LeakIX - Host 115.72.25.120

Host 115.72.25.120

Vietnam

Viettel Group

Vulnerable HiSilicon family DVR

This vulnerability (with proof of concept (PoC) code) affects DVR/NVR devices built using the HiSilicon hi3520d and similar system on a chip (SoC).

Exploiting the vulnerabilities lead to unauthorized remote code execution (RCE) using only the web interface, causing full takeover of the exploited device

IP: 115.72.25.120
Port: 8088
URL: http://115.72.25.120:8088

First seen 2024-04-23 22:16
- Severity: high
  Fingerprint: 321975614123c6c05f83e99b5b070eb1f17b1b12f17b1b12f17b1b12f17b1b12
```
Found HiSiliconDVR firmware:
Hardware: General AHB70016T-MH-V2
Vulnerable to multiple issues : LFI, possibly RCE
```
  Found on 2024-04-23 22:16
Create report

2024-06-15 10:37

HTTP/1.1 200 OK
Connection: close
Cache-Control: no-cache,no-store
Pragma: no-cache
Content-Length: 156491
Set-Cookie: SID_HTTPS_=8b8534ac8ed59ebe582627a25a19498c78ca155431be3e66f4579596ad5632ae; PATH=/; Secure; HttpOnly; SameSite=strict
Set-Cookie: _TESTCOOKIESUPPORT_HTTPS_=1; PATH=/; Secure; HttpOnly; SameSite=strict
Server: 
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: frame-ancestors 'self' 
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8

Page title: F670Y

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge">

<link rel="shortcut icon" href="/img/favicon_viet.ico" />

<title>&#70;&#54;&#55;&#48;&#89;</title>
<style type="text/css">
html, body {
min-height:101%;
}
body {
text-align: center;
background: #F2F2F2;
overflow-y: scroll;
}
body, input, textarea, select, label, td, th {
font-size: 12px;
color: #313131;
font-family: "Microsoft YaHei",Arial,SimSun,Verdana,Helvetica,Sans-Serif,Geneva;
}
body, form, h1, h3, h4, p, ul, ol {
margin: 0;
}
ul, ol {
padding-left: 0;
list-style-type: none;
}
a img {border: 0;}
table {
border-collapse: collapse;
border-spacing: 0;
}
#page_container {
position: relative;
width: 960px;
margin: 0 auto;
padding: 0 30px 15px 30px;
text-align: left;
background: url(../img/site_holder.gif) repeat-y scroll center top;
}
#page_header {
padding-bottom: 20px;
}
#banner {
position: relative;
width: 100%;
height: 74px;
padding-bottom: 5px;
}
.languageListShow{
z-index: 103;
}
#mainNavigator {
width: 100%;
height: 38px;
text-align: center;
margin: 0 auto;
overflow:hidden;
background: #737373;
}
#page_content {
position: relative;
min-height: 510px;
height: auto !important;
height: 480px;
overflow: visible;
text-align: center;
}
#page_footer {
height: 43px;
line-height: 43px;
text-align: left;
background-color: #F4F4F4;
margin-top: 15px;
padding: 0 10px;
border-top: 1px solid #D7D7D7;
}
.logo {
width: 110px;
height: 72px;
float: left;
background: url(../img/Logo_ZTE.png) no-repeat 5px 30px;
}
#banner_switchArea {
width: 500px;
height: 25px;
line-height: 25px;
position: absolute;
bottom: 2px;
right: 0px;
}
.timeArea {
width: 300px;
height: 25px;
line-height: 25px;
position: absolute;
bottom: 2px;
left: 140px;
}
#banner_switchArea div {
float: right;
text-align: center;
margin: 0 8px;
}
#banner_switchArea div.logUser{
padding: 0px;
text-align: right;
overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;
max-width: 180px;
}
.clickable {
cursor: pointer;
}
#mainNavigator ul,li {
margin:0;
padding:0;
list-style: none;
}
#mainNavigator {
position: relative;
}
#mainNavigator ul {
position: relative;
left: 50%;
float: left;
}
#mainNavigator li {
float: left;
position: relative;
right: 50%;
line-height: 34px;
}
#homeLi {
}
#mainNavigator a {
display: block;
width: 100%;
height: 100%;
background: url(../img/nv_middle.gif) repeat-x;
text-decoration: none;
}
#mainNavigator a:link,
#mainNavigator a:visited {
color: #FFFFFF;
}
#mainNavigator a.SelectMenuItem {
color: #FFFFFF;
background: url(../img/nv_s.gif) repeat-x;
}
#mn_first, #mn_last {
height: 100%;
width: 5px;
position: absolute;
}
#mn_li {
background: url(../img/nv_middle.gif) repeat-x;
height: 100%;
}
#mn_first {
background: url(../img/nv_left.gif) no-repeat;
top: 0px;
left: 0px;
}
#mn_last {
background: url(../img/nv_right.gif) no-repeat;
top: 0px;
right: 0px;
}
#slogan {
width: 200px;
float: right;
margin: 0px;
text-align: right;
}
.caption2,
h1 {
border-bottom: 1px dotted #313131;
font-size: 16px;
font-weight: normal;
padding-bottom: 8px;
margin-bottom: 10px;
}
input[type="text"],
input[type="password"],
input[type="file"],
textarea,
select {
-moz-box-sizing: border-box;
-webkit-box-sizing: border-box;
box-sizing: border-box;
height: 26px;
*height: 20px;
padding: 2px;
margin: 2px 0;
border: 1px solid;
border-color: #AAAAAA #CCCCCC #CCCCCC #AAAAAA;
border-radius: 3px;
box-shadow: 0 1px 2px #CCCCCC inset;
}
.SpecialPassword{
font-family: text-security-disc;
}
select {
*height: 26px;
}
textarea {
margin: 0;
width: 100%;
*width: 99%;
resize: none;
height: 180px;
overflow: auto;
}
input[type="text"]:focus,
input[type="password"]:focus,
input[type="file"]:focus,
textarea:focus {
border-color: #FF8040;
-webkit-box-shadow: 0 0 3px rgba(255, 128, 64, 0.7);
-moz-box-shadow: 0 0 3px rgba(255, 128, 64, 0.7);
box-shadow: 0 0 3px rgba(255, 128, 64, 0.7);
}
select:focus {
border-color

Found 2024-06-15 by HttpPlugin

Create report

Fingerprint:

a3d48b68966adfccc9ad0e29d135e99174da6cef4aecb648db758acfb7aeea90

CN:

192.168.1.1

Key:

RSA-2048

Issuer:

Not before:

2019-11-15 01:57

Not after:

2036-04-19 01:57

Domain summary

No record

Host 115.72.25.120

Vietnam

Vulnerable HiSilicon family DVR

Create report

Domain summary