者は悪意のあるコマンドを含むメッセージを送信することで、コマンドインジェクション攻撃を仕掛けることができます。 Exploit Title: Hikvision Web Server Build 210702 - Command Injection Exploit Author: bashis Vendor Homepage: https://www.hikvision.com/ Version:...

HikvisionExploiter

HikvisionExploiter HikvisionExploiter は、Hikvision IP カメラ 、特にファームウェアバージョン 3.1.3.150324 を実行しているカメラの未認証エンドポイントを標的とした、強力で自動化されたエクスプロイテーションツールキットです。 次の操作を実行します: スナップショットアクセスの検証 設定ファイルの取得と復号 ユーザー認証情報の抽出 CVE-2021-36260 を使用したリモートコマンド実行 色付き・タイムスタンプ付きログによるマルチスレッドターゲットスキャン 研究者、レッドチーマー、IoT セキュリティ愛好家のために作られまし...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

CVE-2017-7921 Exploit exploit tool for the Hikvision imp...

CVE-2017-7921-Research-Toolkit GUI

CVE-2017-7921 Research Toolkit Security Statement: This tool is intended for authorized security research and vulnerability verification only. Table of Contents Legal and Ethical Statement Project Description Features Installation Usage Output Defense and Remediation Recommendations Technical...

EUVD-2013-4820

Malware in sbrugna...

CVE-2013-4976

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials...

Metasploit Weekly Wrap-Up

Zimbra with Postfix LPE CVE-2022-3569 This week rbowes added an LPE exploit for Zimbra with Postfix. The exploit leverages a vulnerability whereby the Zimbra user can run postfix as root which in turn is capable of executing arbitrary shellscripts. This can be abused for reliable privilege...

Metasploit Weekly Wrap-Up

Veritas Backup Exec Agent RCE This module kindly provided by c0rs targets the Veritas Backup Exec Agent in order to gain RCE as the system/root user. The exploit itself is actually a chain of 3 separate CVEs CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878 which only makes it more impressive...

Hikvision IP Camera Unauthenticated Command Injection

This module exploits an unauthenticated command injection in a variety of Hikvision IP cameras CVE-2021-36260. The module inserts a command into an XML payload used with an HTTP PUT request sent to the /SDK/webLanguage endpoint, resulting in command execution as the root user. This module...

CVE-2013-4975

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

Privilege escalation

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

CVE-2013-4975

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation...

Hikvision IP Camera Default Credentials (HTTP)

The remote Hikvision IP camera device is using known default credentials. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

Hikvision IP Camera Detection (HTTP)

HTTP based detection of Hikvision IP camera devices. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 < 170109) - Access Control Bypass Explo

Exploit for hardware platform in category web applications Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds: 140721 - 170109 Backdoor Date: 15-03-2018 Vendor Homepage: http://www.hikvision.com/en/ Exploit Author: Matamorphosis Category: Web Apps Description: Exploits a backdoor in...

Hikvision IP Camera Web Interface Detection

Binary data hikvisionwwwdetect.nbin...

Hikvision IP Camera Remote Authentication Bypass

The remote Hikvision IP camera is affected by an authentication bypass vulnerability. A remote, unauthenticated attacker can read configurations including account passwords, access the camera images, or modify the camera firmware. C Tenable Network Security, Inc. include'compat.inc'; if descripti...