Hi all,
I have chinese D8204-2 NVR with four IP cameras. Cameras have YES.SYS logo branded on them. I would like to get rid of that NVR and use cameras directly by IP, using motion or other software. So far, I have been unsuccessful with hacking the cameras. That's what got so far:
NVR model seems to be this:
helpen.dvr163.com
It's unsecure, outdated, last update from 2020, it really should not be on my network, and certainly not on WAN. But currently, I have no other choice and it is.
Cameras are:
YES.SYS logo on them, PoE powered outdoor cameras
Wireshark scan has revealed the following UDP packet sent to the NVR by one of the cameras:
Furthermore, cameras have port 80 open, on which they respond:
They also have telnet open on port 8830:
No more open ports:
I would like to learn what URL I need to pass to that http server listening on port 80, but I don't know how. If I knew, I could pass that onto motion software to have a nice and working AV stream from the camera without that outdated NVR. Any help welcome. Thank you.
I have chinese D8204-2 NVR with four IP cameras. Cameras have YES.SYS logo branded on them. I would like to get rid of that NVR and use cameras directly by IP, using motion or other software. So far, I have been unsuccessful with hacking the cameras. That's what got so far:
NVR model seems to be this:
D8204-2-POE - dvr163
It's unsecure, outdated, last update from 2020, it really should not be on my network, and certainly not on WAN. But currently, I have no other choice and it is.
Cameras are:
YES.SYS logo on them, PoE powered outdoor cameras
Wireshark scan has revealed the following UDP packet sent to the NVR by one of the cameras:
JSON:
{
"Ver": "1.1",
"Nonce": "62e0ef8cd97bdc120a212faf1c2fba981a230164",
"Device-ID": "MAC_86:30:00:58:7d:67",
"Repeater-ID": "none",
"Device-Model": "HD IPCAM",
"Device-Type": "IPCAM",
"Esee-ID": "",
"Software-Version": "1.4.8.391809825(2.4.1.2)",
"Wired": [
{
"Connected": true,
"DHCP": false,
"IP": "192.168.1.69",
"Netmask": "255.255.255.0",
"Gateway": "192.168.1.1",
"MAC": "86:30:00:58:7d:67"
}
],
"Channel-Cnt": 1,
"Channel-Info": [
{
"id": 1,
"Stream-Cnt": 2,
"Stream-Info": [
{
"id": 11,
"Resolution": "2560x1920",
"Bitrate": 4096,
"Codetype": "H.265",
"Framerate": 8
},
{
"id": 12,
"Resolution": "702x576",
"Bitrate": 384,
"Codetype": "H.265",
"Framerate": 15
}
]
}
],
"Capabilities": {
"Http-Port": 80,
"MaxHardDiskDrivers": 0,
"MaxTFCards": 1
}
}Furthermore, cameras have port 80 open, on which they respond:
Code:
$ curl 192.168.1.69:80
<!DOCTYPE HTML PUBLIC "-/IETF/DTD HTML 2.0/EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL requested was not found on this server.</p>
</body></html>They also have telnet open on port 8830:
Code:
$ telnet 192.168.1.69 8830
Trying 192.168.1.69...
Connected to 192.168.1.69.
Escape character is '^]'.No more open ports:
Code:
$ nmap -p- 192.168.1.69
Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-13 19:27 BST
Nmap scan report for 192.168.1.69
Host is up (0.00021s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
8830/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 3.53 secondsI would like to learn what URL I need to pass to that http server listening on port 80, but I don't know how. If I knew, I could pass that onto motion software to have a nice and working AV stream from the camera without that outdated NVR. Any help welcome. Thank you.
