Cameradar🎥: Hack IP Cameras😈 --Be Omniscient --👻

alvin gitonga
Feb 18, 2023
4 min read

CyberMorans🤗

As you may know, we have played some OSINT roles for Ukraine since the invasion began. One of this roles is the hacking of IP cameras throughout the country. In this way, we can spy on Russian activities and war crimes☠️ We did this at the request of the Ukraine Army starting in February 2022 😛

To hack these cameras we use multiple methods and techniques😎 In hacking, always explore multiple methods to be successful. -- Persistence is a key hacker 😈 trait --

As a hacker😈 it is important to take a strategic approach to any target. Always use the simplest methods first before progressing to more advanced attack methods😎

First step, we identified the unprotected☠️ cameras using such sites as Shodan, Google Dorks, and Censys. Then, we tried default credentials. These default credentials vary by camera and manufacturer but that technique resulted to pwning a few cameras😕

Next, we tried to hack the cameras with weak passwords☠️. This produced way more successful results!😝 The primary tool used is Cameradar😈

In this tutorial, I will show you how to use Cameradar for IP camera hacking just like we did!

🚀 Real Time Streaming Protocol: RTSP

RTSP is the protocol that most of these IP cameras use. Not all of the cameras use RTSP, but the vast majority do. Before proceeding, Note that those cameras using proprietary or other protocols will not be exploitable by cameradar😐

RTSP is an application-layer protocol used for commanding streaming media servers via pause and play capabilities. It thereby facilitates real-time control of the streaming media by communicating with the server☺️ — without actually transmitting the data itself.

It is an application-level network communication system that transfers real-time data from multimedia to an endpoint device by communicating directly with the server streaming the data🎥

The protocol establishes and controls the media stream between client devices and servers by serving as a network remote control for time-synchronized streams of continuous media, such as audio and video🙂

It does not stream the multimedia itself but communicates with the server that streams the multimedia data🧐 -- When a user pauses a video they are streaming, RTSP would convey the user's request to pause the video to the video streaming server-- ☺️

Like HTTP, RTSP uses TCP to maintain an end-to-end connection and, while most RTSP control messages are sent by the client to the server, some commands travel in the other direction😋

🚀 RTSP commands

Sent from the client to the server, when negotiating and controlling media transmissions:

👉 Options: This request determines what other types of requests the media server will accept.

👉 Describe: A describe request identifies the URL and type of data.

👉 Announce: The announce method describes the presentation when sent from the client to the server and updates the description when sent from server to client.

👉 Setup: Setup requests specify how a media stream must be transported before a play request is sent.

👉 Play: A play request starts the media transmission by telling the server to start sending the data.

👉 Pause: Pause requests temporarily halt the stream delivery.

👉 Record: A record request initiates a media recording.

👉 Teardown: This request terminates the session entirely and stops all media streams.

👉 Redirect: Redirect requests inform the client that it must connect to another server by providing a new URL for the client to issue requests to.

Other types of RTSP requests include ‘get parameter,’ ‘set parameter,’ and ’embedded binary data,’

Now, you are ready to start cracking IP cameras! 😆

🚀 Download and Install cameradar

Cameradar can be run natively in Linux, but it works best in a docker container.

First, install docker 👇

kali > sudo apt install docker

Next, start docker with the systemctl command👇

kali > sudo systemctl start docker

Now, download cameradar👇

kali> sudo git clone https://github.com/Ullaakut/cameradar

Now, lets brute-force some IP cameras! ✊

🚀 Run the RTSP Credential Brute-forcer

Now that you have docker and cameradar installed, you only need to point cameradar at the IP address of the camera that you want to brute-force! For instance, to brute force a camera at 192.168.1.1 , we would 👇

kali > sudo docker run  ullaakut/cameradar -t 192.168.1.101

Cameradar will now attempt to find a RTSP stream at one of the default RTSP ports namely 554, 5554 and 8554. If you suspect there may be other ports with RTSP streams --you may want to run an nmap scan first--, you can add them with the -p switch 👇

kali > sudo docker run  ullaakut/cameradar -t 192.168.1.101 -p 9554

🚀 Use Custom Username & Password Lists

By default, cameradar uses a small username and password list of the most common usernames and passwords. It's good strategy to use these first but if they are unsuccessful, it's time to think out of the box!😁

This means larger and more appropriate username and password lists --I personally like seclists-- . However from experience hacking cameras in Ukraine, Mexico, Syria, Sudan and Russia, the usernames usually are simple 🤏 such as admin, root, admin1, admin3, etc. This means that you can probably use the default username list but passwords do vary😉

That's why you should use a good password list that is appropriate for your environment and/or context of your target 🤌--i.e, using a Spanish list in a Spanish speaking nation -- or the equivalent for a church, Mosque, Military, Political parties etc--👌

First, the password list MUST🤌 be in json format. There are several websites that can covert your text file to json for free such as https://anyconv.com/txt-to-json-converter/. Your .txt file will then be converted to one with a json extension. So, if we were using the seclist's password list 👇

/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt

I would first convert it to json format and then use that file with cameradar. It will then appear as 10-million-password-list-top-1000000.json. Now to use that password list with cameradar, you can run the command 👇

kali>  sudo docker run  ullaakut/cameradar -t  

-v /usr/share/seclists/Passwords/Common-Credentials:/tmp/dictionaries 

-c "tmp/dictionaries/10-million-password-list-top-1000000.json"

-t 192.168.1.101

🚀 This is easier than it seems...

Once you become familiar with the RTSP protocol, password cracking of IP camera credentials follows a similar process as other remote password cracking techniques. In fact, it may even be easier since the RTSP protocol rarely imposes a lockout limit on the number of attempts made. With cameradar, we were able to gain access to a significant number of IP cameras that had weak passwords😲

🚀Conclusion 🤖

Subscribe to receive notifications of similar posts 😜 where we will be reverse engineering malware, vulnerabilities as well as hacking vectors, stories, tutorials and other Infosec stuff...😋

Follow me on twitter for daily Infosec Memes and shenanigans😝

Morans,