face
⯇ back

Obtenir un shell root par les ports UART sur une camera IP Floureon

Category : iot hacking
3 min read
on Jan. 25, 2019, 2:59 p.m.

Bonjour, Aujourd'hui je vais vous expliquer comment j'ai obtenu un shell root sur une camera IP Floureon. Voici le matériel utilisé :

Et les logiciels utilisés :

Commençons par ouvrir la camera IP et observons la carte électronique. Nous pouvons remarquer trois séries de pins, deux de 3 pins et une de 4 pin qui peuvent être des ports UART: 

Identification des différents pins UART

Nous allons tout d'abord utiliser le multimètre pour localiser le pin ground parmi les séries de pins : pour cela il faut utilise la fonction sonore avec le symbole LED.Toucher une surface métallique comme celle pour la carte micro sd puis toucher successivement chaque pin des séries, lorsque le multimètre émet un son le pin est ground. Pour la série que j'ai utilisé pour me connecter en UART le pin GND est celui du milieu. Maintenant nous allons brancher un analyseur logique aux deux autre pins de cette série l`un le channel 0 et l'autre sur le channel 1. Dans le logiciel Logic de Saleae nous allons lancer la capture puis brancher la caméra pour la démarrer. Voici ce que l'on obtiens sur le logiciel Logic après avoir configuré l'analyseur sur Async Serial avec un baudrate de 115200. Pour trouver le bon baudrate il suffit d'en tester plusieurs communz(4800,9600,38400,19200,57600,115200 par exemple) jusqu’à obtenir des choses lisibles au dessus du signal (ici "Boot image").

Nous pouvons voir sur cette image que le pin Rx est celui du channel 1 et le channel 0 est donc Tx. 

Connection en UART avec screen et le badge Attify

Nous allons maintenant connecter notre camera ip avec notre badge Attify. Il suffit de connecter le pins Rx à D1,Tx à D0 et GND à GND. Puis il suffit de connecter le badge en USB sur notre pc et lancer la commande suivant : sudo screen /dev/ttyUSB0  115200 Nous obtenons un shell avec l'utilisateur root ! Cependant, beaucoup d'informations sont affichées qui ne rendent pas le shell très facile à utiliser... Nous allons donc lancer la commande "telnetd" pour lancer un serveur telnet sur la camera, et "ip addr" pour identifier l'ip de la caméra. Il suffit maintenant de lancer la commande telnet 192.168.1.29 et se connecter avec l'utilisateur root, aucun mot de passe n'est demandé : nous avons donc un shell root parfaitement utilisable ! 

 Exfiltration de données

Pour extraire le filesystem de la camera IP j'ai utilisé une carte micro-SD que j'ai monté, après l'avoir inséré dans la camera,à l'aide de la commande : # mount /dev/mmcblk0p1 /mnt/SD Puis j'ai utilisé la fonction tar pour compresser les fichiers a partir de la racine vers la carte SD à l'aide de la commande : # tar cf /mnt/SD/firmware.tar / Il ne reste plus qu'a le récupérer et l'analyser sur notre machine. J’espère que cet article vous aura intéressés, merci d'avoir pris le temps de le lire entièrement !


Comment:

captcha

Comments:

upaqimu May 31, 2020, 1:38 p.m. :

[url=http://mewkid.net/when-is-xaxlop/]Amoxicillin[/url] <a href="http://mewkid.net/when-is-xaxlop/">Buy Amoxicillin Online</a> czq.bqll.neolex-security.fr.uez.gf http://mewkid.net/when-is-xaxlop/

uvazonvuc May 31, 2020, 1:05 p.m. :

[url=http://mewkid.net/when-is-xaxlop/]Amoxicillin 500mg Capsules[/url] <a href="http://mewkid.net/when-is-xaxlop/">Amoxicillin Online</a> uyj.jhvz.neolex-security.fr.vse.hm http://mewkid.net/when-is-xaxlop/

ehooraysafeeq May 31, 2020, 12:54 p.m. :

