WinBook Security IPCam - Revision history

Tom: /* Furthur Reading */ openwrt

2017-06-09T02:33:13Z

Furthur Reading: openwrt

← Older revision		Revision as of 02:33, 9 June 2017
Line 158:		Line 158:

	https://blog.tho.ms/hacks/2016/08/28/openwrt-on-logilink-wc0030a.html		https://blog.tho.ms/hacks/2016/08/28/openwrt-on-logilink-wc0030a.html

			https://wiki.openwrt.org/toh/views/toh_dev_platforms?dataflt%5BPlatform*~%5D=RT5350

96.88.198.77: links

2017-05-23T00:51:20Z

links

← Older revision		Revision as of 00:51, 23 May 2017
Line 150:		Line 150:
	mtd6: 00300000 00010000 "sys"		mtd6: 00300000 00010000 "sys"
	mtd7: 00080000 00010000 "param"		mtd7: 00080000 00010000 "param"

			==Furthur Reading==

			https://hackaday.com/2016/03/28/tearing-down-an-ip-camera/

			https://jelmertiete.com/2016/03/14/IoT-IP-camera-teardown-and-getting-root-password/

			https://blog.tho.ms/hacks/2016/08/28/openwrt-on-logilink-wc0030a.html

96.88.198.77: /* Webroot */ ok

2017-05-19T03:41:42Z

Webroot: ok

← Older revision		Revision as of 03:41, 19 May 2017
Line 57:		Line 57:

	===Webroot===		===Webroot===

			webroot is at

	/system/www		/system/www
	~~# ls~~
			writeable and persistent.

	===Important Configs and Auth===		===Important Configs and Auth===

96.88.198.77: /* Introduction */ spln

2017-05-19T02:36:43Z

Introduction: spln

← Older revision		Revision as of 02:36, 19 May 2017
Line 7:		Line 7:
	We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.		We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.

	The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838]) in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK ~~RA5350~~] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.		The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838]) in the space uses a [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RT5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.

	===Buy===		===Buy===

96.88.198.77: /* Introduction */ close paren

2017-05-19T02:36:05Z

Introduction: close paren

← Older revision		Revision as of 02:36, 19 May 2017
Line 7:		Line 7:
	We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.		We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.

	The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838] in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.		The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838]) in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.

	===Buy===		===Buy===

96.88.198.77: /* cat /proc */ fmt

2017-05-19T02:00:56Z

cat /proc: fmt

← Older revision		Revision as of 02:00, 19 May 2017
Line 110:		Line 110:
	VCED exceptions : not available		VCED exceptions : not available
	VCEI exceptions : not available		VCEI exceptions : not available

	# cat /proc/meminfo		# cat /proc/meminfo
	MemTotal: 29336 kB		MemTotal: 29336 kB
Line 147:		Line 147:
	mtd6: 00300000 00010000 "sys"		mtd6: 00300000 00010000 "sys"
	mtd7: 00080000 00010000 "param"		mtd7: 00080000 00010000 "param"
	#

96.88.198.77: proc

2017-05-19T02:00:21Z

proc

← Older revision		Revision as of 02:00, 19 May 2017
Line 91:		Line 91:

	It seems that the encoder binary binds to 8600 and streams H.264; as of yet I'm not sure how to access that.		It seems that the encoder binary binds to 8600 and streams H.264; as of yet I'm not sure how to access that.

			==cat /proc==

			# cat /proc/version
			Linux version 2.6.21 (root@mailzxh-desktop) (gcc version 3.4.2) #744 Tue Jul 23 17:23:52 CST 2013

			# cat /proc/cpuinfo
			system type : Ralink SoC
			processor : 0
			cpu model : MIPS 24K V4.12
			BogoMIPS : 239.10
			wait instruction : yes
			microsecond timers : yes
			tlb_entries : 32
			extra interrupt vector : yes
			hardware watchpoint : yes
			ASEs implemented : mips16 dsp
			VCED exceptions : not available
			VCEI exceptions : not available

