From Firmware to RCE: Attacking Hikvision NVRs

From Firmware to RCE: Attacking Hikvision NVRs

Speakers: Angel Lozano Alcazar (Threat Intelligence and Malware Researcher); Pedro Guillen Nuñez (Principal Red Team, Constructora)

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=ZlftJt49O2I

Overview

In their Ekoparty Miami talk, "From Firmware to RCE: Attacking Hikvision NVRs," Angel Lozano Alcazar and Pedro Guillen Nuñez unveiled critical pre-authentication remote code execution (RCE) vulnerabilities in Hikvision Network Video Recorders (NVRs). Hikvision, a global leader in security camera and NVR manufacturing, boasts an immense market presence, with over 2 million devices discoverable online. These NVRs are deployed across a vast array of environments, including corporate offices, residential properties, critical infrastructure, and even sensitive government facilities like embassies and hospitals, making any compromise a significant security concern.

The motivation for this research stemmed from the sheer ubiquity of Hikvision devices and the potential impact of compromising NVRs, which serve as the central control points for entire camera systems. While previous research has often focused on individual cameras, Lozano and Nuñez strategically targeted the NVRs, recognizing that control over these devices inherently grants control over all connected cameras. Their deep dive into the Hikvision firmware ultimately uncovered two distinct stack overflow vulnerabilities within the unauthenticated Search Active Devices Protocol (SADP) service, paving the way for full system compromise.

The talk meticulously details the journey from firmware acquisition and decryption to sophisticated exploit development, including bypassing modern security mitigations like ASLR and DEP. The researchers not only demonstrated reliable RCE but also engineered a method for persistent access that circumvents the NVR's watchdog mechanisms. This presentation serves as a stark reminder of the pervasive risks associated with widely deployed embedded systems and the critical need for robust security practices from manufacturers and diligent patching from users.

Background

▶ Watch: Introduction and motivation to target Hikvision NVRs (0:00)

Hikvision's dominance in the global security market means their products are deeply embedded in the digital and physical infrastructure of countless organizations and homes. This widespread adoption, while a testament to their commercial success, also presents a massive attack surface for adversaries. The NVRs, in particular, are complex devices running embedded Linux kernels, exposing various protocols and services. The researchers identified several key interfaces, including a web server, proprietary APIs like ISAPI and SDK, cloud connectivity via Hik-Connect, and standard streaming protocols like ONVIF and RTSP. Their focus, however, narrowed to the SADP (Search Active Devices Protocol), an unauthenticated multicast UDP service primarily used for device discovery and initial configuration.

The existence of such a broad attack surface, especially one with unauthenticated services, creates inherent security risks. Previous research, such as presentations at earlier Ekoparty conferences that explored vulnerabilities in Ezviz cameras (a Hikvision subsidiary), highlighted the potential for compromise within this ecosystem. Lozano and Nuñez specifically chose NVRs over individual cameras, understanding that NVRs aggregate and manage video streams from multiple sources, making them a higher-value target. A compromise of an NVR could grant an attacker not just access to video feeds, but potentially control over the entire security system and the underlying operating system.

Understanding the NVR's boot sequence was also crucial for their analysis. The devices typically start with a bootloader, followed by an ARM kernel image. Subsequently, hardware drivers load, then various services, culminating in a restricted shell. The fact that even this shell is restricted indicates some level of security awareness from Hikvision, but as the research would prove, fundamental flaws in core services could easily bypass such perimeter defenses. The lack of authentication in SADP meant that any vulnerability found within this service could be exploited by an unprivileged attacker on the local network, bypassing several layers of intended security.

Key Findings

▶ Watch: Discovery of the first stack overflow vulnerability (8:30)

The core of this research lies in the discovery and exploitation of two critical stack overflow vulnerabilities within the SADP (Search Active Devices Protocol) service of Hikvision NVRs. These flaws, identified in the processing of exchange code and activate packets, allowed for pre-authentication Remote Code Execution (RCE). This means an attacker could execute arbitrary code on vulnerable NVRs without needing any prior credentials or authentication, simply by sending specially crafted SADP packets to the device on the local network.

