btsimonh / 826-x-ip-camera Goto Github PK

View Code? Open in Web Editor NEW

65.0 15.0 11.0 20.53 MB

For the examination of an mipc connected camera

Shell 100.00%

camera ip-camera firmware g8136s grain mining mipc ipc-project cloudcam

826-x-ip-camera's Introduction

826-x-ip-camera

This repo is about an IP camera I just bought on Amazon for £29.99 delivered.

See the wiki for a human readable intro....

If you have an interest in this or a similar camera (one which uses www.mipcm.com), add to the issue I've raised. Depending upon interest, I'll publish more....

https://www.amazon.co.uk/gp/product/B074M71BRF/ref=oh_aui_detailpage_o01_s00?ie=UTF8&psc=1

Mine was branded 'OnvianTech 1080P Wi-Fi IP Security Camera', but also known as 'Pannovo 826-x', 'FUJIKAM CCTV Security 1080P 2.0MP WiFi IPCamera'.

It's Grain 8136s based with ethernet, wifi, USB OTG and SD card, with pan and tilt, dubbed a 'Cloud Camera'.

The camera works with https://www.mipcm.com, however there is no information about the security of the camera, or what they may do with your data.

So; before attaching it to my wireless network, I'm going to have to break into it to see what it's made of.

It does have a local webpage which works with PC but not with mobile browsers. The mipc PC app is a wrapped html app.

The local webpage is mainly a javascript application, and as such is relatively easy to debug into in order to examine the protocols involved.

More worrying is that the camera does talk to mipc servers, at least for firmware updates, but it sends a fair bit of encrypted data to the servers, so without convincing documentation or evidence, this data is not to be trusted.

I have obtained an incremental firmware update file (ipc_pack_patch_from_v4.6.2.1706161621.rtl8188fu_to_v5.1.5.1803281502.rtl8188fu.bin), which consists of several parts: an lzma compressed patch to patch a tar file, an executable, a script, and a CRC, plus a few numbers... A full firmware file is elusive.

A few days of effort revealed a mechanism for replacing the script file in the upgrade file, which opens up the ability to run telnet/ftp and have root access.

work to do, can you help?

For a more general mod to the upgrade file, we would need to understand the patch mechanism. With this, it may be possible to make an upgrade file for cameras which have no upgrade file available (by making a patch file which does nothing, and knowing the CRC of the orignal TAR file present in firmware extracted from having a serial connection).

Login screen

Password:
login: can't chdir to home directory '/root'

|---------------------------------------------------------------------------|
| Welcome to                                                                |
|                                                                           |
|                    A                                                      |
|                   AAA                                                     |
|                  AAAAA                                                    |
|                 AAAAAAA                                                   |
|                AAAA   AA                                                  |
|         A     AAAA     AA                                                 |
|        AAA   AAAA       AA          AAA   AAAAA    AAA   AAAAA    AAAAA   |
|       AAAAA AAAA         AA              AA   AA        AA   AA  AA   AA  |
|      AAAAAAAAAA           AA        AAA  AA   AA   AAA  AA   AA  AA   AA  |
|     AAAAA AAAA             AA       AAA  AA   AA   AAA  AA   AA  AA   AA  |
|    AAAAA    A               AA      AAA  AA   AA   AAA  AA   AA   AAAAAA  |
|   AAAAA                      AA     AAA  AA   AA   AAA  AA   AA       AA  |
| AAAAAA                        AAAA  AAA  AA   AA   AAA  AA   AA  AAAAAA   |
|===========================================================================|
|                                                                           |
|                                             http://www.shenzhenmining.com |
|                                           power by (C)shenzhenmining 2015 |
|---------------------------------------------------------------------------|




BusyBox v1.20.1 (2015-03-29 21:56:34 HKT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

current status: root prompt, ability to start ftpd, etc.

Update - root access without serial.

I have uploaded two 'upgrade' files for different versions of this camera. These enable root telnet access plus allow for further customisation, see 'upgrade_hacks' folder.

