Welcome back, cyberwarriors!

A few weeks ago we published PwnEye, which is a great tool for camera hacking. We talked about the importance of keeping your IoT devices patched to prevent unauthorized access. A less hardened device is a lot more appealing to a hacker, especially when it sits on the same network as other infrastructure.

Cheap devices aren’t really built with security in mind and some of them come with backdoors that sooner or later get discovered and abused by anyone who finds them online.

Today let’s look at a tool that can identify cameras, test credentials and help you harden them.

Eyesharvester

Eyesharvester is a recon tool for IP cameras, DVRs and NVRs. You give it an IP range, it scans common ports, fingerprints the vendor and optionally tries default credentials. It can also show known CVEs associated with a brand and give you basic hardening advice. The tool is mainly for identification and reporting.

Setting Up

Let’s quickly download the repository and install the tool. No dependencies needed to get started.

kali > git clone https://github.com/Exhunterx/eyesharvester.git
kali > cd eyesharvester
kali > bash install.sh

The help menu covers everything the tool can do.

kali > eyesharvester --help

Now let’s look at the ways you can use it.

Testing Cameras

You don’t always get the camera IP ranges from admins, so recon comes first. We need to figure out which IPs belong to cameras.

kali > eyesharvester IP/24

A few cameras were found. Now let’s pipe all those IPs to a text file. The flag below will silence the noise. 

kali >  eyesharvester IP/24 -q  > cameras.txt
kali > cat cameras.txt

You can keep these IPs for future tests, say with PwnEye for example. Or maybe you want to update the spreadsheet of your surveillance infrastructure, as admins often do, though there are better ways to keep a record of everything.

We can also run confirmation checks to make sure these are actually cameras.

kali > eyesharvester IP/24 -c confirmed -v

There’s a confirmed Hikvision camera above. We’ll test it and the rest of those we found for default credentials.

kali > eyesharvester IP/24 --check-creds

Finding a camera with default credentials internally is very common.

Hardening Cameras

Testing cameras is fun, but hardening them is a bigger question that needs to be addressed. Both pentesters and defenders should know how to do it and your report should include recommendations on how to harden these devices.

kali > eyesharvester IP --harden

Based on the vendor and open ports, a hardening checklist is generated along with the CVEs that affect your device. This mainly covers segmenting devices away from business and IT networks, disabling unused services, replacing weak credentials and updating firmware.

It’s very common to find Hikvision cameras vulnerable to CVE-2021-36260. The exploit can give you a shell on the device and lets you run commands.

We tested the same device and it was vulnerable with no patch applied.

This vulnerability is particularly interesting because you can generate a payload with Metasploit for this camera and connect it back to your C2. Then using a Meterpreter proxy or reverse SSH tunnel that camera becomes a proxy for attacking other reachable hosts on the network.

Summary

Testing cameras is definitely fun and PwnEye can help a lot here, but securing them can be part of your job too. Knowing how to both break and fix these devices gives you a better understanding of cybersecurity overall. That’s why you need Eyesharvester.

There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more. 

The post Camera Hacking: Testing Cameras with Eyesharvester first appeared on Hackers Arise.