Exploitee.rs - User contributions [en]

Momentum Axel-720P

2018-04-25T17:45:34Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Momentum_Axel-720P.jpg|100px|thumb|left|Momentum Axel 720P]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built-in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by placing this customized firmware onto the micro SD card, and rebooting the camera. After reboot, you can log in to telnet with root/EHLGVG.

== Build Your Own Firmware ==

Alternatively, you can build your own firmware by following these instructions:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-25T17:45:13Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Momentum_Axel-720P.jpg|100px|thumb|left|Momentum Axel 720P]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built-in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by placing this customized firmware onto the micro SD card, and rebooting the camera. After reboot, you can log in to telnet with root/EHLGVG.

[[File:Ezviz.c]]

== Build Your Own Firmware ==

Alternatively, you can build your own firmware by following these instructions:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:35:34Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Momentum_Axel-720P.jpg|100px|thumb|left|Momentum Axel 720P]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by placing this customized firmware onto the micro SD card, and rebooting the camera. After reboot, you can log in to telnet with root/EHLGVG.

[[File:Ezviz.c]]

== Build Your Own Firmware ===

Alternatively, you can build your own firmware by following these instructions:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

File:Ezviz.c

2018-04-24T20:15:27Z

Rchase:

Momentum Axel-720P

2018-04-24T20:10:21Z

Rchase: /* Root: Custom Firmware Upgrade via SD Card */

__FORCETOC__
{{Disclaimer}}
[[File:Momentum_Axel-720P.jpg|100px|thumb|left|Momentum Axel 720P]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

Instructions to build custom firmware:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:09:41Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Momentum_Axel-720P.jpg|100px|thumb|left|Momentum Axel 720P]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

File:Momentum Axel-720P.jpg

2018-04-24T20:08:52Z

Rchase:

Momentum Axel-720P

2018-04-24T20:08:27Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Momentum Axel 720P.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:06:40Z

Rchase: /* About */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and Target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:06:24Z

Rchase: /* About */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Momentum Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription. Sold at Walmart and target. For more information, see https://www.momentumcam.com

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:05:30Z

Rchase: /* Root: Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Momentumcam.com Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription.

== Disassembly ==

== UART ==

== Root: Custom Firmware Upgrade via SD Card ==

Root shell over telnet can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:04:32Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Momentumcam.com Axel 720P is a Wi-Fi camera with a built in microphone, speaker, motion detection. Comes with free iPhone/Android app for control of the device. Recordings can be stored on micro SD card (not included) or cloud storage with a subscription.

== Disassembly ==

== UART ==

== Root: Custom Firmware with Telnet ==

Telnet to root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:01:04Z

Rchase: /* Root: Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Custom Firmware with Telnet ==

Telnet to root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: The root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:00:44Z

Rchase: /* Root: Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Custom Firmware with Telnet ==

Telnet to root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:00:29Z

Rchase: /* Root: Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Custom Firmware with Telnet ==

Telnet to root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T20:00:18Z

Rchase: /* Root: Build Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Custom Firmware with Telnet ==

Telnet root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T19:59:54Z

Rchase: /* Root: Build Custom Firmware with Telnet */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Build Custom Firmware with Telnet ==

Telnet root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T19:59:46Z

Rchase: /* Telnet to Root via SD card custom firmware upgrade */

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Root: Build Custom Firmware with Telnet ==

Telnet root shell can be enabled by creating a custom firmware, naming it 'ezviz.dav', placing it on the SD card, and rebooting:

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum Axel-720P

2018-04-24T19:57:59Z

Rchase:

__FORCETOC__
{{Disclaimer}}
[[File:Alarm.com_ADC-v520IR.jpg|100px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Alarm.com ADC-v520IR.

== About ==
The Alarm.com ADC-v520IR is a network (Wifi/Ethernet) camera w/ IR LEDs provided by alarm.com

== Disassembly ==

== UART ==

== Telnet to Root via SD card custom firmware upgrade ==

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum axel-720p

2018-04-24T19:54:38Z

Rchase: Blanked the page

Momentum Axel-720P

2018-04-24T19:54:02Z

Rchase: Created page with "Telnet to Root via SD card custom firmware upgrade 1. Download Hikvision packer/unpacker (to Linux PC): https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x..."

