Back Sploitus Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware
[
- Checks one host for the configuration-file bypass.
- Decrypts the response when it matches the supported format.
- Prints parsed `admin` records with passwords masked by default.
- Fetches a snapshot unless `--no-snapshot` is set.
The implementation reconstructs the AES-128-ECB and per-file XOR steps described in the reverse-engineering notes in the source. Firmware differences may prevent decryption or record parsing even when an endpoint responds.
- `pycryptodome` (listed in `requirements.txt`)
- A camera/NVR reachable over HTTP on the selected port
python -m pip install -r requirements.txt
Example (replace the address with your test device):
python hik_poc.py 192.0.2.10 --no-snapshot
`192.0.2.10` is reserved for examples. The default port is `80`.
| `--port PORT` | HTTP port (default: `80`) |
| `--timeout SECONDS` | Timeout for each request (default: `15`) |
| `--no-snapshot` | Skip the snapshot request; recommended unless you need to verify it |
| `--snapshot-out PATH` | Save the retrieved JPEG to this path (default: `snapshot_bypass.jpg`) |
| `--save PATH` | Save the decrypted configuration locally; treat the file as a secret |
| `--show` | Print parsed passwords in full; avoid sharing this output |
| `-h`, `--help` | Show command-line help |
Passwords are masked by default. The script still saves a snapshot unless `--no-snapshot` is set. Treat files written with `--save` or `--snapshot-out` as sensitive.
- **Bypass accepted:** the endpoint returned a configuration-sized response for a tested token. This is evidence of exposure, not a complete assessment of every vulnerability on the device.
- **Decrypt OK:** the response matched the format this implementation understands.
- **No parsed records / decrypt failed:** the firmware may use a different format, or the returned data may not be a supported configuration.
- **No response:** the device may be unreachable, patched, or configured differently. A failed check does not prove the device is secure.
1. Identify the exact camera/NVR model and firmware version.
2. Install the vendor-recommended firmware that addresses CVE-2017-7921, if available for the device.
3. Restrict management interfaces to trusted networks; do not expose them directly to the internet.
4. Change affected credentials after patching. If a configuration was exposed, treat credentials in it as compromised and rotate them.
5. Review access logs and network exposure for unexpected access.
The script checks only the host passed on the command line. A failed check does not prove that the device is secure; firmware differences or network settings can affect the result.
При успешном ответе скрипт расшифрует конфигурацию поддерживаемого формата и покажет найденные записи `admin`. Пароли скрыты по умолчанию. Снимок сохраняется автоматически; отключите его параметром `--no-snapshot`.
**Защита:** обновите прошивку до версии, исправляющей уязвимость, закройте доступ к веб-интерфейсу из интернета и смените пароли. Сохранённую конфигурацию и снимок считайте конфиденциальными. Отсутствие результата проверки не доказывает, что устройство защищено.
Запускайте PoC только на своём устройстве или с разрешения владельца.
Released under the MIT License. See [LICENSE](LICENSE).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
