CVE-2018-9995 PoC — TBK DVR4104和DVR4216 安全漏洞

Source

https://github.com/kienquoc102/CVE-2018-9995-2

Associated Vulnerability

Title: TBK DVR4104和DVR4216 安全漏洞 (CVE-2018-9995)
Description:TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Readme

#  [Tool] CVE-2018-9995-2

	[*] CVE:            CVE-2018-9995
	[*] Exploit Author: Fernandez Ezequiel ( @capitan_alfa ) 
	[*] Modify:         Kien Quoc
	[*] Version:        2.0

	
## Install Python3
        apt-get install git
        pip3 install requests
        pip3 install colorama
        sudo apt update
        apt-get install python3

## Quick start
```
     git clone https://github.com/kienquoc102/CVE-2018-9995-2
     cd CVE-2018-9995-2
     python3 exploit.py
     *and then enter IP and port (excluding http://ip:port)*
     Example: ( Host: 192.168.x.x )
              ( Port: 81 )
     and wait for hack.


```
![DVR_indoor_1](screenshot/indoor/in_x.png)
![DVR_indoor_2](screenshot/indoor/in_x1.png)
![DVR_indoor_3](screenshot/indoor/in_1.png)
![DVR_indoor_4](screenshot/indoor/in_2.png)
![DVR_indoor_5](screenshot/indoor/in_3.png)
![DVR_indoor_6](screenshot/indoor/in_4.png)
![DVR_indoor_7](screenshot/indoor/in_5.png)
<img src="https://github.com/kienquoc102/CVE-2018-9995-2/blob/master/in_8.jpg">


# Hack successfully:
<img src="https://github.com/kienquoc102/CVE-2018-9995-2/blob/master/main1.jpg">


## The camera Company Has a Security Error:
	Novo
	CeNova
	QSee
	Pulnix
	XVR 5 in 1 (title: "XVR Login")
	Securus,  - Security. Never Compromise !! - 
	Night OWL
	DVR Login
	HVR Login
	MDVR Login
	Zeisic


### Login Main:
![DVR_login_1](screenshot/loginFront/login_1.png)
![DVR_login_2](screenshot/loginFront/login_2.png)
![DVR_login_3](screenshot/loginFront/login_3.png)
![DVR_login_4](screenshot/loginFront/login_4.png)
![DVR_login_5](screenshot/loginFront/login_5.png)
![DVR_login_6](screenshot/loginFront/login_6.png)
![DVR_login_7](screenshot/loginFront/login_7.png)
![DVR_login_8](screenshot/loginFront/login_9.png)
![DVR_login_10](screenshot/loginFront/login_10.png)


# Dorks: 
        Zoomeye.org: "/login.rsp"
        Shodan: "login.rsp"
        Google: intitle:"DVR Login"
                intitle:"NVR Login"
	            intitle:"XVR Login"
	            intitle:"AHD Login"

![DVR_dorks_0](screenshot/cow/zoomEyes.jpg) 
![DVR_dorks_2](screenshot/cow/shodan_1.png) 
![DVR_dorks_1](screenshot/cow/google_1.png) 
![DVR_dorks_3](screenshot/cow/shodan_2.png)


Tks for Read :XD

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →