买了一套课程,送了一些工具大礼包,无聊中,看到有一个智能摄像头,于是玩一玩,发现有三种方式进行联动。
wifi
网线
4G
搞不明白一点就是,摄像头没网口,怎么网线连接。。。。
然后下载app,进行匹配链接,既然能联网,肯定有个ip,有ip可能有web,有web可能有漏洞。
于是开干
简单进行了端口扫描
嗨黑嘿
访问尝试下,emmm
目录扫描
但是也都是一样的访问不了
于是用nmap漏洞模块试试
nmap 192.168.31.29 --script=vuln
Starting Nmap 7.92 ( https://nmap.org ) at 2022-12-03 22:02 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.31.29
Host is up (0.0082s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_ http://ha.ckers.org/slowloris/
| http-enum:
| /cgi-bin/mj_wwwusr: Majordomo2 Mailing List
| /cgi-bin/vcs: Mitel Audio and Web Conferencing (AWC)
| /cgi-bin/ffileman.cgi?: Ffileman Web File Manager
| /cgi-bin/ck/mimencode: ContentKeeper Web Appliance
| /cgi-bin/masterCGI?: Alcatel-Lucent OmniPCX Enterprise
| /cgi-bin/awstats.pl: AWStats
|_ /cgi-bin/image/shikaku2.png: TeraStation PRO RAID 0/1/5 Network Attached Storage
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-majordomo2-dir-traversal: ERROR: Script execution failed (use -d to debug)
|_http-dombased-xss: Couldn't find any DOM based XSS.
554/tcp open rtsp
9898/tcp open monkeycom
发现了一个cve,apache的dos
可以使用msf进行漏洞验证
然后又对另外两个端口进行深入探测
发现 554 端口对应的是rtsp协议,可能存在弱口令,未授权等
尝试测试未授权,失败了
尝试爆破密码,也没成功
模拟器抓包,安装证书后也无法获取数据包,经反编译发现,双向认证,emmm,我是废物。