通用漏洞华为h3c ECR3316-HC型号通用免密码查看视频监控

漏洞详情

披露状态:

2014-02-19: 细节已通知厂商并且等待厂商处理中
2014-03-01: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放
2014-05-17: 细节向公众公开

简要描述:

因为一个小小的程序导致的免去密码查看监控

详细说明:

首先我通过一系列的社工进入了学校的监控系统,这不是重点,登陆之后系统要求我下载一份cab于是我下载,之后发现是软件包

_KFXE4KP(AKX]$7W(2)GSRM.jpg



之后打开主程序

如图

EKY$OQ%27X%WL_Q01F~1`L4.jpg



下载到本地之后发现并不需要密码和账户即可连接,只需要注册到注册表

reg文件的内容如下

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10]
":Range"="192.168.19.41"
"*"=dword:00000002



并没有什么特殊的限制貌似只要是同型号的监控设备都能进去吧

59BYA)66%L}1O1M_{TXBCFA.jpg





于是我为了证实,我将文件包放到虚拟机上,虚拟机上从来没有通过web登陆过监控设备,再用这个软件能够登陆吗?

实验如下

HZ[W0C8Z]S(OWU{`8Z10626.jpg



在windows2008上测试只需注册之后点击查看播放控件即可



为此我查看了登陆的日志文件

内容截取一段如下

[2014-02-17 18:47:40.760]-[StreamDCCtrl.cpp][2899]-[80488]: CPU的使用率为16
[2014-02-17 18:47:40.760]-[StreamDCCtrl.cpp][2947]-[80488]: Thread ID exceeded: 80488
[2014-02-17 18:47:40.760]-[StreamDCCtrl.cpp][2956]-[80488]: /******************************* Start new RealWatch **********************************/
[2014-02-17 18:47:40.760]-[StreamDCCtrl.cpp][2957]-[80488]: /**** Request RealWatch, IP:192.168.19.45, Cam:0, lIndex:3, localPort:49382 ****/
[2014-02-17 18:47:40.761]-[decodework.cpp][269]-[81036]: RtpDecodeThread(): 进入RtpDecodeThread线程!
[2014-02-17 18:47:40.761]-[rtprecv.cpp][1172]-[81708]: RtpRcvThread(): 进入RtpRcvThread线程!
[2014-02-17 18:47:40.762]-[rtprecv.cpp][2343]-[81708]: Send Setup MSG, IP:192.168.19.45 Port:30000
[2014-02-17 18:47:40.878]-[rtprecv.cpp][1756]-[81708]: add accept list: 3232240429.30000
[2014-02-17 18:47:40.878]-[rtprecv.cpp][2239]-[81708]: Stream Type Changed to H264!
[2014-02-17 18:47:41.214]-[decodework.cpp][1535]-[81036]: Video Type TYPE_VIDEO_H264, 352 * 288 !
[2014-02-17 18:47:52.083]-[rtprecv.cpp][1394]-[80784]: Receive Rtp Stream time exceeded, 20 secends no data!
[2014-02-17 18:47:52.083]-[rtprecv.cpp][2547]-[80784]: Send Release MSG, IP:0.0.0.0 Port:0
[2014-02-17 18:47:52.084]-[rtprecv.cpp][1449]-[80784]: RtpRcvThread(): 退出RtpRcvThread线程!
[2014-02-17 18:47:52.084]-[channel.cpp][929]-[81984]: RealWatchRecvMsgProc SDC_MSG_EXIT Close End
[2014-02-17 18:47:52.084]-[decodework.cpp][1106]-[80796]: RtpDecodeThread Received Exit Msg!
[2014-02-17 18:47:52.084]-[decodework.cpp][335]-[80796]: RtpDecodeThread(): 退出RtpDecodeThread线程!
[2014-02-17 18:50:39.917]-[bidirectaudio.cpp][273]-[80488]: ********* Called TerminateThread *********
[2014-02-17 18:50:39.917]-[bidirectaudio.cpp][289]-[80488]: ********* Called TerminateThread *********
[2014-02-17 18:50:39.952]-[channel.cpp][929]-[81032]: RealWatchRecvMsgProc SDC_MSG_EXIT Close End
[2014-02-17 18:50:39.953]-[rtprecv.cpp][1606]-[81708]: RtpRcvThread Received Exit Msg!
[2014-02-17 18:50:39.953]-[rtprecv.cpp][1253]-[81708]: RtpRcvThread(): RtpRecvMsgProc消息处理错误!
[2014-02-17 18:50:39.953]-[rtprecv.cpp][2547]-[81708]: Send Release MSG, IP:192.168.19.45 Port:30000
[2014-02-17 18:50:39.954]-[rtprecv.cpp][1449]-[81708]: RtpRcvThread(): 退出RtpRcvThread线程!