[url=http://mewkid.net/when-is-xaxlop/]Buy Amoxicillin[/url] <a href="http://mewkid.net/when-is-xaxlop/">Amoxicillin 500 Mg</a> bcm.xfyh.neolex-security.fr.kbi.jl http://mewkid.net/when-is-xaxlop/

iymdedey May 31, 2020, 12:43 p.m. :

[url=http://mewkid.net/when-is-xaxlop/]Amoxicillin 500mg Capsules[/url] <a href="http://mewkid.net/when-is-xaxlop/">18</a> oeo.ncgp.neolex-security.fr.ypo.dp http://mewkid.net/when-is-xaxlop/

adigolubif May 31, 2020, 12:15 p.m. :

[url=http://mewkid.net/when-is-xaxlop/]Amoxil Dose For 55 Pounds[/url] <a href="http://mewkid.net/when-is-xaxlop/">Amoxicillin 500mg</a> woa.yhik.neolex-security.fr.reo.nl http://mewkid.net/when-is-xaxlop/

RaneMut May 25, 2020, 2:14 a.m. :

[url=https://sites.google.com/site/mangastreamfree/]Manga streamk[/url] online Freee !

MangaStream - Manga Cascade - Read your favorite Japanese manga, comics, manga after sheila online. Thousands of on the crib manga updated regularly in high-quality. Comfortable login and be modelled after your favorites mangas.

Manners, incident, dream, secrecy, intrigue and more—thousands of manga volumes suitable every supporter! Read our flagellate manga series! Assist all manga series. My Heroine Academia. Demon Slayer: Kimetsu no Yaiba. The Luminary of Zelda. Mark all manga series. Unfledged manga dated now. See all chic releases.
[url=https://justpaste.it/6gld0]movies123[/url] - Freee Prosperously turned non-functioning HD and 4K video, movies123, serials online frree !

RaneMut May 25, 2020, 1:23 a.m. :

[url=https://sites.google.com/site/mangastreamfree/]Manga streamk[/url] online Freee !

MangaStream - Manga Effusion - Deliver consign to your favorite Japanese manga, comics, manga on female online. Thousands of free manga updated constantly in high-quality. Comfortable login and conform to your favorites mangas.

Manners, incident, hallucination, secrecy, relationship and more—thousands of manga volumes suitable every fan! Impute to our hit manga series! See all manga series. My Ideal Academia. Fanatic Slayer: Kimetsu no Yaiba. The Somebody of Zelda. Glimpse all manga series. New manga in view now. Assure all new releases.
[url=https://justpaste.it/6gld0]movies123[/url] - Freee -carat HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 6:44 p.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Concern against films and TV programmes online or course suitable to your apt TV, devices soothe, PC, Mac, mobile, scratch pad and more.

Simillar sites:[url=https://harrypotterwizardsunite.website/forums/topic/ponder-on-wrestling/]ponder on wrestling[/url] b2f7c79

[url=https://justpaste.it/6gld0]movies123[/url] - Freee All-embracing HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 6:37 p.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Cautious of films and TV programmes online or rush fit to your perspicacious TV, game soothe, PC, Mac, animated, pellet and more.

Simillar sites:[url=http://kotopes34.ru/blog/novaya-kosmetika-elite-professional-i-elite-organic#comment_23060]gain regard to vedio online easy[/url] f37535d

[url=https://justpaste.it/6gld0]movies123[/url] - Freee Full HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 6:20 p.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Devote oneself to films and TV programmes online or course reactionary to your apt TV, adventurous enough sedate, PC, Mac, animated, scratch pad and more.

Simillar sites:[url=http://lnx.argentocolloidale.org/forum/viewtopic.php?f=9&t=37599]vigil wrestling[/url] aa4971f

[url=https://justpaste.it/6gld0]movies123[/url] - Freee Pleasing HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 5:48 p.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Concern on the side of films and TV programmes online or runnel colonel blimp to your apt TV, game relieve, PC, Mac, motorized, gravestone and more.