To achieve reliable RCE, the researchers had to overcome several modern security mitigations. They successfully developed an information leak technique to bypass ASLR (Address Space Layout Randomization) by extracting sensitive memory addresses. Furthermore, they crafted a sophisticated ROP (Return-Oriented Programming) chain to bypass DEP (Data Execution Prevention), allowing their injected shellcode to execute. Crucially, while stack canaries were present in the NVR's overall binaries, the specific vulnerable functions within the SADP parser on the targeted firmware versions (4.x) did not utilize them, simplifying the exploit development for these particular flaws.

The impact of these findings is profound. The vulnerabilities affect potentially millions of Hikvision devices globally, many of which are deployed in critical and sensitive environments. The successful exploitation grants root shell access to the NVR, giving attackers complete control over the device and its connected cameras. Beyond initial compromise, the researchers also developed a method for persistence, ensuring that their access would survive reboots and evade the device's watchdog mechanisms, making detection and remediation significantly more challenging for defenders. The disclosure highlights a fundamental security weakness in a widely used, unauthenticated protocol.

Technical Deep Dive

▶ Watch: Exploit development: bypassing ASLR, DEP, and stack canaries (18:00)

The technical journey began with firmware acquisition and analysis. The researchers first obtained the NVR firmware directly from the Hikvision website. Initial analysis with Binwalk, a tool for analyzing firmware images, quickly revealed that the firmware was encrypted. However, a closer look at the decrypted portions of the firmware, specifically within the driver files, exposed hardcoded encryption keys. Recognizing that others might have faced similar challenges, they wisely sought existing tools and discovered Hikpack, a public utility primarily used by integrators to customize firmware (e.g., changing logos). This tool proved invaluable for decrypting the firmware, saving significant reverse engineering effort.

With the firmware decrypted, the next step was to understand the SADP service. Static analysis of the firmware binaries was combined with dynamic observation. The researchers leveraged Hikvision’s own SADP Tool, a legitimate utility for managing NVRs, in conjunction with a network sniffer like Wireshark. Since SADP traffic is unencrypted, this allowed them to capture and analyze the structure of SADP packets, confirming it operates over multicast UDP and uses XML for data transmission. This provided critical insights into how devices communicate and how packets are formed.

Identifying the relevant binaries was done efficiently using grep to search for XML tag patterns observed in the SADP traffic. This led them to SC-Hikcore in version 4 firmware and Lib Six Maintenance in version 5. Using IDA Pro for static analysis, they located the main SADP parser function. Within this function, multicast_get_pack_type identifies the type of incoming SADP packet. A subsequent switch statement then dispatches processing to specific functions, such as proc_exchange_info for exchange_code packets (case 5) and proc_activate_info for activate packets (case 6).

The crucial vulnerability discovery occurred within these packet processing functions. Both proc_exchange_info and proc_activate_info were found to call a common helper function, base64_decode. This function takes three arguments: an input buffer (derived from XML tags like task code or password), the length of this input buffer, and a fixed-size output buffer on the stack. The critical flaw was the complete absence of length validation for the input buffer before or within base64_decode. An attacker could supply an excessively long base64-encoded string, causing base64_decode to write past the end of its fixed-size stack buffer, resulting in a stack overflow.

Developing a reliable exploit required an emulation environment. The researchers used QEMU with an ARM kernel to simulate the NVR. Reconstructing the exact file system paths from the decrypted start.sh script (also decrypted using Hikpack) was essential. During emulation, they encountered common issues like missing hardware sensors and libraries. Their solution involved creating dummy drivers to intercept ioctl calls and return expected values, and dummy libraries with hooks to provide necessary functions. For rapid prototyping and validation, Frida was used to dynamically patch the code and confirm crashes.

A significant challenge was the diversity of Hikvision NVR versions and architectures. The latest 5.x firmware utilized an Android-like infrastructure with binder, and required expensive hardware. The researchers opted for more affordable 4.x NVRs, specifically versions 4.7.2 and 4.8.3, which, while still having security mitigations, presented a more accessible target. Debugging on physical hardware was done through UART serial consoles, allowing them to observe program counter (PC) traces during crashes and achieve blind exploitation without full debugger attachment.