[2014-02-17 18:50:39.954]-[decodework.cpp][1106]-[81036]: RtpDecodeThread Received Exit Msg!
[2014-02-17 18:50:39.956]-[decodework.cpp][335]-[81036]: RtpDecodeThread(): 退出RtpDecodeThread线程!
[2014-02-17 18:50:39.984]-[StreamDCCtrl.cpp][632]-[80488]: -----------------------------------------------------------------------
[2014-02-17 19:11:51.325]-[StreamDCCtrl.cpp][591]-[90544]: ***********************************************************************
[2014-02-17 19:11:51.325]-[StreamDCCtrl.cpp][592]-[90544]: ISC3000V100R002 D020SP10 D020090713
[2014-02-17 19:11:51.644]-[StreamDCCtrl.cpp][1576]-[90544]: OnCreate():窗口成功生成!
[2014-02-17 19:12:05.103]-[StreamDCCtrl.cpp][2899]-[90544]: CPU的使用率为21
[2014-02-17 19:12:05.103]-[StreamDCCtrl.cpp][2947]-[90544]: Thread ID exceeded: 90544
[2014-02-17 19:12:05.103]-[StreamDCCtrl.cpp][2956]-[90544]: /******************************* Start new RealWatch **********************************/
[2014-02-17 19:12:05.103]-[StreamDCCtrl.cpp][2957]-[90544]: /**** Request RealWatch, IP:192.168.19.42, Cam:0, lIndex:0, localPort:34088 ****/
[2014-02-17 19:12:05.104]-[decodework.cpp][269]-[91796]: RtpDecodeThread(): 进入RtpDecodeThread线程!
[2014-02-17 19:12:05.104]-[rtprecv.cpp][1172]-[89704]: RtpRcvThread(): 进入RtpRcvThread线程!
[2014-02-17 19:12:05.104]-[rtprecv.cpp][2343]-[89704]: Send Setup MSG, IP:192.168.19.42 Port:30000
[2014-02-17 19:12:05.146]-[rtprecv.cpp][1756]-[89704]: add accept list: 3232240426.30000
[2014-02-17 19:12:05.146]-[rtprecv.cpp][2239]-[89704]: Stream Type Changed to H264!
[2014-02-17 19:12:05.778]-[decodework.cpp][1535]-[91796]: Video Type TYPE_VIDEO_H264, 352 * 288 !
[2014-02-17 19:12:17.415]-[StreamDCCtrl.cpp][2899]-[90544]: CPU的使用率为20
[2014-02-17 19:12:17.415]-[StreamDCCtrl.cpp][2947]-[90544]: Thread ID exceeded: 90544
[2014-02-17 19:12:17.415]-[StreamDCCtrl.cpp][2956]-[90544]: /******************************* Start new RealWatch **********************************/
[2014-02-17 19:12:17.415]-[StreamDCCtrl.cpp][2957]-[90544]: /**** Request RealWatch, IP:192.168.19.42, Cam:0, lIndex:1, localPort:34090 ****/
[2014-02-17 19:12:17.416]-[decodework.cpp][269]-[90768]: RtpDecodeThread(): 进入RtpDecodeThread线程!
[2014-02-17 19:12:17.416]-[rtprecv.cpp][1172]-[90000]: RtpRcvThread(): 进入RtpRcvThread线程!
[2014-02-17 19:12:17.416]-[rtprecv.cpp][2343]-[90000]: Send Setup MSG, IP:192.168.19.42 Port:30000
[2014-02-17 19:12:17.428]-[rtprecv.cpp][1756]-[90000]: add accept list: 3232240426.30030
[2014-02-17 19:12:17.428]-[rtprecv.cpp][2239]-[90000]: Stream Type Changed to H264!
[2014-02-17 19:12:18.010]-[decodework.cpp][1535]-[90768]: Video Type TYPE_VIDEO_H264, 352 * 288 !
[2014-02-17 19:12:30.711]-[StreamDCCtrl.cpp][2899]-[90544]: CPU的使用率为32
[2014-02-17 19:12:30.711]-[StreamDCCtrl.cpp][2947]-[90544]: Thread ID exceeded: 90544





可以看到,程序貌似只是匹配了端口就能够登陆成功呢?

漏洞证明:

HZ[W0C8Z]S(OWU{`8Z10626.jpg

修复方案:

不知算不算漏洞

版权声明:转载请注明来源 Hxai11@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-03-01 14:04

厂商回复:

最新状态:

暂无


漏洞评价: