==Summary==
This article describes the Hak5 Key Croc, a smart hardware keylogging device.
[[File:keycroc_photo.png]]<ref name="Pictures"></ref>

==Key Croc Basics==
[[File:Keycroc_specs.png]]<ref name="Pictures"></ref>

The Key Croc contains a Quad Core ARM processor, 512 MB RAM, and an 8 GB SSD. It can be connected to the internet by entering a Wi-Fi name and password into its config file. The Key Croc has to be connected to the target device via USB. Once it is installed between a PC and its keyboard, it starts its booting process, indicated by the LED changing its color. After it has booted, the LED is turned off and the Key Croc is now in Attack Mode.

===Attack Mode===
Attack Mode is visible from the outside by the LED being turned off. In this mode, the Key Croc clones the hardware identifier of the keyboard connected to it and poses as this keyboard. Thus, each keystroke entered via the keyboard is sent to the PC, but also recorded in the Key Croc’s loot file. Payloads may be triggered by typing the required keyword. Pressing the hidden button on the back of the Key Croc will cause it to enter Arming Mode.

===Arming Mode===
Arming Mode is visible from the outside by the LED blinking blue. In Arming Mode, no further keystrokes are recorded and payloads can’t be activated anymore. Instead, the Key Croc emulates a USB flash disk and a serial device, allowing the user to access it via the device’s file manager. A password and timeout to enter the Arming Mode can be configured in the Key Croc’s config file, if they aren’t configured the Key Croc will enter Arming Mode as soon as the button is pressed.

===Key Croc's File System===
*config.txt – configuration file
*upgrade.html – shortcut to software update documentation
*version.txt – current version
*docs/ – license and quick start guide
*languages/ – hosts keymap files used for recording and injection
*library/ – hosts inactive payloads
*loot/ – hosts captured keystrokes and other logs
*payloads/ – hosts active payloads
*tools/ – used to install additional packages

===LED Colors===

*Green – Booting up
*Red – Error
*Cyan – Configuring Wi-Fi per config.txt
*Magenta – Configuring Keylogger
*Blue – Arming Mode
*Yellow – Disk Full
*White – No Keyboard Detected

==Payloads==
[[File:Keycroc_payload.png]]<ref name="Payload"></ref>
The Key Croc offers the possibility to execute payloads on the targeted device. To be able to get activated, the payloads have to exist as either .txt or .sh files in the payloads/ directory on the Key Croc. Payloads that aren’t currently used can be stored in the library/ directory.
Most payloads activate on MATCH, meaning that if a certain string is typed, the payload will be triggered. The date and time of activation of a payload is logged in the associated log file in the loot/ folder. The language used in the payloads is Ducky Script 2.0, or QUACK.
Payloads can be written by the pentester themselves, or downloaded from the Hak5 GitHub repository.
[[File:Sudo-pass.png]]
This example shows how to get the password of a user on an Ubuntu machine.
First you need to tell it to wait for the "sudo" string. If the user types "sudo", the victim's keystrokes are recorded. SAVEKEYS UNTIL, like MATCH, can be a simple string or a complex regular expression. As the name suggests, it saves the entered key until it matches.
This little regex basically says that the key will be saved until ENTER is pressed twice. First his ENTER key is known to be at the end of the sudo command. Then enter your password when prompted. So it checks passwords using all regular expressions (.*?) until the last statement is the final ENTER key.
In this case, the WAIT_FOR_LOOT command tells the payload to wait until the specified loot file is written. Use this awk -F to create a new file containing only the extracted password and send it to Cloud C2 with a notification.

==Tools==
Additional pentesting tools like Metasploit might be installed on the Key Croc. Installation requires an active WiFi connection (which can be configured in the config.txt) and can be done via SSH, Cloud C2, or serial connection.
After installation, these tools can be found in the tools/ directory.
==Accessing Key Croc==

The Key Croc can be accessed via its USB flash disk, using any device's file manager. This enables the user to configure the Key Croc, check its loot files and change its active payloads. If a WiFi network and password is entered into the Key Croc's configuration file and it is configured to connect to a Cloud C2 server, captured keystrokes may also be streamed to this server. The Cloud C2 server also offers the possibility for a user to send payloads remotely to the Key Croc. Another way to remotely access the Key Croc is per SSH connection, which also has to be configured in the config.txt first.
Finally, having a serial console connection to the Key Croc enables the user to access its Linux shell.
Additional pentesting tools like Metasploit may be installed via Cloud C2, SSH, or serial console connection using the INSTALL_EXTRAS command.

==References==
[https://docs.hak5.org/hc/en-us/categories/360003797793-Key-Croc Hak5 Key Croc Documentation]
<references>
<ref name="Pictures">https://hak5.org/products/key-croc</ref>
<ref name="Payload">https://github.com/hak5/keycroc-payloads/blob/master/payloads/examples/example_text-expander.txt</ref>
</references>

2022-06-18T12:48:26Z

JJashari: /* Scanning Tools */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). It should include at least the subnets, firewalls, gateways, services/servers, and, above all, the system's communication relationships. 

*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats.

*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus2.png | 400px]]
|}

Wireshark 
Wireshark is a protocol analyzer. It is an essential tool for safety experts or gadget administrators. It is used to investigate the shape of various community protocols and has the ability to illustrate applications.

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:wireshark-tplink.png | 400px]] || [[File:wireshark-ev.png | 800px]] || [[File:wireshark-abus.png | 400px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 600px]] || [[File:ssh-abus.jpg | 800px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.kali.org/tools/wireshark/
* https://www.metasploit.com/
* https://www.speedguide.net/ports.php
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]

File:Nessus-abus2.png

2022-06-18T12:47:13Z

JJashari:

IOT Security: Pentesting on IP Cameras

2022-06-18T09:42:39Z

JJashari: /* References */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). It should include at least the subnets, firewalls, gateways, services/servers, and, above all, the system's communication relationships. 

*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats.

*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus.png | 800px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 400px]] || [[File:ssh-abus.jpg | 400px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.metasploit.com/
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator
* https://www.speedguide.net/ports.php

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-18T09:41:31Z

JJashari: /* Scanning Tools */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). It should include at least the subnets, firewalls, gateways, services/servers, and, above all, the system's communication relationships. 

*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats.

*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus.png | 800px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 400px]] || [[File:ssh-abus.jpg | 400px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.metasploit.com/
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-18T09:40:33Z

JJashari: /* Scanning Tools */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). It should include at least the subnets, firewalls, gateways, services/servers, and, above all, the system's communication relationships. 

*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats.

*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 600px]] || [[File:nessus-abus.png | 800px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 400px]] || [[File:ssh-abus.jpg | 400px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.metasploit.com/
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-18T09:39:56Z

JJashari: /* Scanning Tools */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). It should include at least the subnets, firewalls, gateways, services/servers, and, above all, the system's communication relationships. 

*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats.

*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 400px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus.png | 400px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 400px]] || [[File:ssh-abus.jpg | 400px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.metasploit.com/
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]