The exploit development addressed several security mitigations:

• ASLR Bypass (Information Leak): While ASLR randomized the heap, stack, and libc base address, the NVR's main binary in v4 was not compiled as PIE (Position Independent Executable), meaning its base address was fixed. To bypass ASLR for libc, they exploited the proc_exchange_info function. Specifically, within make_exchange_red_XML (which constructs the XML response), the util_xat_elem function is used to insert data into XML tags. By overflowing a buffer, they could overwrite a pointer (referred to as a4) that typically points to the device's MAC address, redirecting it to the Global Offset Table (GOT) entry for the system function within libc. When the NVR responded, the MAC address field in the XML contained the actual memory address of system(), thus leaking a libc address.
• DEP Bypass (ROP Chain): With the system() address leaked, the base address of libc could be calculated. From this, the address of mprotect (a function to change memory page permissions) was determined. A ROP chain was then constructed. This chain leveraged existing instructions (gadgets) within the NVR's memory to call mprotect, making the stack executable. Once the stack was executable, the injected shellcode could then run.
• Stack Canaries: Fortunately for the attackers, the specific base64_decode calls within the SADP parser functions on the targeted v4 firmware versions did not have stack canaries enabled. This meant no canary bypass was required for these particular overflows. The researchers noted that 5.x versions did implement stack canaries in these functions, but a similar information leak could potentially be used to bypass them as well.

A crucial aspect for a robust and stealthy exploit was continuity of execution. Embedded systems often employ watchdog timers that reboot the device if a critical service crashes. To prevent the NVR from rebooting after the shellcode executed, the ROP chain was designed to return to a known, safe instruction address within the SADP parser function. This ensured the service continued running normally, preventing the watchdog from triggering a reboot and allowing for repeated exploitation without detection by monitoring systems.

Demo / Proof of Concept

▶ Watch: Metasploit RCE exploit demonstration with service continuity (28:00)

The talk featured two compelling demonstrations showcasing the exploit's capabilities. The primary demonstration involved a Metasploit module developed by the researchers, highlighting the full chain RCE against a vulnerable Hikvision NVR.

The Metasploit module operated in a multi-stage fashion:

1. Device Identification: The module first sent an inquiry SADP packet. The vulnerable NVR responded with its MAC address and firmware version. This information was critical: the MAC address was needed for subsequent packets (as the multicast SADP service filters packets based on MAC), and the firmware version dictated the specific memory offsets required for the exploit's ROP chain.
2. Information Leak: Once the device was identified, the module sent a specially crafted exchange_code packet designed to trigger the information leak. As detailed in the technical deep dive, this manipulated a pointer to leak the memory address of the system() function from libc in the NVR's XML response (specifically, within the MAC address tag).
3. Code Execution: With the system() address, the module calculated the libc base address and the address of mprotect. It then sent another crafted SADP packet (e.g., an activate packet) containing the full ROP chain and the shellcode. This chain called mprotect to make the stack executable, then transferred execution to the shellcode.

The demo successfully obtained a root shell on the target NVR. A key highlight was the demonstration of continuity of execution: after obtaining the initial shell and exiting the session, the researchers immediately re-launched the exploit, and it successfully returned another root shell. This proved that the service had not crashed and the NVR's watchdog had not rebooted the device, underscoring the stealth and reliability of the exploit.

The second demonstration focused on persistence on a physical NVR device connected via UART. After gaining initial access, the researchers showed how to modify the NVR's startup scripts, specifically by leveraging the source dev zero boot_args command found in start.sh. Through this mechanism, they injected commands to:

• Kill the restricted shell, gaining a full root shell.
• Start the SSH service for remote access.
• "Feed" the watchdog process to prevent it from detecting service issues and rebooting the device.

The demo then concluded by showcasing a successful SSH connection to the NVR, confirming persistent root access. This illustrated not just the ability to compromise, but to maintain control over the device. The Metasploit module and associated code were announced to be released publicly on GitHub, allowing other security professionals to analyze and utilize the findings responsibly.

Defensive Implications

▶ Watch: Responsible disclosure, patch analysis, and key conclusions (35:00)

The findings presented by Lozano and Nuñez carry significant defensive implications for organizations and individuals utilizing Hikvision NVRs, given their widespread deployment and the critical nature of the compromised systems.

