© Federal News Network
© Federal News Network
© The Associated Press
Welcome back, cyberwarriors!
A few weeks ago we published PwnEye, which is a great tool for camera hacking. We talked about the importance of keeping your IoT devices patched to prevent unauthorized access. A less hardened device is a lot more appealing to a hacker, especially when it sits on the same network as other infrastructure.
Cheap devices aren’t really built with security in mind and some of them come with backdoors that sooner or later get discovered and abused by anyone who finds them online.
Today let’s look at a tool that can identify cameras, test credentials and help you harden them.
Eyesharvester is a recon tool for IP cameras, DVRs and NVRs. You give it an IP range, it scans common ports, fingerprints the vendor and optionally tries default credentials. It can also show known CVEs associated with a brand and give you basic hardening advice. The tool is mainly for identification and reporting.
Let’s quickly download the repository and install the tool. No dependencies needed to get started.
Loginkali > git clone https://github.com/Exhunterx/eyesharvester.git
kali > cd eyesharvester
kali > bash install.sh
The help menu covers everything the tool can do.
kali > eyesharvester --help
Now let’s look at the ways you can use it.
You don’t always get the camera IP ranges from admins, so recon comes first. We need to figure out which IPs belong to cameras.
kali > eyesharvester IP/24
A few cameras were found. Now let’s pipe all those IPs to a text file. The flag below will silence the noise.
kali > eyesharvester IP/24 -q > cameras.txt
kali > cat cameras.txt
You can keep these IPs for future tests, say with PwnEye for example. Or maybe you want to update the spreadsheet of your surveillance infrastructure, as admins often do, though there are better ways to keep a record of everything.
We can also run confirmation checks to make sure these are actually cameras.
kali > eyesharvester IP/24 -c confirmed -v
There’s a confirmed Hikvision camera above. We’ll test it and the rest of those we found for default credentials.
kali > eyesharvester IP/24 --check-creds
Finding a camera with default credentials internally is very common.
Testing cameras is fun, but hardening them is a bigger question that needs to be addressed. Both pentesters and defenders should know how to do it and your report should include recommendations on how to harden these devices.
kali > eyesharvester IP --harden
Based on the vendor and open ports, a hardening checklist is generated along with the CVEs that affect your device. This mainly covers segmenting devices away from business and IT networks, disabling unused services, replacing weak credentials and updating firmware.
It’s very common to find Hikvision cameras vulnerable to CVE-2021-36260. The exploit can give you a shell on the device and lets you run commands.
We tested the same device and it was vulnerable with no patch applied.
This vulnerability is particularly interesting because you can generate a payload with Metasploit for this camera and connect it back to your C2. Then using a Meterpreter proxy or reverse SSH tunnel that camera becomes a proxy for attacking other reachable hosts on the network.
Testing cameras is definitely fun and PwnEye can help a lot here, but securing them can be part of your job too. Knowing how to both break and fix these devices gives you a better understanding of cybersecurity overall. That’s why you need Eyesharvester.
There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more.
The post Camera Hacking: Testing Cameras with Eyesharvester first appeared on Hackers Arise.
Welcome back, aspiring cyberwarriors.
Some cameras protect a building, others betray it. Camera hacking isn’t hard, and that’s the problem. These devices are often the most vulnerable in any environment. Once installed, they aren’t maintained until there’s a problem. Many “problems” can go unnoticed if you know how vulnerable cameras are. Hackers can use them for persistence or as an entry point into an organization.
We do have different articles on this topic, but this time there’s something else we want to show. It’s PwnEye.
PwnEye is a newer tool that didn’t get enough attention yet. It works with both ONVIF and RTSP and that’s pretty much all you need. Once it has compromised a camera, it can reboot it, factory reset and open an interactive shell via ONVIF.
You also black out the operator’s view. Just like in movies.
Let’s set up the tool. You’ll need ffmpeg first.
kali > sudo apt install ffmpeg
Then install pipx and grab the tool.
kali > sudo apt install pipx
kali > pipx install git+https://github.com/Hackerest/pwneye.gitOnce it’s ready, you can test it:
kali > pwneye -h 
The help menu’s large. The tool can be used to find cameras in a local network with –discover, but it can be pointed at any camera IP. That’s where we’ll start.
ONVIF is the protocol that lets cameras from different manufacturers talk to each other without buying the same product. It’s basically a standard, but it’s also an attack vector.
kali > pwneye -t IP
If the camera’s running default or weak credentials, you get access. The tool extracts everything after compromise. Below you can see the network config, MAC address, DNS entries and configured users. DNS entries may sometimes point to interesting internal servers.
Look at the configured user credentials in the output. You’ll use those to get a shell.
The tool also finds snapshots that the camera captures regularly. You can view them in the browser or wait for PwnEye to open the stream.
Some cameras support deface (black the screen), PTZ movement and factory reset through ONVIF. Not all. Depends on the model.
Finally, once it finishes, you get the stream.
Well, it’s just a bus station. Nothing fancy here.
If the camera supports it, you can deface it.
kali > pwneye -t IP --deface [MESSAGE]
It’s not sophisticated, but it works.
That’s probably the most interesting part. Take the credentials from the user profile output and get a shell.
kali > pwneye -t IP -ou admin -op ‘’
Once you’re in, run help and see what it has. Some cameras let you do more than others.
ONVIF compromise is worse than RTSP compromise, but RTSP often works when ONVIF doesn’t. The tool tries both by default, but you can skip ONVIF and go straight to RTSP if you want.
kali > pwneye -t IP -so
The tool has more than 450 credentials built in. You can also try common corporate passwords like Company123 or just Company.
Once it gets credentials, you get the stream.
Some IP cameras might be accessible from the internet and locally. That means compromising them also gives you a foothold on the internal network. They aren’t upgraded regularly and IoT devices in general lack proper software updates. There are dozens of known CVEs on most camera models. Cameras can be used to proxy through them, attack other hosts or maintain persistence.
There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more.
The post Camera Hacking: Using PwnEye to Compromise IP Cameras first appeared on Hackers Arise.
