以下学习整理自渗透安全-HackTwo
一、车联网攻击面分析
信息搜集

攻击入口概述 车联网存在多种攻击点,如GPS、T-Box(路由器、云端)、IVI(车载娱乐系统)、蓝牙、Wi-Fi、OBD、ADAS(辅助驾驶)等。

典型攻击场景
- 利用格式化字符串漏洞进行远程代码执行。
- 通过ADB调试模式获取车机root权限。
- T-Box暴露公网导致远程攻击。
- 充电桩PLC通信协议存在安全隐患。

这是大致的架构、可攻击点(功能越多、攻击点越多)
ICSE 2026发布的大规模实证研究分析了649个真实漏洞,揭示了车联网攻击面的真实分布:
攻击面分布:- 远程信息处理/T-Box:31%- 车载信息娱乐系统:28%- 诊断接口/OBD-II:15% - V2X通信模块:12%- 传感器/ADAS:8%- 充电系统:6%
操作系统(嵌入式操作电脑):安卓、DBA系的KingBase(和linux差不多)
最先尝试:蓝牙、WIFI(演示奥迪上的格式化字符串漏洞:CVE-2020-27524)

安卓车机进入开发者模式,通过adb shell拿到root权限
攻击面–TBOX
Desoldering the EMMC Chip
Dumping the firmware from Chip
Analyzing and extract the Private Key
Pwn2Own 2026特斯拉IVI攻破
- 漏洞1:信息泄露:通过特制USB设备,触发系统信息泄露漏洞,获取内存布局关键信息
- 漏洞2:越界写入:利用第二个漏洞实现越界写入,覆盖关键内存区域
- 权限提升:串联两个漏洞,成功获取系统root权限
- 代码执行:在root权限下执行任意代码,完全控制信息娱乐系统
攻击面–充电桩

中国一般走CAN,供给面也很多(介绍一个:CVE-2021-34602,远程RCE)
充电桩类型与通信协议 分为交流/直流充电桩,国标使用CAN协议,欧标使用PLC+TCP/IP。
施耐德充电桩漏洞分析
- 硬编码后门账户(iter/open)。
- 登录Token硬编码绕过身份验证。
- 固件升级机制被利用实现远程RCE。
危害分析 可用于僵尸网络、横向渗透、电压控制破坏设备,甚至作为跳板攻击车辆本身,还有免费充电、窃取用户支付信息、向车辆传输恶意数据、控制充电过程(过充等安全风险)等等。
CAN注入攻击链:
- 攻击者通过T-Box远程漏洞获得车内网络访问权限
- 逆向分析CAN报文,识别关键指令(如刹车、油门、转向)
- 构造伪造的制动指令报文,以高优先级发送到CAN总线
- ECU接收并执行伪造指令,车辆在高速行驶中意外刹车
攻击面–传感器
主要在自动驾驶里面
投影、人脸图片(人脸识别欺骗)、广告牌、指纹欺骗等等
攻击面-Keyfob
硬件上推荐支持RTL-SDR的电视棒,带有PortaPack模块的HackRF、RF干扰
无线钥匙与中继攻击
钥匙类型与通信机制 包括OOK/FSK调制方式、PTRVM/曼彻斯特编码等。
攻击方法演示
干扰攻击:阻止车辆接收锁车信号。
回放攻击:捕获并重放固定码信号。
滚动码破解:利用频段漂移实现“肉酱攻击”。
Hella系的汽车钥采用0OK调制模式,Manchester编码

中继攻击原理与实战演示
- 中继攻击即中间人攻击,放大信号绕过距离限制。
- 成功模拟对特斯拉NFC钥匙的中继攻击。
数字钥匙与认证机制
- 数字钥匙发展历史 从机械钥匙 → 远控钥匙 → RFID防盗 → NFC/蓝牙数字钥匙演变。
- 后装数字钥匙漏洞分析
- 安米智能钥匙存在逻辑缺陷:删除共享钥匙后仍可连接控制车辆。
- 云端使用HTTP明文传输敏感信息,如IMEI码。
特斯拉NFC钥匙分析
NFC协议结构与加密机制 支持ISO14443 Type A协议,采用Java卡架构和椭圆曲线加密。
APDU指令交互流程 包括选择AID、公钥交换、挑战响应验证等步骤。
中继攻击绕过时间限制 绕过选择AID阶段,节省响应时间以完成中继攻击。
二、车联网靶场实战
1、工具搭建
项目地址:(内置数百种车联网安全专用测试工具,安恒开发,有点像helloctf的那种虚拟机)
https://github.com/TianWen-Lab/TranSec
OVA 直接导入虚拟机wmware就行,账号密码:iov/root

2、靶场搭建
这里用的是OWASP的官方靶场
curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/develop/deploy/docker/docker-compose.yml
VERSION=develop docker-compose pull
VERSION=develop docker-compose -f docker-compose.yml --compatibility up -d
能pull起来,显示状态healthy就行