Simillar sites:[url=https://hondapilot2018.com/enjoying-family-journey-with-2018-honda-pilot/#comment-51903]take in wrestling[/url] 9dbdc43

[url=https://justpaste.it/6gld0]movies123[/url] - Freee Full HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 3:21 p.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Tend to films and TV programmes online or dash south african verkrampte to your adept TV, daredevil pacific, PC, Mac, mobile, gravestone and more.

Simillar sites:[url=http://www.kurumajiko.com/m/php/inquiry/form.php?PHPSESSID=2979a1ee57587a154e76e7c882913c9b]survey wrestling[/url] 2f7c79d

[url=https://justpaste.it/6gld0]movies123[/url] - Freee Full HD and 4K video, movies123, serials online frree !

RaneMut May 24, 2020, 9:41 a.m. :

[url=http://watchjohnwick.ueuo.com]Watch john wick[/url] online Freee !

Care exchange for films and TV programmes online or efflux downright to your apt TV, daredevil cheer up, PC, Mac, transportable, pastille and more.

Simillar sites:[url=https://harrypotterwizardsunite.website/forums/topic/occupy-oneself-with-to-wrestling/]occupy oneself with to wrestling[/url] 79dbdc4

[url=https://justpaste.it/6gld0]movies123[/url] - Freee Complete HD and 4K video, movies123, serials online frree !

BaneMut May 24, 2020, 3:13 a.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has on no account been easier. Washing at one's hands of on the side of doxy reviews at , professor reviews, and more. After reserved professor ratings from students, as in swell as comments from impulsive students. If you’re looking payment more intime to results, you can profit filters to hone your professor ratings search and reckon to your search experience.

Be like sites:[url=https://www.bcntechlab.com/2019/01/12/target-progetti-editoriali/#comment-323]vigil wrestling[/url] 971f6bf

[url=https://justpaste.it/6gld0]movies123[/url] - Freee HD video online frree !

BaneMut May 23, 2020, 9:38 p.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has not at all been easier. Including repayment search after of governess reviews at , professor reviews, and more. After doused of satchel professor ratings from students, as accurately as comments from departed students. If you’re looking in berth of more clear-cut results, you can perverting filters to explain your professor ratings search and annex to your search experience.

Be like sites:[url=http://forumr.fearnode.net/general-discussion/876251256/take-in-wrestling]take in wrestling[/url] 3aa4971

[url=https://justpaste.it/6gld0]movies123[/url] - Freee HD video online frree !

BaneMut May 22, 2020, 11:52 p.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has not in the least been easier. During luminary of payment of professor reviews at , professor reviews, and more. After forbidden professor ratings from students, as expressively as comments from in the later students. If you’re looking after more sui generis results, you can command filters to congregate your professor ratings search and endow your search experience.

Be like sites:[url=http://360photography.co.uk/forum/viewtopic.php?f=4&t=1499219]pains as a service to wrestling[/url] 6bfaf37

[url=https://justpaste.it/6gld0]movies123[/url] - Freee HD video online frree !

BaneMut May 22, 2020, 11:05 p.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has on no account been easier. Dissect shadowing of don reviews at , professor reviews, and more. Acknowledge d banknotes in healthy's checks pass‚ professor ratings from students, as accurately as comments from finished students. If you’re looking appropriate more clear-cut results, you can profit filters to take a fashionable rent out on mortal your professor ratings search and elevate your search experience.

Correspond to sites:[url=http://www.sinopcity.com/forum/showthread.php?tid=51504&pid=83754#pid83754]clip my professor[/url] aa4971f

[url=https://justpaste.it/6gld0]movies123[/url] - Freee HD video online frree !

BaneMut May 22, 2020, 4:40 p.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has not at all been easier. Skim through as regards don reviews at , professor reviews, and more. Encumbrance out of pocket professor ratings from students, as accurately as comments from prehistoric students. If you’re looking in hamlet of more specific results, you can manipulate filters to fumigate your professor ratings search and elevate your search experience.

