Попала мне в лапы камера МГТС LTV CNQ-310 C1, покупал как мёртвую с целью объектив 2,8 мм свинтить, дома включил на последок а она признаки жизни подаёт
Адрес по DHCP получает, в веб-морде пароль просит, VLC-плеером на 554 порт тоже пароль хочет.
А вот пароль то и не известен. Стандартные типа admin, 12345, 123456 не подходят (а предусмотрен ли там вообще вход? В инструкции от МГТС вообще нет упоминания веб-интерфейса, только облако).
На reset как ни жал - вроде не сбрасывается, по крайней мере признаков нет.
Просканил в Zenmap:
Код: Выделить всё
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-18 19:17 RTZ 2 (ceia)
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 19:18
Completed NSE at 19:18, 0.00s elapsed
Initiating NSE at 19:18
Completed NSE at 19:18, 0.00s elapsed
Initiating ARP Ping Scan at 19:18
Scanning 192.168.0.152 [1 port]
Completed ARP Ping Scan at 19:18, 0.44s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:18
Completed Parallel DNS resolution of 1 host. at 19:18, 0.00s elapsed
Initiating SYN Stealth Scan at 19:18
Scanning 192.168.0.152 [65535 ports]
Discovered open port 554/tcp on 192.168.0.152
Discovered open port 80/tcp on 192.168.0.152
Discovered open port 8000/tcp on 192.168.0.152
Discovered open port 8200/tcp on 192.168.0.152
Discovered open port 1050/tcp on 192.168.0.152
Completed SYN Stealth Scan at 19:18, 12.49s elapsed (65535 total ports)
Initiating Service scan at 19:18
Scanning 5 services on 192.168.0.152
Completed Service scan at 19:20, 150.10s elapsed (5 services on 1 host)
Initiating OS detection (try #1) against 192.168.0.152
NSE: Script scanning 192.168.0.152.
Initiating NSE at 19:20
Completed NSE at 19:21, 14.42s elapsed
Initiating NSE at 19:21
Completed NSE at 19:21, 1.02s elapsed
Nmap scan report for 192.168.0.152
Host is up (0.0010s latency).
Not shown: 65529 closed ports
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Hikvision IP camera httpd
|_http-favicon: Unknown favicon MD5: 89B932FCC47CF4CA3FAADB0CFDEF89CF
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST PUT DELETE
|_ Potentially risky methods: TRACE PUT DELETE
|_http-server-header: App-webs/
|_http-title: index
554/tcp open rtsp Hikvision 7513 POE IP camera rtspd
1050/tcp open http ZTE Auto-Configuration Servers (ACS) http login
|_http-title: Site doesn't have a title (text/xml; charset="utf-8").
8000/tcp open http-alt?
8200/tcp open trivnet1?
MAC Address: BC:AD:28:68:хх:хх (Hangzhou Hikvision Digital Technology)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5
Uptime guess: 0.050 days (since Mon Feb 18 18:09:17 2019)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=264 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Devices: webcam, broadband router
TRACEROUTE
HOP RTT ADDRESS
1 1.05 ms 192.168.0.152
NSE: Script Post-scanning.
Initiating NSE at 19:21
Completed NSE at 19:21, 0.00s elapsed
Initiating NSE at 19:21
Completed NSE at 19:21, 0.00s elapsed
Read data files from: C:\Program Files (x86)\Nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 183.74 seconds
Raw packets sent: 65556 (2.885MB) | Rcvd: 65558 (2.623MB)А от этой корпус вообще 1:1 LTV CNM-310
Короче, кто знает что это за дичь такая - буду рад любой инфе, хочу оригинальную прошивку залить в неё.
И за прошивку буду благодарен, желательно такую чтобы сразу на программаторе зашить и с UARTом не загоняться