下面就是根据官方文档一步步测试
先注册一个邮箱为test@test.com 密码为123qweASD@的用户

然后去看自己的车辆信息,在8025端口


能看到自己的车辆了,无痛free拥有一辆奥迪好叭,里面一共是10个漏洞,复现一下
challenge1:找到泄露其它用户敏感信息的API接口
很明显其他用户在community菜单,刷新一下抓个包
/community/api/v2/community/posts/recent?limit=30&offset=0
此接口会泄露出敏感信息

challenge2:访问其它用户车辆的详细信息
刚刚记录下的车辆信息
"author": {
"nickname": "Adam",
"email": "adam007@example.com",
"vehicleid": "f89b5f21-7829-45cb-a650-299a61090378",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.643Z"
},
"comments": [],
"authorid": 1,
"CreatedAt": "2026-09-15T06:52:49.643Z"
},
{
"id": "WoMeuPyjjRN2xX3taxXB3G",
"title": "Fuel Economy Tips",
"content": "Gas prices are absolutely crazy right now and I\u0026#39;m looking to save wherever I can. What driving habits help you maximize your miles per gallon? I\u0026#39;ve heard keeping tires properly inflated and avoiding aggressive acceleration helps. Also thinking about using cruise control more on the highway. Any other tips you\u0026#39;ve found effective?",
"author": {
"nickname": "Robot",
"email": "robot001@example.com",
"vehicleid": "4bae9968-ec7f-4de3-a3a0-ba1b2ab5e5e5",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.641Z"
},
"comments": [],
"authorid": 3,
"CreatedAt": "2026-09-15T06:52:49.641Z"
},
{
"id": "W8Ca2mba2CqRC6UZqg9zy",
"title": "Car Audio Upgrades",
"content": "Looking to upgrade my factory sound system because the bass is practically nonexistent. Any recommendations for speakers and subwoofers that won\u0026#39;t break the bank? I\u0026#39;m thinking a 10-inch sub in the trunk and maybe some component speakers up front. Should I also upgrade the head unit or will an amp be enough to power everything?",
"author": {
"nickname": "Pogba",
"email": "pogba006@example.com",
"vehicleid": "cd515c12-0fc1-48ae-8b61-9230b70a845b",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.64Z"
},
"comments": [],
"authorid": 2,
"CreatedAt": "2026-09-15T06:52:49.64Z"
},
{
"id": "2vMoVkmYEohzcANM3qUVpX",
"title": "Winter Tire Discussion",
"content": "Winter is coming and I need to prepare my car for the snow. Should I invest in dedicated winter tires or are all-seasons good enough for moderate snowfall? I live in an area that gets maybe 10-15 snow days per year. The cost of a second set of tires plus storage seems high but safety is important. What are your thoughts?",
"author": {
"nickname": "Adam",
"email": "adam007@example.com",
"vehicleid": "f89b5f21-7829-45cb-a650-299a61090378",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.64Z"
},
"comments": [],
"authorid": 1,
"CreatedAt": "2026-09-15T06:52:49.64Z"
},
{
"id": "UZdEdK5FkzMSVa7XBSTTo3",
"title": "Car Insurance Advice",
"content": "Just got quoted for my new vehicle and the prices are all over the place. Any tips on getting the best rates for comprehensive coverage? I\u0026#39;ve been with the same company for 10 years but they\u0026#39;re not offering any loyalty discounts. Should I bundle with home insurance? What deductible amount do you guys usually go with?",
"author": {
"nickname": "Robot",
"email": "robot001@example.com",
"vehicleid": "4bae9968-ec7f-4de3-a3a0-ba1b2ab5e5e5",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.639Z"
},
"comments": [],
"authorid": 3,
"CreatedAt": "2026-09-15T06:52:49.639Z"
},
{
"id": "YSPFozL3sGGZdLqXVnWEn5",
"title": "Road Trip Essentials",
"content": "Planning a cross-country drive next month from coast to coast. What car accessories do you always bring on long trips? So far I have a phone mount, portable tire inflator, and emergency kit. Looking for recommendations on comfortable seat cushions for those 8+ hour driving days. Also need a good cooler that fits in the backseat.",
"author": {
"nickname": "Pogba",
"email": "pogba006@example.com",
"vehicleid": "cd515c12-0fc1-48ae-8b61-9230b70a845b",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.637Z"
},
"comments": [],
"authorid": 2,
"CreatedAt": "2026-09-15T06:52:49.637Z"
},
{
"id": "ko5YGhQGYsLBbZAywyP4gB",
"title": "Electric vs Gas Cars",
"content": "Thinking about switching to electric for my next vehicle purchase. What are your experiences with EV charging infrastructure? I commute about 50 miles daily and there are a few charging stations near my office. The initial cost is higher but the fuel savings seem significant. Anyone made the switch recently? How\u0026#39;s the range anxiety treating you?",
"author": {
"nickname": "Adam",
"email": "adam007@example.com",
"vehicleid": "f89b5f21-7829-45cb-a650-299a61090378",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.636Z"
},
"comments": [],
"authorid": 1,
"CreatedAt": "2026-09-15T06:52:49.636Z"
},
{
"id": "Z7qZNUq9SaBL7Fsd8f6wuD",
"title": "Car Wash Recommendations",
"content": "Looking for the best car wash in town. Anyone have suggestions for a good detailing service? I\u0026#39;ve been going to the automatic wash but my paint is starting to show swirl marks. Thinking about trying a hand wash place or maybe doing it myself. What products do you guys use for a proper detail at home?",
"author": {
"nickname": "Robot",
"email": "robot001@example.com",
"vehicleid": "4bae9968-ec7f-4de3-a3a0-ba1b2ab5e5e5",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.635Z"
},
"comments": [],
"authorid": 3,
"CreatedAt": "2026-09-15T06:52:49.635Z"
},
{
"id": "cyZ24vDESRQCHepCL4CudM",
"title": "My New Car Experience",
"content": "Just picked up my new ride last week and I couldn\u0026#39;t be happier! The fuel efficiency is amazing - I\u0026#39;m getting around 35 MPG on the highway. The interior is so comfortable with heated leather seats and a panoramic sunroof. The infotainment system connects seamlessly with my phone. Highly recommend test driving one if you\u0026#39;re in the market.",
"author": {
"nickname": "Pogba",
"email": "pogba006@example.com",
"vehicleid": "cd515c12-0fc1-48ae-8b61-9230b70a845b",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.634Z"
},
"comments": [],
"authorid": 2,
"CreatedAt": "2026-09-15T06:52:49.634Z"
},
{
"id": "mq5gi4krKyG4kphryuaWcG",
"title": "Best Car Maintenance Tips",
"content": "Regular oil changes and tire rotations are essential for keeping your car running smoothly. I recommend changing your oil every 5,000 miles and rotating tires every 7,500 miles. Also, don\u0026#39;t forget to check your brake pads and fluid levels monthly. A well-maintained car can last over 200,000 miles if you take care of it properly.",
"author": {
"nickname": "Adam",
"email": "adam007@example.com",
"vehicleid": "f89b5f21-7829-45cb-a650-299a61090378",
"profile_pic_url": "",
"created_at": "2026-09-15T06:52:49.602Z"
},
"comments": [],
"authorid": 1,
"CreatedAt": "2026-09-15T06:52:49.602Z"
}
想具体去看详细信息,自己车辆的详细信息位置抓包,看看有什么,给我整美国来了哈哈哈

