LeakIX - Host 59.27.61.216

Host 59.27.61.216

South Korea

Korea Telecom

Vulnerable HiSilicon family DVR

This vulnerability (with proof of concept (PoC) code) affects DVR/NVR devices built using the HiSilicon hi3520d and similar system on a chip (SoC).

Exploiting the vulnerabilities lead to unauthorized remote code execution (RCE) using only the web interface, causing full takeover of the exploited device

IP: 59.27.61.216
Port: 5000
URL: http://59.27.61.216:5000

First seen 2023-02-03 14:36
Last seen 2024-04-18 19:05
Open for 440 days
- Severity: high
  Fingerprint: 321975614123c6c05f83e99b74b6d9e701d3b64c01d3b64c01d3b64c01d3b64c
```
Found HiSiliconDVR firmware:
Hardware: General AHB7004T-MHV2
Vulnerable to multiple issues : LFI, possibly RCE
```
  Found on 2024-04-18 19:05
Create report

2024-04-18 19:05

HTTP/1.0 200 OK
Content-type: text/html
Server: uc-httpd 1.0.0
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    <title>NETSurveillance WEB</title>
    <!-- m.js -->
    
    <script type="text/javascript" language="JavaScript">
	if(navigator.userAgent.indexOf('IE') < 0)
	{
		var userAgent = navigator.userAgent,   
                rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
                rFirefox = /(firefox)\/([\w.]+)/,   
                rOpera = /(opera).+version\/([\w.]+)/,   
                rChrome = /(chrome)\/([\w.]+)/,   
                rSafari = /version\/([\w.]+).*(safari)/;
		var browserMatch = uaMatch(userAgent.toLowerCase());
		 
		if(browserMatch.browser!="IE")
		{
		     location="Login.htm";
		}
		
	}
	
	function uaMatch(ua) {  
                    var match = rMsie.exec(ua);
		      
                    if (match != null) {  
                        return { browser : "IE", version : match[2] || "0" };  
                   }  
                    var match = rFirefox.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                    var match = rOpera.exec(ua);  
                    if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                   var match = rChrome.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                   }  
                    var match = rSafari.exec(ua);  
                    if (match != null) {  
                       return { browser : match[2] || "", version : match[1] || "0" };  
                    }  
                  if (match != null) {  
                        return { browser : "", version : "0" };  
                   }  
               }  
    </script>
    <script type="text/javascript" src="m.jsp"></script>
    <script type="text/javascript" src="config.js"></script>
    <script type="text/javascript" >
    var ipaddress =document.location.hostname;
	if(ipaddress == "")
	{
		ipaddress = "10.10.33.175";
	}
var hostport=5001;
var iLanguage=116;
	var DownLoadAddr="";
	var numLanguage;
	</script>


    <!-- 全局变量 -->

    <script type="text/javascript" type="text/javascript">
var gExitChannel=new Array();
var gExitSubType=new Array();
var gexiti;
var gcid=-1;
var g_channelNum=4;
var g_digitalChannel=0;
var gspeed;
var gsld;
var gslda;
var gsldb;
var gsldc;
var gsldd;
var gfmu1=0;
var gfmu2=0;
var gfmu3=0;
var g_bRecord=false;
var g_bRealPlay=false;
var g_bAudio=false;
var g_bQS=false;
var g_bClose=false;
var gHashCookie = new Hash.Cookie('NetSuveillanceWebCookie',{duration: 30});
var settings = {
	username:'',
	ocxlanguage:''
	}
var gca=0;
var gcb=0;
var gcc=0;
var gcd=0;
var gcs=0;

var gAutoPlayAll=false;
   

    </script>

    <!-- 颜色滑块 -->

    <script type="text/javascript" type="text/javascript">
function sldtopos(sld,step){
	sld.knob.setStyle('left', sld.toPosition(step));
	gcs=step;
}
function setcolorsv(f,v){
		switch (f)
		{

	        case 5: gcs=v;//5这个值是云台的速度值
					$('ScrollBar').title=v;
					break;