Update - privacy assured

I beleive that the scripts in modificationscripts will convincingly stop the camera from being able to send anything to the internet servers - basically by removing the default gateway, so allowing the IP layer to only talk to the local LAN.

You can still use the local web interface, and with a little playing should be able to integrate the camera output into other local video destinations.

826-x-ip-camera's People

Contributors

Stargazers

Watchers

Forkers

cholik cron410 ammondevtek carthago66 bluesentinelsec belveder79 perrin-1 ragecc karlhaines82 nami-wh-lo chorpler

826-x-ip-camera's Issues

TTHS005 Camera

Hello,

Found this repo by way of this post (http://www.openipcam.com/forum/index.php/topic,1429.msg5004.html#msg5004), the site appears to be nonfunctional (couldn't reply).

I have a TaoTronics TT-HS005 camera I picked up on a flash deal at one point. The manual is located here: https://www.taotronics.com/media/downloads/88-20005-181_TT-HS005%20User%20Guide%20(PC)%20-%20V1.1(20170307).pdf

It connects remotely to the "ehawk.taotronics.com" URL, which appears to be identical to the MIPC website (though skinned slightly different), so I believe it is a similar clone.

I'd like to use locally with my camera server, however I can't seem to locate a feed. I found my way to your post after an NMAP showed a similar "Tmrmt_hello" response. NMAP result below:

