Any experience with FortiNet cams? missing password

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
I picked up a used Fortinet CB20 bullet-type cam (cheap, of course!). Seems like a well-built cam (2mp 2.8-12mm manual vari-focal with PoE and coax video out). It gets an IP via DHCP or takes 192.168.1.245 if no DHCP server is available. There's a web UI on port 80 (uses an activeX plugin), but I don't have the admin password and seller claims to not know it. No obvious reset button or pin hole on the camera body. Nothing in the 'hatch' except the varifocal control wands. I took off the front cover, but find no visible reset button, without further dis-assembly. NMAP shows it has port 23 open (telnet) so I'm running John the Ripper against it. From what I've managed to google, the cam originally ships with a blank password and the FortiRecorder software assigns one based on the mac address (hashed somehow, i suppose, and probably pretty long) No support from Fortinet of course, as I haven't bought the cam from them (they sell for like $300+ new...)

Does anyone know if/how this cam can be factory reset? Would save some time vs letting JTR do it's thing. Once cracked and/or reset, will need to find the rtsp:// URL, if any...

TIA, Paul.
 
Last edited:

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
sorry Alastair, for being misleading. i meant some sort of telnet password cracker, maybe not JTR, if not appropriate. (suggest one?) it's moot for now, as i forgot to bring the cam home with me for the weekend... I have yet to find any firmware files for the Fortinet cams - they seem to keep their stuff under wraps pretty well. All i've found is that the NVR software apparently sets a password on the cams at install time. the user never even needs to see it. and yet, there is a web GUI. go figure...
 
Joined
Aug 3, 2015
Messages
3,791
Reaction score
12,182
Location
Charlotte
Disassemble the camera, and post pictures of the printed circuit boards. If there's not a small push button on the board, there will be a pair of likely unmarked contacts/holes somewhere. Shorting those two contacts together while applying power to the camera should factory reset it.
 
Top