		}	
}



function getcolors(){
	var colors="";
	colors=ocx.GetColor();
	
	var t= new Array();
	if (colors !="")
	{
		t=colors.split(',');
		
    if(64==parseInt(t[0]))
    {
        OnColorBT(5,1);     
    }
    else
    {
        var ver=parseInt(t[0])/14;    
        OnColorBT(1,ver);         
    }
    
    if(64==parseInt(t[1]))
    {
        OnColorBT(5,2);     
    }
    else

Found 2024-04-18 by HttpPlugin

Create report

Open service 59.27.61.216:5000

2024-04-10 14:53

HTTP/1.0 200 OK
Content-type: text/html
Server: uc-httpd 1.0.0
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    <title>NETSurveillance WEB</title>
    <!-- m.js -->
    
    <script type="text/javascript" language="JavaScript">
	if(navigator.userAgent.indexOf('IE') < 0)
	{
		var userAgent = navigator.userAgent,   
                rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
                rFirefox = /(firefox)\/([\w.]+)/,   
                rOpera = /(opera).+version\/([\w.]+)/,   
                rChrome = /(chrome)\/([\w.]+)/,   
                rSafari = /version\/([\w.]+).*(safari)/;
		var browserMatch = uaMatch(userAgent.toLowerCase());
		 
		if(browserMatch.browser!="IE")
		{
		     location="Login.htm";
		}
		
	}
	
	function uaMatch(ua) {  
                    var match = rMsie.exec(ua);
		      
                    if (match != null) {  
                        return { browser : "IE", version : match[2] || "0" };  
                   }  
                    var match = rFirefox.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                    var match = rOpera.exec(ua);  
                    if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                   var match = rChrome.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                   }  
                    var match = rSafari.exec(ua);  
                    if (match != null) {  
                       return { browser : match[2] || "", version : match[1] || "0" };  
                    }  
                  if (match != null) {  
                        return { browser : "", version : "0" };  
                   }  
               }  
    </script>
    <script type="text/javascript" src="m.jsp"></script>
    <script type="text/javascript" src="config.js"></script>
    <script type="text/javascript" >
    var ipaddress =document.location.hostname;
	if(ipaddress == "")
	{
		ipaddress = "10.10.33.175";
	}
var hostport=5001;
var iLanguage=116;
	var DownLoadAddr="";
	var numLanguage;
	</script>


    <!-- 全局变量 -->

    <script type="text/javascript" type="text/javascript">
var gExitChannel=new Array();
var gExitSubType=new Array();
var gexiti;
var gcid=-1;
var g_channelNum=4;
var g_digitalChannel=0;
var gspeed;
var gsld;
var gslda;
var gsldb;
var gsldc;
var gsldd;
var gfmu1=0;
var gfmu2=0;
var gfmu3=0;
var g_bRecord=false;
var g_bRealPlay=false;
var g_bAudio=false;
var g_bQS=false;
var g_bClose=false;
var gHashCookie = new Hash.Cookie('NetSuveillanceWebCookie',{duration: 30});
var settings = {
	username:'',
	ocxlanguage:''
	}
var gca=0;
var gcb=0;
var gcc=0;
var gcd=0;
var gcs=0;

var gAutoPlayAll=false;
   

    </script>

    <!-- 颜色滑块 -->

    <script type="text/javascript" type="text/javascript">
function sldtopos(sld,step){
	sld.knob.setStyle('left', sld.toPosition(step));
	gcs=step;
}
function setcolorsv(f,v){
		switch (f)
		{

	        case 5: gcs=v;//5这个值是云台的速度值
					$('ScrollBar').title=v;
					break;

		}	
}



function getcolors(){
	var colors="";
	colors=ocx.GetColor();
	
	var t= new Array();
	if (colors !="")
	{
		t=colors.split(',');
		
    if(64==parseInt(t[0]))
    {
        OnColorBT(5,1);     
    }
    else
    {
        var ver=parseInt(t[0])/14;    
        OnColorBT(1,ver);         
    }
    
    if(64==parseInt(t[1]))
    {
        OnColorBT(5,2);     
    }
    else

Found 2024-04-10 by HttpPlugin

Create report

Open service 59.27.61.216:5000

2024-03-21 10:37

HTTP/1.0 200 OK
Content-type: text/html
Server: uc-httpd 1.0.0
Expires: 0

Page title: NETSurveillance WEB

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <link rel="stylesheet" type="text/css" media="screen" href="m.css" />
    <title>NETSurveillance WEB</title>
    <!-- m.js -->
    
