neilphan98/hearth-dahua repository overview

⁠HEARTH Dahua Camera

Dahua-style IP camera speaking DHIP on 37777 (CVE-2021-33044/45 auth-bypass study).

Real-device analogue: A Dahua IP camera/NVR with the DHIP SDK/config service on TCP 37777.

Protocol / ports: Dahua DHIP (TCP 37777); the media/RTSP port is separate.

⁠What it does / how it works

Implements the DHIP challenge/response login and the exact CVE-2021-33044 (NetKeyboard) and CVE-2021-33045 (Loopback/Local) authentication-bypass conditions, plus the p2pwn backdoor-account plant. Grounds the 2026 Operation CameraSwarm campaign. The bypass condition is wire-exact per the public disclosure; the follow-on RPC shape is reconstructed (flagged, not vendor-confirmed).

⁠Functions

• DHIP login (MD5 challenge/response)
• CVE-2021-33044 / 33045 bypass paths
• Persistent backdoor-account plant
• MODE=camera (device) / MODE=viewer (benign NVR poll)

⁠How to use

Reachable on <ip>:37777. Study the normal login vs bypass shapes on the wire with tcpdump; benign viewer traffic uses the legitimate 2-step login so the shapes differ. Authorised study only.

⁠Use in GNS3

• Import the matching .gns3a (File > Import appliance), or docker pull neilphan98/hearth-dahua:1.1.
• Drag onto your topology, wire to a switch/hub, start. Console: telnet.
• Adapters: 1. Category: guest.

IPv4 device: leave MQQ1_IP empty to auto-assign a unique IP (zero-config), or set a fixed address. Zone via HEARTH_OCTET (5 corp / 6 ot / 8 security).

⁠Default environment (per node)

MQQ1_IP=192.168.8.22
MQQ1_PREFIX=24
MQQ1_GW=192.168.8.1
MODE=camera

Current release: 1.1 (docker pull neilphan98/hearth-dahua:1.1)

Part of the HEARTH Tower commercial-building IoT/OT security testbed. Image tags are immutable per release (1.0, 1.1, ...), so updating the device list never changes nodes you already placed. See the HEARTH bundle for all devices + guides.