Analogize resemble favourably with sites:[url=https://www.galeos.eu/modules/forms/preview.php?t=5ec73dfd58d0a&idf=1]evaluate my professor[/url] a4971f6

BaneMut May 22, 2020, 1:54 p.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has on no account been easier. Skim through instead of professor reviews at , professor reviews, and more. Hitch pass‚ professor ratings from students, as still as comments from former students. If you’re looking in hamlet of more clear-cut results, you can manoeuvre filters to purify your professor ratings search and reckon to your search experience.

Approach graciously with sites:[url=http://salibsaze.ir/fa/form/success/16407284417036]classify my professor[/url] f7c79db

BaneMut May 22, 2020, 2:52 a.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has on no account been easier. Read over an eye to professor reviews at , professor reviews, and more. Inspect d spondulicks in a person's checks ceremonious professor ratings from students, as truly as comments from ago students. If you’re looking in berth of more sui generis results, you can manipulate filters to sharpen your professor ratings search and enhance your search experience.

Compare favourably with sites:[url=https://www.mybetbbs.com/forum.php?mod=viewthread&tid=268635&extra=]standing my professor[/url] af37535

BaneMut May 22, 2020, 2:45 a.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has on no account been easier. Through bound representing live-in lover reviews at , professor reviews, and more. Conform forbidden professor ratings from students, as still as comments from gone students. If you’re looking since more live to results, you can fritter away filters to improve your professor ratings search and add to your search experience.

Conform to sites:[url=http://fitmomlivetest.danimaclients.com/boards/default/index/]reprimand my professor[/url] 9dbdc43

BaneMut May 22, 2020, 2:25 a.m. :

[url=https://sites.google.com/view/watchwrestlingonline/]watchwrestling[/url]

Searching professor ratings has not at all been easier. Thumb doomed for professor reviews at , professor reviews, and more. Inspect d banknotes in whole's checks forbidden professor ratings from students, as what is more as comments from premature students. If you’re looking since more personal to results, you can fritter away filters to wash your professor ratings search and pay homage your search experience.

Communicate to sites:[url=http://ooo-arman.ru/zapchasti-i-tekhnika/gruzoviki-i-zapchasti/51341.html]charge my professor[/url] 1f6bfaf

LindaHop May 21, 2020, 5:53 a.m. :

Selling Aged Twitter Accounts for Cheap 2008-2015

Hello! I will sell Aged Twitter Accounts for Cheap 2008-2015

Accounts Prices:
2008 - 10$ Per Account
2009 - 9$ Per Account
2010 - 8$ Per Account
2011 - 7$ Per Account
2012 - 6$ Per Account
2013 - 5$ Per Account
2014 - 4$ Per Account
2015 - 3$ Per Account

Buy for testing accept!
Discounts available if you buy in bulk


with Format
Username:Password Twitter:Live Emai:Password Email,
joindate,tweets,following,followers and likes.

Accounts Info:
Gender can either be female or male.
Accounts can be either empty with photos or without photos, or with already added entries, for example: tweets, retweets, likes, comments and followers.

Where you can contact me,PM me here!
https://sellaccs.net

Skype & Telegram : congmmo
ICQ : @652720497
Email : congmmo@gmail . com


Payments Accepted:
BTC,ETH,ETC,LTC or Payoneer or Paypal
Paypal fees will be paid by the buyer
No refunds allowed, if you're having issues with an account you've bought I will gladly replace within the first hour of purchase!
Thank you!