Telnet to Root via SD card custom firmware upgrade

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8%20build%20170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum axel-720p

2018-04-24T19:53:27Z

Rchase:

Momentum axel-720p

2018-04-24T19:52:46Z

Rchase:

Momentum axel-720p

2018-04-24T19:52:16Z

Rchase:

Telnet to Root via SD card custom firmware upgrade

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8 build 170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw

4. cd newfw

5. unsquahsfs app.img

6. cd squashfs-root

7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)

8. cd ..

9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148

10. rm -rf squashfs-root

11. ./hikpack -t r0 -p ezviz.dav -o newfw

12. Copy ezviz.dav to SD card

13. Insert SD card to camera

14. Reboot camera

15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Momentum axel-720p

2018-04-24T19:51:50Z

Telnet to Root via SD card custom firmware upgrade

1. Download Hikvision packer/unpacker (to Linux PC):

https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/

2. Download original firmware:

https://prod-peq-a-firmware-uploads.s3.amazonaws.com/firmware/Hikvision/MOCAM-720-01/V5.1.8 build 170829/digicap.dav?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAI3CJ5PEMTCV2KBOA/20180422/us-east-1/s3/aws4_request&X-Amz-Date=20180422T154301Z&X-Amz-Expires=604799&X-Amz-SignedHeaders=host&X-Amz-Signature=830a05ea9c676973fb282c53f70c6442eed9ba8894afbf0902652fd475ca0252

3. ./hikpack -t r0 -x digicap.dav -o newfw
4. cd newfw
5. unsquahsfs app.img
6. cd squashfs-root
7. nano initrun.sh and add '/bin/busybox telnetd &' to the end to enable telnet (or make any changes you want)
8. cd ..
9. mksquashfs squashfs-root/ app.img -comp xz -b 256K -noappend -force-uid 4145 -force-gid 4148
10. rm -rf squashfs-root
11. ./hikpack -t r0 -p ezviz.dav -o newfw
12. Copy ezviz.dav to SD card
13. Insert SD card to camera
14. Reboot camera
15. Log in to telnet with root/EHLGVG

*NOTE: This works because the current version of the firmware checks for the existence of 'ezviz.dav' when booting up. Also, the root password is hard-coded to all devices.

Rchase

2018-04-24T19:49:58Z

Rchase:

'''Member Profile'''

*Exploitee.rs Name: rchase

*Real Name: Reilly Chase

*Email: rchase [at] rchase.com

*Twitter: https://twitter.com/_rchase_

*Web: https://rchase.com

Rchase

2018-04-24T19:45:49Z

Rchase:

'''Member Profile'''

Exploitee.rs Name: rchase

Real Name: Reilly Chase

Email: rchase [at] rchase.com

Twitter: https://twitter.com/_rchase_

Web: https://rchase.com

Rchase

2018-04-24T19:42:11Z

Rchase:

'''Member Profile'''

-Exploitee.rs Name: rchase
-Real Name: Reilly Chase

Email: rchase [at] rchase.com

Twitter: [_rchase_]

Area of expertise: Hax0r

Rchase

2018-04-24T19:41:33Z

Rchase:

'''Member Profile'''

Exploitee.rs Name: rchase

Real Name: Reilly Chase

Email: rchase [at] rchase.com

Twitter: _rchase_

Area of expertise: Hax0r

Rchase

2018-04-24T19:41:07Z

Rchase:

'''Member Profile'''

-Exploitee.rs Name: rchase
-Real Name: Reilly Chase

Email: rchase [at] rchase.com

Twitter: _rchase_

Area of expertise: Hax0r

Rchase

2018-04-24T19:40:33Z

Rchase:

'''Member Profile'''

Exploitee.rs Name: rchase

Real Name: Reilly Chase

Email: rchase [at] rchase.com

Twitter: _rchase_

Area of expertise: Hax0r

Rchase

2018-04-24T19:40:19Z

Rchase: Created page with "'''Member Profile''' Exploitee.rs Name: rchase Real Name: Reilly Chae Email: rchase [at] rchase.com Twitter: _rchase_ Area of expertise: Hax0r"

'''Member Profile'''

Exploitee.rs Name: rchase
Real Name: Reilly Chae
Email: rchase [at] rchase.com
Twitter: _rchase_
Area of expertise: Hax0r