LeakIX - Host centuryhonest.direct.quickconnect.to

Domain centuryhonest.direct.quickconnect.to

Hong Kong

Hong Kong Broadband Network Ltd.

Vulnerable HiSilicon family DVR

This vulnerability (with proof of concept (PoC) code) affects DVR/NVR devices built using the HiSilicon hi3520d and similar system on a chip (SoC).

Exploiting the vulnerabilities lead to unauthorized remote code execution (RCE) using only the web interface, causing full takeover of the exploited device

IP: 183.178.140.230
Domain: centuryhonest.direct.quickconnect.to
Port: 80
URL: http://centuryhonest.direct.quickconnect.to

First seen 2024-02-01 09:32
Last seen 2024-12-21 01:24
Open for 323 days
- Severity: high
  Fingerprint: 321975614123c6c05f83e99be00d7104014dcbe9014dcbe9014dcbe9014dcbe9
```
Found HiSiliconDVR firmware:
Hardware: General NBD6808T-PL
Vulnerable to multiple issues : LFI, possibly RCE
```
  Found on 2024-12-21 01:24
Create report

Open service 183.178.140.230:80 · centuryhonest.direct.quickconnect.to

2024-12-21 01:24

HTTP/1.0 200 OK
Content-type: text/html
Server: uc-httpd 1.0.0
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    
    <title>NETSurveillance WEB</title>
    
    <!-- m.js -->

    <script type="text/javascript" language="JavaScript">
var ShowTipFlag=2;
	if(navigator.userAgent.indexOf('IE') < 0)
	{
		var userAgent = navigator.userAgent,   
                rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
                rFirefox = /(firefox)\/([\w.]+)/,   
                rOpera = /(opera).+version\/([\w.]+)/,   
                rChrome = /(chrome)\/([\w.]+)/,   
                rSafari = /version\/([\w.]+).*(safari)/;
		var browserMatch = uaMatch(userAgent.toLowerCase());
		 
		if(browserMatch.browser!="IE")
		{
		     location="Login.htm";
			 }
		
	}
	
	function reminder()
	{
		var nSel=$('langlist').selectedIndex;
		var cLanguage;
		switch(nSel)
		{
		case 0:
             cLanguage="English";
            
             break;
		case 1:
             cLanguage="French";
            
             break;
		case 2:
             cLanguage="Hungarian";
            
             break;
		case 3:
             cLanguage="Italian";
            
             break;
		case 4:
             cLanguage="Japanese";
             
             break;
		case 5:
             cLanguage="Portugal";
            
             break;
		case 6:
             cLanguage="Russian";
             
             break;
		case 7:
             cLanguage="SimpChinese";
            
             break;
		case 8:
             cLanguage="Spanish";
            
             break;
		case 9:
             cLanguage="TradChinese";
             
             break;
		case 10:
             cLanguage="German";
            
             break;
		case 11:
             cLanguage="Poland";
            
             break;
		case 12:
             cLanguage="Turkey";
           
             break;
		case 13:
             cLanguage="Romanian";
             break;
		case 14:
             cLanguage="Suomi";
             break;
		case 15:
             cLanguage="Korean";
             break;
		case 16:
             cLanguage="Farsi";
             break;
		case 17:
             cLanguage="Thai";
             break;
		case 18:
             cLanguage="Greek";
             break;
		case 19:
             cLanguage="Vietnamese";
             break;
		case 20:
             cLanguage="Brazilian";
             break;
		case 21:
             cLanguage="Hebrew";
             break;
		case 22:
             cLanguage="Arabic";  
             break;  
		case 23:
             cLanguage="Bulgarian";  
             break; 
		case 24:
      		 cLanguage="Czech";  
             break;
		case 25:
			cLanguage="Azerbaycan";
			break;
		default:
             cLanguage="English";
             break;   
		}			 
		
		if(2==ShowTipFlag)
		{
			switch(nSel)
			{
				case 0:
					cLanguage="English";
					alert("Please set the encrypted problem!");
					break;
				case 7:
					cLanguage="SimpChinese";
					alert("请先设置密保问题!");   
					break;  
				default:
					cLanguage="English";
					alert("Please set the encrypted problem!");
					break;       
			}
		}
		else
		{
			location="reminder.html?cLanguage="+cLanguage;
		}
		