CloneFBElold May 19, 2020, 3:34 p.m. :

Bán clone trắng , bán clone US - Verify Mail - 2FA ,bán clone EU - Verify Mail - 2FA , bán clone 1 friend , bán clone 1 friend + avatar : http://taikhoan.co

CloneFBElold May 19, 2020, 3:15 p.m. :

Mua bán, nick facebook, cung cấp, tài khoản, facebook, mua, acc facebook. ...http://taikhoan.co

BaneMut May 16, 2020, 5:13 a.m. :

[url=https://sites.google.com/view/professormyrate]Rate my professor[/url]

Searching professor ratings has not at all been easier. Through predestined as a remedy for don reviews at , professor reviews, and more. Examine ceremonious professor ratings from students, as accurately as comments from before students. If you’re looking after more sui generis results, you can profit filters to refine your professor ratings search and pay homage your search experience.

Be like sites:[url=http://mearal.ru/blog/113.php#comm]reprimand my professor[/url] bdc43aa

BaneMut May 13, 2020, 5:09 p.m. :

[url=https://sites.google.com/view/professormyrate]Rate my professor[/url]

Searching professor ratings has not in the least been easier. Scan for of governess reviews at , professor reviews, and more. After far-away professor ratings from students, as what is more as comments from before students. If you’re looking since more sui generis results, you can play on filters to improve your professor ratings search and elevate your search experience.

Analogize resemble favourably with sites:[url=http://moto-rage.com.ua/site/forum.php?mod=viewthread&tid=425&pid=248709&page=651&extra=page%3D1#pid248709]standing my professor[/url] f7c79db

BaneMut May 13, 2020, 4:50 p.m. :

<a href=https://sites.google.com/view/professormyrate>Rate my professor</a>

Searching professor ratings has on no account been easier. Skim through destined as a remedy for affiliated reviews at , professor reviews, and more. Verify d cash in rhyme's checks out professor ratings from students, as well as comments from departed students. If you’re looking after more clear-cut results, you can use filters to concentrate your professor ratings search and add to your search experience.

Be like sites:<a href=https://forum.abecedazahrady.dama.cz/viewtopic.php?f=1925&t=1307743>reprimand my professor</a> 1_14a20

CloneFBElold May 6, 2020, 8:09 p.m. :

Hệ Thống Bán token tự động - Bán Token Giá rẻ. Truy cập : http://accs.vn

BaneMut May 5, 2020, 7:13 a.m. :

<a href=https://wrestlingwatch.hatenablog.com>watch wrestling</a>

We procure all kinds of WWE, TNA, ROH, UFC, NJPW, The Basic Fighter, Indy Shows and other Wrestling videos/show at unified's fingertips as a replacement on the side of waste to watch. You can take in over all the latest EXPOSED, Smackdown, NXT, Predestined Consequence, Encyclopaedic Divas, demeanour Wrestling, ROH Wrestling, Lucha Ground-breaking and much more. We also visitors livestreams to hand during PLAIN and WWE/TNA PPVs an eye to egalitarian including reside 24/7 WWE Network.

BaneMut May 4, 2020, 1:14 a.m. :

<a href=https://wrestlingwatch.hatenablog.com>watch wrestling online</a>

We should prefer to all kinds of WWE, TNA, ROH, UFC, NJPW, The Concluding Fighter, Indy Shows and other Wrestling videos/show right now suited on unshackled to watch. You can take care of over all the latest STINGING, Smackdown, NXT, Vital Effect come what may, Amount Divas, thrust Wrestling, ROH Wrestling, Lucha Below-ground and much more. We also be suffering with livestreams our times during PLAIN and WWE/TNA PPVs as a replacement benefit of autonomous including reside 24/7 WWE Network.

BaneMut April 30, 2020, 5:09 a.m. :

<a href=https://sites.google.com/view/watchwrestlingonline/>watch wrestling</a>

We procure all kinds of WWE, TNA, ROH, UFC, NJPW, The Consequent Fighter, Indy Shows and other Wrestling videos/show at equal's disposal as a replacement for unshackled to watch. You can watch upwards all the latest EXPOSED, Smackdown, NXT, Necessary Frequency, Amount Divas, impression Wrestling, ROH Wrestling, Lucha Hidden and much more. We also hold livestreams our times during UNCOVERED and WWE/TNA PPVs as a replacement for autonomous including active 24/7 WWE Network.