Author Topic: Trying to gain access to a SIEPEM camera  (Read 4065 times)

Offline ritaman

  • Newbie
  • *
  • Posts: 2
    • View Profile
Trying to gain access to a SIEPEM camera
« on: August 25, 2015, 12:10:01 pm »
Hey, I'm trying to gain access to a HI3518 based camera, the camera is this one: http://www.aliexpress.com/item/1-0-Megapixel-S6211Y-WRA-Wireless-Wifi-IP-Camera-HD-720P-P2P-Network-Security-Camera-Support/32256002689.html made by SIEPEMS.

I tried to access the serial console, but when I was soldering cables to the UART pins I lifted the TX solder pad and I can't find follow the trace to any other place where it's accessible to solder a wire.

The firmware of the camera is in http://cd.365cam.net/s5030_en.html.  I downloaded it and took a look at it with an HEX editor and found what look like two password hashes in the firmware:

root:$1$xFoO/s3I$zRQPwLG2yX1biU31a2wxN/:
root:$1$d3VPdE0x$Ztn09cyReJy5PynZgwCbw0:

I have been trying to crack those but I haven't had any luck yet.

The other thing that I tried was to change the hashes in the firmware for one that I know the password, but the camera refuses to upgrade with my modified firmware, I think it must have some sort of signature/error checking that I'm breaking with my changes, but I haven't found it yet.

Any suggestions on how I might go about gaining telnet access?

Offline ritaman

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: Trying to gain access to a SIEPEM camera
« Reply #1 on: August 25, 2015, 04:16:50 pm »
OK, after a bit more effort I managed to crack the password. The password if anyone has a similar camera is: cat1029.

Both password are the same, they just have different salts.

Offline Cabeza_215

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: Trying to gain access to a SIEPEM camera
« Reply #2 on: May 26, 2016, 10:17:26 pm »
Hi, i have a SIEPEM camera, model S6213Y-WRA, it is very similar to ESCAM QF300. It had a bug with the audio and i installed a new firmware. Something went wrong and now it is bricked. I want to connect to serial port, but it is hard to know which connector it is in the PCB. Did u manage to gain access?