Foremost, firmware patching is paramount. Hikvision acknowledged the vulnerabilities, assigned a CVE (though the specific number was not mentioned in the talk), and released patches. It is crucial for all users to update their NVR firmware immediately to the latest patched versions. However, the researchers noted that Hikvision's patch specifically addressed the length validation in proc_chain_info and activate functions, rather than a generalized fix for the base64_decode function itself. This targeted approach means other code paths calling base64_decode might still be susceptible if similar length validation is missing. Defenders should remain vigilant and apply all available security updates. It's also important to acknowledge that many older Hikvision devices may no longer receive security updates or might not be compatible with newer firmware versions, leaving them permanently vulnerable.

Network segmentation is another critical defensive measure. The SADP protocol operates over multicast UDP and is inherently unauthenticated. This means any attacker on the same local network segment as the NVR can potentially exploit these vulnerabilities. Isolating NVRs on dedicated VLANs or network segments, separate from user networks and other critical systems, can significantly reduce the attack surface. Implementing strict firewall rules to limit SADP traffic to only necessary administrative interfaces or specific IP addresses, rather than allowing broad multicast access, is highly recommended. Disabling SADP if it's not strictly required for ongoing operations should also be considered, though it might impact device discovery and configuration.

Monitoring for unusual activity on NVRs and network traffic is also essential. While the exploit is designed for stealth and avoids crashing the service, unusual SADP packets (e.g., repeated inquiry requests from an unfamiliar source, or malformed SADP packets) could indicate attempted exploitation. Organizations should implement network intrusion detection systems (NIDS) to flag such anomalies. Furthermore, monitoring NVR logs for unexpected SSH connections, process anomalies (like the watchdog being fed excessively), or unauthorized configuration changes could help detect post-exploitation activities.

Finally, the research highlights a broader concern regarding the security posture of embedded devices and the importance of secure development lifecycle (SDL) practices. Manufacturers must prioritize robust input validation, secure memory handling, and comprehensive security testing. For consumers and businesses, this underscores the need for a critical evaluation of IoT and embedded device vendors, prioritizing those with a strong commitment to security and transparent patching processes. Relying on default configurations or assuming device security based solely on physical access controls is insufficient.

Key Takeaways

• Firmware Decryption is Feasible: Hikvision NVR firmware can be easily decrypted using publicly available tools like Hikpack or by extracting hardcoded keys from unencrypted driver components, exposing the internal software to analysis.
• Emulation for Embedded Systems: QEMU, combined with techniques like creating dummy drivers and libraries, provides a viable (though challenging) environment for emulating embedded ARM-based systems, enabling pre-hardware vulnerability analysis.
• Unauthenticated Multicast Protocol Risk: The SADP protocol's unauthenticated and multicast nature makes it a high-risk attack surface, allowing any attacker on the local network to interact with and potentially exploit vulnerable NVRs.
• Pre-Authentication RCE on Millions of Devices: Two stack overflow vulnerabilities were discovered in SADP's packet processing, leading to pre-authentication RCE on potentially millions of Hikvision NVRs globally, granting root access.
• Sophisticated Exploit Chain: Achieving reliable RCE required bypassing ASLR (via an information leak of system() address), DEP (via a ROP chain calling mprotect), and implementing continuity of execution to prevent watchdog reboots.
• Responsible Disclosure is Essential: The researchers adhered to responsible disclosure practices, reporting the vulnerabilities to Hikvision, which subsequently issued patches, demonstrating the importance of collaboration between researchers and vendors.

About the Speaker(s)

Angel Lozano Alcazar is a Threat Intelligence and Malware Researcher. His work focuses on understanding and analyzing malicious software and emerging threats.

Pedro Guillen Nuñez serves as a Principal Red Team member at a constructora (construction company). His role involves simulating cyberattacks to test and improve an organization's security posture.

Both speakers share a strong passion for uncovering security flaws in various devices, with a particular interest in hardware hacking and reverse engineering. Their collaborative efforts in this research exemplify their commitment to identifying and addressing vulnerabilities in widely deployed systems, often working as independent researchers driven by curiosity and a desire to enhance cybersecurity.