			# cat /proc/meminfo
			MemTotal: 29336 kB
			MemFree: 7104 kB
			Buffers: 1004 kB
			Cached: 4308 kB
			SwapCached: 0 kB
			Active: 4936 kB
			Inactive: 4104 kB
			SwapTotal: 0 kB
			SwapFree: 0 kB
			Dirty: 0 kB
			Writeback: 0 kB
			AnonPages: 3756 kB
			Mapped: 5464 kB
			Slab: 5432 kB
			SReclaimable: 616 kB
			SUnreclaim: 4816 kB
			PageTables: 364 kB
			NFS_Unstable: 0 kB
			Bounce: 0 kB
			CommitLimit: 14668 kB
			Committed_AS: 14096 kB
			VmallocTotal: 1048404 kB
			VmallocUsed: 6596 kB
			VmallocChunk: 1040520 kB

			# cat /proc/mtd
			dev: size erasesize name
			mtd0: 00800000 00010000 "ALL"
			mtd1: 00030000 00010000 "Bootloader"
			mtd2: 00010000 00010000 "Config"
			mtd3: 00010000 00010000 "Factory"
			mtd4: 00100000 00010000 "Kernel"
			mtd5: 00330000 00010000 "RootFS"
			mtd6: 00300000 00010000 "sys"
			mtd7: 00080000 00010000 "param"
			#

96.88.198.77: echo clobber and price

2017-05-19T01:57:48Z

echo clobber and price

← Older revision		Revision as of 01:57, 19 May 2017
Line 8:		Line 8:

	The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838] in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.		The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838] in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.

			===Buy===

			They seem to be available used/new from $40-$60 on ebay and amazon. Maybe they can be got from MicroCenter as well.

	==Filesystem==		==Filesystem==
Line 72:		Line 76:

	And after a reboot, here is the hash for 'hacdc': 4.n5RnxbkaMcU		And after a reboot, here is the hash for 'hacdc': 4.n5RnxbkaMcU

			==Change Password for remote access==

			Since the password is unknown, to obtain easy telnet access, you can append something like
			echo 'sleep 40 && /sbin/chpasswd.sh root xxxx' >> /system/init/ipcam.sh

			Probably good to backup ipcam.sh before clobbering it with echo >.

	==Pictures==		==Pictures==

96.88.198.77: /* Important Configs and Auth */ fmt

2017-05-19T01:50:57Z

Important Configs and Auth: fmt

← Older revision		Revision as of 01:50, 19 May 2017
Line 68:		Line 68:

	Here is the initial root password hash: OYZVRABjiXqqQ		Here is the initial root password hash: OYZVRABjiXqqQ

	Here is the hash for 'hacdc': ZnfPmQ6KIvlTA		Here is the hash for 'hacdc': ZnfPmQ6KIvlTA

	And after a reboot, here is the hash for 'hacdc': 4.n5RnxbkaMcU		And after a reboot, here is the hash for 'hacdc': 4.n5RnxbkaMcU

96.88.198.77: ok

2017-05-19T01:05:36Z

← Older revision		Revision as of 01:05, 19 May 2017
Line 7:		Line 7:
	We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.		We'd love to have some nice open source IP Cameras, who wouldn't? Unfortunately we've just got a shitty proprietary one. Fortunately, it's easy to hack.

	The Winbook IP Cam in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.		The Winbook IP Cam (I believe it's a [https://www.amazon.com/Winbook-Security-Wireless-Camera-Vision/dp/B00JX7QAX2 T7838] in the space uses an [https://wikidevi.com/wiki/Ralink_RT5350 RALINK RA5350] ([https://drive.google.com/file/d/0B8BpyTY91XfmajRYMWtscHRpbEU/edit datasheet]). The board we have includes holes for a UART serial pinout. We had success with a TTL USB serial adapter at 57600 baud. Root is available on serial with no password. The stock password is unknown at this time but can be reset to allow more comfortable remote telnet access; however, it resets every time we boot.

	==Filesystem==		==Filesystem==