Telnet password and username for IPC

I purchased a couple of these cameras: http://www.ipccam.com/ecp_view.asp?id=380. There are several of these on the internet and while they look to be the same, mine has an "Amovision" label on it, so I'm not quite sure whether all these are clones or they're all the same but with a different brand on it.

I wanted to fool around and see what's inside the firmware. See if I can get a few things to work like emailing, motion detection and stuff. I guess it should be simple since the firmware comes with those features - they simply aren't working at the moment.

The seller refused to provide the telnet password and username. I've tried a lot of combinations without success. I do have a serial converter but I wanted to avoid disassembling the device.

The web UI has an option for upgrading a new firmware but I haven't been able to find any.

Any clues on where to start?

Thanks a lot!

I have the same (?) camera, at least by the outside looks, bought here: http://www.ebay.com/itm/CCTV-IR-1080X720P-1-0MP-HD-P2P-outdoor-3-6mm-Onvif-network-Security-IP-Camera-/111245655784?pt=US_Security_Cameras&hash=item19e6c1fee8
My camera is labelled as: Vanxse Model V-B811, but I've seen many variants, as far a Vendor and Model numbers go, on different reseller sites.
I lost access to web interface on port 80, nmap scan shows only ports: 21 (ftp), 23 (telnet) and 5050 (multimedia conference control tool) open on the camera. Can't access with Telnet, wrong username and/or password, but I was able to pull some files with FTP. There were the two directories listed, "/conf" and "/custom" (can send via PM), which do not mean a whole lot to me. Poked around some of the ".html" files, but did not find anything of use. Seems like most of the configuration is saved in ".json" files.
The reseller did not provide any files or directions upon request (get what you pay for...)
Camera goes apart fairly easily, just carefully unscrew the body (threads are under the ring), paying attention not to mess up the wiring inside.
This is what is printed on the board: Hi3518_OV9712_v2.2.3_SQ38, which tells me it has a Hi3518 chip with OV9712 CMOS, version 2.2.3 (?) and whatever SQ38 is...
Will post some pictures of the board later on today...
Hope to get some more good info sharing going on here.
./b

Pictures of the board

Thanks for providing some nice pictures. I can't recognise any RX or TX pins. Did you get access to the serial console?

Also, if you can send me the files that you downloaded that'd be great. Mine does not seem to have FTP access enabled by default.

Code: [Select]

PORT    STATE SERVICE
23/tcp  open  telnet
80/tcp  open  http
88/tcp  open  kerberos-sec
554/tcp open  rtsp


PM sent with links...

Seems like the files you sent to me are some configuration json files. There is no reference to any telnet settings, though.

Thanks for the PM.

That is all I was able to pull with FTP.

I have a similar one, but the board layout is different. Just by looking at your board, the likely candidates for the serial are either the 2 or 3 pad groupings next to the Hi3518 IC.



If it's the 2 pad pair, you can pull GND from one of the holes for the standoffs.
Mine had a 3pad grouping close to the edge of the board.

I've only made slight progress. (dumped flash, extracted the firmware's fs partitions, and mounted the on a linux box)
I've also been trying to get the telnet password, but so far I've come to the conclusion that the password has to be reset in the firmware and re-flashed onto the camera.  I haven't gotten that far yet.  But I was able to view the /etc/passwd & /etc/passwd- files and here's what they have  (I've tried some rainbowtables with no luck).

/etc/passwd

Code: [Select]

root:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh
/etc/passwd-

Code: [Select]

root:$6$0E8/0opc$yfESwbvIce8PIEb3fCgH1kRpISzA2ffyv9VfdeM3wadmKyLfLXgNlyH3TafXvugdqPevBgE.3EZtGnP.KZZug.:0:0:root:/:/bin/sh
For mine re-flashing  to get telnet looks to be the only option for terminal access.  Because the serial connection stops after the kernel is loaded.  Which makes me think that either the kernel wasn't compile with tty support - or something is missing in the config.

Here's what I get during boot:

Code: [Select]

U-Boot 2010.06 (Jun 26 2013 - 09:59:34)

DRAM:  256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xEF 0x40 0x17 0x00 0x00 0x00
Spi(cs1): Block:64KB Chip:8MB Name:"W25Q64FV"
MMC:   MMC FLASH INIT: No card on slot!
envcrc 0xcbb66e64
ENV_SIZE = 0xfffc
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
CFG_BOOT_ADDR:0x58040000
8192 KiB hi_sfc at 0:0 is now current device

### boot load complete: 2382412 bytes loaded to 0x82000000
### SAVE TO 80008000 !
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   linux
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2382348 Bytes = 2.3 MiB
   Load Address: 80008000
   Entry Point:  80008000


load=0x80008000,_bss_end=808c1f30,image_end=8024da0c,boot_sp=807c71d8
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.


I took a couple pictures and labeled the serial connection on mine.  Turns out it's much more different than I first thought.  But I hope some of this info at least adds to the pool of knowledge on these cameras.

sudoninjas: Hi, I have the same board in my cam. Im new in cams, but what I need, is to now the path of the stream, because I want connect this cam to Synology SS. Can you help my?
THX
Lu

Hi ludom!

You can set them up as Generiv ONVIF Camera! Works fine for me! The port should be 1018 by default!
Also you could ssh to your NAS and create a file for this cam...

/etc/passwd
root:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh

If you still need the password for that hash here it is: xmhdipc

In depth details about this camera and the manufacturer of the hardware can be found here:

http://www.ipcamtalk.com/showthread.php/1812-Review-TOP-201-Super-Mini-720P-HD-IP-Cam-(The-Cheapest-IP-Cam-So-Far-!!)?p=19499&viewfull=1#post19499

Don