	}
	
	function uaMatch(ua) {  
                    var match = rMsie.exec(ua);
		      
                    if (match != null) {  
                        return { browser : "IE", version : match[2] || "0" };  
                   }  
                    var match = rFirefox.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }

Found one day ago by HttpPlugin

Create report

Open service 183.178.140.230:80 · centuryhonest.direct.quickconnect.to

2024-12-19 02:44

HTTP/1.0 200 OK
Content-type: text/html
Server: uc-httpd 1.0.0
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    
    <title>NETSurveillance WEB</title>
    
    <!-- m.js -->

    <script type="text/javascript" language="JavaScript">
var ShowTipFlag=2;
	if(navigator.userAgent.indexOf('IE') < 0)
	{
		var userAgent = navigator.userAgent,   
                rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
                rFirefox = /(firefox)\/([\w.]+)/,   
                rOpera = /(opera).+version\/([\w.]+)/,   
                rChrome = /(chrome)\/([\w.]+)/,   
                rSafari = /version\/([\w.]+).*(safari)/;
		var browserMatch = uaMatch(userAgent.toLowerCase());
		 
		if(browserMatch.browser!="IE")
		{
		     location="Login.htm";
			 }
		
	}
	
	function reminder()
	{
		var nSel=$('langlist').selectedIndex;
		var cLanguage;
		switch(nSel)
		{
		case 0:
             cLanguage="English";
            
             break;
		case 1:
             cLanguage="French";
            
             break;
		case 2:
             cLanguage="Hungarian";
            
             break;
		case 3:
             cLanguage="Italian";
            
             break;
		case 4:
             cLanguage="Japanese";
             
             break;
		case 5:
             cLanguage="Portugal";
            
             break;
		case 6:
             cLanguage="Russian";
             
             break;
		case 7:
             cLanguage="SimpChinese";
            
             break;
		case 8:
             cLanguage="Spanish";
            
             break;
		case 9:
             cLanguage="TradChinese";
             
             break;
		case 10:
             cLanguage="German";
            
             break;
		case 11:
             cLanguage="Poland";
            
             break;
		case 12:
             cLanguage="Turkey";
           
             break;
		case 13:
             cLanguage="Romanian";
             break;
		case 14:
             cLanguage="Suomi";
             break;
		case 15:
             cLanguage="Korean";
             break;
		case 16:
             cLanguage="Farsi";
             break;
		case 17:
             cLanguage="Thai";
             break;
		case 18:
             cLanguage="Greek";
             break;
		case 19:
             cLanguage="Vietnamese";
             break;
		case 20:
             cLanguage="Brazilian";
             break;
		case 21:
             cLanguage="Hebrew";
             break;
		case 22:
             cLanguage="Arabic";  
             break;  
		case 23:
             cLanguage="Bulgarian";  
             break; 
		case 24:
      		 cLanguage="Czech";  
             break;
		case 25:
			cLanguage="Azerbaycan";
			break;
		default:
             cLanguage="English";
             break;   
		}			 
		
		if(2==ShowTipFlag)
		{
			switch(nSel)
			{
				case 0:
					cLanguage="English";
					alert("Please set the encrypted problem!");
					break;
				case 7:
					cLanguage="SimpChinese";
					alert("请先设置密保问题!");   
					break;  
				default:
					cLanguage="English";
					alert("Please set the encrypted problem!");
					break;       
			}
		}
		else
		{
			location="reminder.html?cLanguage="+cLanguage;
		}
		
	}
	
	function uaMatch(ua) {  
                    var match = rMsie.exec(ua);
		      
                    if (match != null) {  
                        return { browser : "IE", version : match[2] || "0" };  
                   }  
                    var match = rFirefox.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }

Found 2024-12-19 by HttpPlugin

Create report

Domain summary

centuryhonest.direct.quickconnect.to 2

1 recorded

IP summary

183.178.140.230 2

1 recorded

Domain centuryhonest.direct.quickconnect.to

Hong Kong

Vulnerable HiSilicon family DVR

Create report

Create report

Domain summary

IP summary