Starting
Nmap 7.70 ( https://nmap.org ) at 2018-07-03 19:16 MDT
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 19:16
Completed NSE at 19:16, 0.00s elapsed
Initiating NSE at 19:16
Completed NSE at 19:16, 0.00s elapsed
Initiating ARP Ping Scan at 19:16
Scanning 172.16.0.195 [1 port]
Completed ARP Ping Scan at 19:16, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:16
Completed Parallel DNS resolution of 1 host. at 19:16, 0.00s elapsed
Initiating SYN Stealth Scan at 19:16
Scanning 172.16.0.195 [65535 ports]
Discovered open port 80/tcp on 172.16.0.195
Discovered open port 8600/tcp on 172.16.0.195
Discovered open port 7010/tcp on 172.16.0.195
Completed SYN Stealth Scan at 19:16, 19.72s elapsed (65535 total ports)
Initiating Service scan at 19:16
Scanning 3 services on 172.16.0.195
Service scan Timing: About 33.33% done; ETC: 19:20 (0:02:42 remaining)
Service scan Timing: About 66.67% done; ETC: 19:19 (0:01:00 remaining)
Completed Service scan at 19:19, 151.24s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 172.16.0.195
Retrying OS detection (try #2) against 172.16.0.195
adjust_timeouts2: packet supposedly had rtt of -1085677 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -1085677 microseconds. Ignoring time.
Retrying OS detection (try #3) against 172.16.0.195
Retrying OS detection (try #4) against 172.16.0.195
adjust_timeouts2: packet supposedly had rtt of -1225849 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -1225849 microseconds. Ignoring time.
Retrying OS detection (try #5) against 172.16.0.195
NSE: Script scanning 172.16.0.195.
Initiating NSE at 19:19
Completed NSE at 19:19, 0.25s elapsed
Initiating NSE at 19:19
Completed NSE at 19:19, 1.07s elapsed
Nmap scan report for 172.16.0.195
Host is up (0.0025s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
80/tcp open http?
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|http-title: IPC
7010/tcp open ups-onlinet?
8600/tcp open asterix?
| fingerprint-strings:
| DNSStatusRequestTCP:
| y%2&
| Tmrmt_hello
| 1jfiegbp5sfdq
| DNSVersionBindReqTCP, GenericLines, GetRequest, HTTPOptions, Help, NULL, RPCCheck, RTSPRequest:
| Tmrmt_hello
| 1jfiegbp5sfdq
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8600-TCP:V=7.70%I=7%D=7/3%Time=5B3C1FF9%P=x86_64-apple-darwin13.4.0
SF:%r(NULL,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\xf9\xb5h\0
SF:\0\0\0\xbc\x1c\xc5\xb6\0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0\0\xe0\x1c\xc5\xb6\0\0\0\x001
SF:jfiegbp5sfdq\n\0\0")%r(GenericLines,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0
SF:0\0\0\0\0\0\0\0|\xf9\xb5h\0\0\0\0\xbc\x1c\xc5\xb6\0\0\0\0\xf5\x8f\x05T
SF:mrmt_hello\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0
SF:0\xe0\x1c\xc5\xb6\0\0\0\x001jfiegbp5sfdq\n\0\0")%r(GetRequest,6C,"8\0\0
SF:\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0z\xf5\x9dc\0\0\0\0@$\xc5\xb6
SF:0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:0\0\0\0\0\0\x0e\0\0\0d$\xc5\xb6\0\0\0\x001jfiegbp5sfdq\n\0\0")%r(HTTPO
SF:ptions,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa8?\x98\x0f
SF:\0\0\0\0@$\xc5\xb6\0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0\0\0\0\0\0\0\0\0
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0\0d$\xc5\xb6\0\0\0\x001jfiegbp5
SF:sfdq\n\0\0")%r(RTSPRequest,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\x81g(x\0\0\0\x008+\xc5\xb6\0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0\0\+\xc5\xb6\0
SF:\0\0\x001jfiegbp5sfdq\n\0\0")%r(RPCCheck,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0<\xd4/5\0\0\0\x008+\xc5\xb6\0\0\0\0\xf5\x8f\x05Tmr
SF:mt_hello\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0\0
SF:\+\xc5\xb6\0\0\0\x001jfiegbp5sfdq\n\0\0")%r(DNSVersionBindReqTCP,6C,"8
SF:\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xb7$\xccV\0\0\0\x008+\x
SF:c5\xb6\0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\x0e\0\0\0\+\xc5\xb6\0\0\0\x001jfiegbp5sfdq\n\0\0")
SF:%r(DNSStatusRequestTCP,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0y%2&\0\0\0\0\xc4\x07\xc5\xb6\0\0\0\0\xf5\x8f\x05Tmrmt_hello\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0\0\0\xe8\x07\xc5\xb6\0
SF:0\0\x001jfiegbp5sfdq\n\0\0")%r(Help,6C,"8\0\0\0l\0\0\0\0\0\0\0\0\0\0\0
SF:0\0\0\0\0\0\0\0\x1b\x85\xc0y\0\0\0\0\xc4\x07\xc5\xb6\0\0\0\0\xf5\x8f\x0
SF:5Tmrmt_hello\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\0
SF:0\0\xe8\x07\xc5\xb6\0\0\0\x001jfiegbp5sfdq\n\0\0");
MAC Address: AE:CA:05:FE:91:47 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=7/3%OT=80%CT=1%CU=34710%PV=Y%DS=1%DC=D%G=Y%M=AECA05%TM
OS:=5B3C2099%P=x86_64-apple-darwin13.4.0)SEQ(SP=104%GCD=1%ISR=10B%TI=Z%CI=Z
OS:%II=I%TS=U)SEQ(CI=Z%II=I%TS=U)SEQ(CI=Z%II=I)OPS(O1=M582NNSNW2%O2=M582NNS
OS:NW2%O3=M582NW2%O4=M582NNSNW2%O5=M582NNSNW2%O6=M582NNS)WIN(W1=3714%W2=371
OS:4%W3=3714%W4=3714%W5=3714%W6=3714)ECN(R=Y%DF=Y%T=40%W=3714%O=M582NNSNW2%
OS:CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y
OS:%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%R
OS:D=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%
OS:S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPC
OS:K=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

NSE: Script Post-scanning.
Initiating NSE at 19:19
Completed NSE at 19:19, 0.00s elapsed
Initiating NSE at 19:19
Completed NSE at 19:19, 0.00s elapsed
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 188.81 seconds
Raw packets sent: 66075 (2.911MB) | Rcvd: 65974 (2.642MB)`

In the WebGUI, there are two versions listed, neither which match up with the uploads you provided. It appears to be running a slightly different version - I've tried uploading the ones on this site to no avail.