主要是这个

能看到carid,用别的车的信息再重新发个包
但是不知道能不能看到别的车辆的定位信息,因为只能载google里面有内接定位
challenge3:找到泄露视频内部属性的API接口

这里能看到有个视频文件上传的接口

可以改名字

conversion_params(转换参数):
- 值为
"-v -codec h264"。 - 这是极其关键的内部信息。它揭示了后端服务器(可能是基于 FFmpeg 等工具)在对该视频进行转码时使用的具体命令行参数。
-v通常指代视频处理,-codec h264表明服务器将其转码为了 H.264 编码格式。
这段响应体中还包含了 id: 6。这个 ID 通常对应数据库中的自增主键。如果 API 没有严格的权限验证(例如水平越权漏洞),攻击者可以通过修改 URL 或请求参数中的 ID(比如改成 1、2、3…),尝试获取其他用户的视频信息。
challenge4:访问其它用户的机械报告
也是比较典型的越权,机械报告,那就是考虑联系维修师傅

随便填了点儿东西提交了一下

可以看到:
http://127.0.0.1:8888/workshop/api/mechanic/mechanic_report?report_id=6
可以通过修改report_id来查看其他用户的报告

直接访问不行,要jwt的

challenge5:重置其它用户的密码
登录页面有一个忘记密码的功能


通过前面信息搜集,可以获取所有用户的邮箱:
adam007@example.com
robot001@example.com
pogba006@example.com


这个OTP 是一次性密码,发送到对应邮箱,其实就是邮箱验证码。
只要得到了OTP就能重置密码
抓包试试:
tips(在抓包Robot用户邮箱的OTP信息之前,可以先登录自己的邮箱,看看返回的OTP是什么样子的,格式如何,方便后续爆破!这里发现OTP是4位数字)


发现爆破是有次数限制的,有V2版本,V3版本
限制次数提交的版本是V3版本,那么有没有可能V2版本就没有限制提交呢?且V2的版本还在呢?没有下线? 试一试:


然后就可以尝试爆破了

然后就可以去修改用户密码了
感觉这个靶场更偏向web一点,后面就没做了,重新找别的靶场玩了


说些什么吧!