Stack overflow in Hikvision Search and Discovery feature

This repository contains a single Ruby Metasploit module, metasploit_sadp_exchange.rb, implementing an unauthenticated remote code execution exploit against Hikvision devices speaking the SADP protocol over UDP. Because it is a Metasploit module, the analysis is focused on that file only. The module is structured as a remote UDP exploit using Metasploit's Msf::Exploit::Remote::Udp mixin. Metadata identifies the target as Hikvision SADP RCE, platform linux, architecture ARM little-endian, with a default payload of linux/armle/shell_reverse_tcp. Default targeting uses UDP port 37020 and multicast address 239.255.255.250, which is consistent with SADP discovery behavior. Operationally, the exploit first sends a multicast SADP inquiry and collects device responses. It parses returned XML/device information and appears to filter candidate devices by firmware version using the VULN_FW option, defaulting to 4.83 and 4.72. The code includes two custom shellcode builders, one for each firmware family, which embed the operator's LHOST and LPORT directly into ARM shellcode and invoke /bin/sh for a reverse shell. A notable capability beyond simple delivery is memory disclosure. The module contains leak_libc_symbols and leak_address routines that craft a large base64-encoded payload inside an XML <Probe> message with <Types>exchangecode</Types>. This is sent over UDP to the SADP multicast target, and the response is parsed for leaked bytes from the <MAC> field. That indicates the exploit likely uses an information leak primitive to recover addresses needed for reliable exploitation across firmware variants. Overall, this is a real exploit module rather than a detector. It performs network discovery, target parsing, firmware selection, memory leakage, and payload delivery to obtain unauthenticated code execution with a reverse shell on vulnerable Hikvision devices.