Are there upgrade.sh files I can copy to an SD card, can I modify the upgrade files, or any potential suggestions? I'm happy to pop it open and JTAG it if that's the next steps (done plenty of similar cracking of models; in the past I would unlock Vonage boxes for usage with FreePBX/Asterisk via serial console :))

Root Login requires password

Hey I followed all the steps on the Step by Step guide.
However after setting the debug flag a root password is still required.
What can I do? (All commands ran without an error)

breaks on Node 17.x

After moving forward with the Armbian installation, the flow is broken on a newer Node version. The crypto modules seems to require a different setup and I don't really know how to fix it.

In the init node, this line gives an error (round line 585 or so):
ccm.sdh = crypto.createDiffieHellman(ccm.primehex, 'hex', 5);

"Error: error:0280007E:Diffie-Hellman routines::modulus too small"

This seems to be related to a comment I found about new requirement from openssl regarding key length:

https://www.mail-archive.com/[email protected]/msg1822399.html

Since I don't exactly know what this prime stuff is, I was not able to fix it. Any ideas?

Interested? comment here

This repo is my exposure of my attempt to keep my privacy faced with Chinese hardware with no published privacy policy....
If you have the same or similar camera, and are interested in contributing, then put a comment against this issue; maybe we can collaborate.
I've got the initial work done (root prompt, but requiring serial access to establish, permanently), but the ideal would be an exploit which did not require serial access.
There are promising hints of such exploits, but they require detailed investigation (ARM decompilation and debugging) which I simply don't have the time to do.
There are also (purely from the connections of the developer) hints that these cameras may actually be mining bitcoin on the developer's behalf - a good way of financing the internet infrastructure required for delivering the cloud video. I've not got a problem with that :). But I do need to have some guarantees about it's interaction with my home network....

Automatic Reboot in Node-Red

just came across this amazing stuff... my Yatwin is also one of those cams with the mipc software...

do you have any idea how to implement the reboot command in node-red?
since i have blocked internet access for mine, it tends to lock up every few days, and rebooting it periodically would be a nice workaround...

Developer of app TinyCam found a solution for live feed and PTZ [Conico Camera]

I have two cameras using the same firmware (but different version) as you all. I have been following this for quite awhile. I noticed that the dev of the app TinyCam found a solution for both getting images and PTZ. You can use TinyCam to also create a re-host for the cameras which can connected to Zoneminder or another NVR. I found information here which helped https://community.home-assistant.io/t/inkerscoop-and-mipc-camera-integration/39314/2

The reason I bring this up is because I am going to see if (in my free time) I can reverse engineer this to work directly with Zoneminder using the information you all have collected here..no promises of course.

Information:
Specifically Cameras:
Conico - Wireless Camera, 1080P HD WiFi Pet Camera Baby Monitor, Pan/Tilt/Zoom IP Camera for Elder/Nanny Security Cam Night Vision Motion Detection 2-Way Audio Cloud Service Available Webcam White - amazon.com/gp/product/B07QFVQ2DY
Software Version: v5.3.1.1907051809

Conico - Wireless Security Camera 1536P Pet Camera, CONICO 3MP Dog Cam Baby Monitor 360° Viewing 8X Zoom, 2-Way Audio, Surveillance Camera with Motion Sound Alerts Night Vision Cloud Storage Works with Alexa - amazon.com/gp/product/B07T4678FX
Software Version: v5.3.1.2003301008

Using the document you posted https://github.com/btsimonh/826-x-ip-camera/blob/master/reference/relatedcameras.txt I was able to find a setting that worked on the TinyCam App. I used the Fukikam config mode FL-366 as the config selection and selected jpg . Both PTZ and live image updating works.

TinyCam Free https://play.google.com/store/apps/details?id=com.alexvas.dvr&hl=en_US