    <script type="text/javascript" language="JavaScript">
	if(navigator.userAgent.indexOf('IE') < 0)
	{
		var userAgent = navigator.userAgent,   
                rMsie = /(msie\s|trident.*rv:)([\w.]+)/,   
                rFirefox = /(firefox)\/([\w.]+)/,   
                rOpera = /(opera).+version\/([\w.]+)/,   
                rChrome = /(chrome)\/([\w.]+)/,   
                rSafari = /version\/([\w.]+).*(safari)/;
		var browserMatch = uaMatch(userAgent.toLowerCase());
		 
		if(browserMatch.browser!="IE")
		{
		     location="Login.htm";
		}
		
	}
	
	function uaMatch(ua) {  
                    var match = rMsie.exec(ua);
		      
                    if (match != null) {  
                        return { browser : "IE", version : match[2] || "0" };  
                   }  
                    var match = rFirefox.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                    var match = rOpera.exec(ua);  
                    if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                    }  
                   var match = rChrome.exec(ua);  
                   if (match != null) {  
                       return { browser : match[1] || "", version : match[2] || "0" };  
                   }  
                    var match = rSafari.exec(ua);  
                    if (match != null) {  
                       return { browser : match[2] || "", version : match[1] || "0" };  
                    }  
                  if (match != null) {  
                        return { browser : "", version : "0" };  
                   }  
               }  
    </script>
    <script type="text/javascript" src="m.jsp"></script>
    <script type="text/javascript" src="config.js"></script>
    <script type="text/javascript" >
    var ipaddress =document.location.hostname;
	if(ipaddress == "")
	{
		ipaddress = "10.10.33.175";
	}
var hostport=5001;
var iLanguage=116;
	var DownLoadAddr="";
	var numLanguage;
	</script>


    <!-- 全局变量 -->

    <script type="text/javascript" type="text/javascript">
var gExitChannel=new Array();
var gExitSubType=new Array();
var gexiti;
var gcid=-1;
var g_channelNum=4;
var g_digitalChannel=0;
var gspeed;
var gsld;
var gslda;
var gsldb;
var gsldc;
var gsldd;
var gfmu1=0;
var gfmu2=0;
var gfmu3=0;
var g_bRecord=false;
var g_bRealPlay=false;
var g_bAudio=false;
var g_bQS=false;
var g_bClose=false;
var gHashCookie = new Hash.Cookie('NetSuveillanceWebCookie',{duration: 30});
var settings = {
	username:'',
	ocxlanguage:''
	}
var gca=0;
var gcb=0;
var gcc=0;
var gcd=0;
var gcs=0;

var gAutoPlayAll=false;
   

    </script>

    <!-- 颜色滑块 -->

    <script type="text/javascript" type="text/javascript">
function sldtopos(sld,step){
	sld.knob.setStyle('left', sld.toPosition(step));
	gcs=step;
}
function setcolorsv(f,v){
		switch (f)
		{

	        case 5: gcs=v;//5这个值是云台的速度值
					$('ScrollBar').title=v;
					break;

		}	
}



function getcolors(){
	var colors="";
	colors=ocx.GetColor();
	
	var t= new Array();
	if (colors !="")
	{
		t=colors.split(',');
		
    if(64==parseInt(t[0]))
    {
        OnColorBT(5,1);     
    }
    else
    {
        var ver=parseInt(t[0])/14;    
        OnColorBT(1,ver);         
    }
    
    if(64==parseInt(t[1]))
    {
        OnColorBT(5,2);     
    }
    else

Found 2024-03-21 by HttpPlugin

Create report

Domain summary

No record

Host 59.27.61.216

South Korea

Vulnerable HiSilicon family DVR

Create report

Create report

Create report

Domain summary