p2pwn is a multithreaded Go security scanner that reaches Dahua cameras over their cloud-based P2P relay and checks them for known CVEs and weak credentials during authorized assessments.
| Tool | thebadinteger/p2pwn — multithreaded Dahua camera security scanner operating over the vendor's P2P mechanism |
| Category | IP camera / IoT security auditing in Go |
| Primary Use | Auditing fleets of Dahua cameras you own for CVE-2021-33044, CVE-2021-33045, unauthenticated-add-user flaws, and weak credentials via CGI and SDK protocols |
| Safe Use | Authorized penetration tests, internal camera-fleet audits, and lab-based defensive research against devices you own or have written permission to test; the [nuke] options must never be used outside controlled environments |
| Telemetry Note | Generates connection bursts toward the Dahua P2P relay (capped by maxrps), adds a named dummy account (p2pwn), optionally writes an OSD overlay, and can set disable P2P — all observable signals for defenders inventorying device changes |
p2pwn is a Go-based security scanner written by thebadinteger, distributed under GPL-3.0, that targets one of the most persistent blind spots in enterprise security: Dahua IP cameras reachable through the vendor's cloud-assisted peer-to-peer mechanism. Rather than scanning IP ranges the traditional way, the tool works from device serial numbers or serial prefixes, resolving targets through the same P2P infrastructure that remote-management apps and mobile clients use. That is a meaningful architectural choice, because devices sitting behind NAT with no exposed ports can still be reached for an audit, mirroring how attackers have historically abused P2P relays against consumer and SOHO cameras. The repository currently sits at a modest 58 stars, tagged with topics like dahua, ip-camera, cctv, cve-2021-33044, and cve-2021-33045, which tells you the author is deliberately signaling the two authentication-bypass CVEs at the core of the tool's detection logic.
The feature list is dense for a single-binary tool. p2pwn is multithreaded, supports both the web CGI protocol and the proprietary SDK protocol on port 37777, and distinguishes between Type 0 and Type 1 device generations — an important detail because older Type 1 firmware speaks a different dialect and requires different handling, including a deliberate 20-second delay between brute attempts configured via type1.delay. Detection coverage includes the two 2021 Dahua authentication bypasses plus an unauthenticated addUser path the author labels uau, alongside a credential brute-force module driven by a configurable list or wordlist file. All of this is documented in a README that is unusually candid about what each method actually does.
Internally, the configuration file config.toml is where the architecture becomes visible. The [scan] section controls timing and scale: timeout in milliseconds, retries, a generate option that can expand a 10-character serial prefix into up to 1,048,576 candidate serial numbers, and two throttling mechanisms — a worker pool the author calls nurses (default 200) for online/offline checks, and a governor with a maxrps cap (default 3000) on concurrent checks. The naming is idiosyncratic, but the design intent is clear: the tool can generate enormous serial-number spaces and needs rate shaping to keep the P2P relay interaction within practical bounds. For defenders, that governor is also a hint about how the traffic profile looks from the network side.
The [pwn] section acts as a per-method toggle panel, and the README's tips clarify the capability matrix: protocol.cgi can perform both CVE checks and brute force, while protocol.sdk and protocol.type1 are brute-only paths, with the author noting that disabling protocol.sdk speeds up scans when NVRs are not in scope. Each CVE method (methods.cve-2021-33044, methods.cve-2021-33045) extracts administrator credentials and, as a fallback marker, provisions a dummy account — a detail that doubles as a defensive indicator, since the account name and password are themselves configurable in the [dummy] section with constraints (5–32 alphanumeric characters for the login, 8–32 for the password).
Evidence collection is well thought out. The tool writes a pwned.csv with columns sn,model,login,password,channels,ip,vuln, captures snapshots into a snapshots/ directory using a {serial}_{login}_{password}_{model}_{channel(s)}.jpg naming scheme, and can pull those images via CGI, SDK, or RTSP depending on toggles in the [image] section. Crucially for blue teams, snapshot capture is proof-of-impact in an assessment report — but it is also the single most sensitive output the tool produces, and anyone running authorized audits should treat the output directory as containing confidential evidence. The tool also generates import_*.xml files in DeviceManager format for Dahua's own management software, capped at 64 devices per file, which makes it straightforward to import verified findings back into vendor tooling for remediation tracking.
Installation follows standard Go conventions and stays minimal: go install github.com/thebadinteger/p2pwn@main for the toolchain route, or the usual git clone followed by go build from source, with prebuilt binaries offered on the Releases page. The README specifies Go 1.26+ and cross-platform support for Windows, Linux, and macOS. Invocation is a single command shape — ./p2pwn -i [input] -o [output] -t [threads] with optional -c for a custom config, --debug for verbose logging, and --nuke to arm destructive options. Input can be a bare 10-character prefix, a full serial, a comma-separated mix, or existing inventory exports in csv, xml, dhscp, or folder formats, which makes the tool fit naturally into an audit that starts from an existing asset list rather than discovery.
The parts that demand the most caution are the [nuke] and [overlay] sections. The overlay feature can rewrite the on-screen-display text on validated devices — channel title plus up to five custom lines — effectively stamping 'device is vulnerable' onto the video feed, a classic wake-up call for organizations that ignore written findings. The [nuke] section, explicitly gated behind the --nuke flag and flagged as experimental with a 'DO NOT USE' warning from the author himself, contains genuinely destructive options: deleting all device accounts except admin and the dummy, forcing all video-quality settings to a single number, applying box masks over regions of the image, and disabling P2P on the device entirely. In an authorized assessment against your own fleet, disabling P2P post-validation can be a legitimate hardening action; against anything else it is sabotage. The flag gating and the author's warning are the right design, but they also make clear this is a tool for operators who understand the blast radius.
From a defensive research perspective, p2pwn is best read as a systematization of what has already been documented about Dahua's P2P ecosystem. CVE-2021-33044 and CVE-2021-33045 are login-bypass flaws in Dahua's authentication flow that were fixed by the vendor years ago, yet fleets of unpatched cameras persist, and the tool's serial-prefix generation exploits the fact that serial numbers carry structure and are enumerable. The uau method — an unauthenticated addUser — rounds out the picture. For asset owners, the defensive countermeasures follow directly: patch firmware, rotate default credentials like the ones in the default credentials list (admin/admin, admin/admin123, and the well-known 666666 and 888888 pairs), audit device account lists for unexpected entries, and decide deliberately whether P2P cloud relay should be enabled at all on surveillance equipment.
The README closes with a disclaimer stating the software is intended for educational and authorized testing purposes only, with the author disclaiming responsibility for misuse — standard language, but here backed by observable design choices like the dummy-account approach rather than silent persistence, the --nuke gate, and detailed configuration transparency. The project credits contributors in a THANKS.md file, which suggests a small but real community around it.
For the intended audience — consultants auditing camera deployments, SOC teams inventorying their own CCTV estates, and IoT researchers studying P2P relay abuse — p2pwn is a technically interesting specimen: a single static binary that turns vendor cloud infrastructure into an audit surface, with evidence collection, import tooling, and rate governance built in. It should only ever be pointed at serial numbers you own or are contractually authorized to test, its pwned.csv and snapshot outputs should be handled as sensitive assessment evidence, and the destructive options should remain untouched outside a lab. Within those boundaries, it is a capable example of modern IoT audit tooling with a thoughtful, if bluntly named, design.
thebadinteger/p2pwn.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.