KERUI Camera - Werid connectivity issue

flc99

n3wb
Jan 17, 2024
2
0
Spain
Hi to everybody,

I have been enjoying an IP Camera brand KERUI, model unknown for some years now. To use it I had to use either TuyaSmart or SmartLife phone apps.

Suddenly one day the camera disconnected itself and I had to re-connect it. This kept happening for some weeks until it never wanted to connect again (via a scan of a QR code on the phone). It gets stuck telling me "connecting to network" but I never hear the "connected to network". This happens with two networks where the camera had been previously connected to (two different places).

However, when I check via my router I see that the camera has a local IP address. I tried many many random combinations of user/password to enter it via telnet/ssh but I was unable to do so. When I ran nmap I got this output:
Nmap scan report for 192.168.1.193
Host is up (0.032s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp BusyBox ftpd (D-Link DCS-932L IP-Cam camera)
23/tcp open telnet BusyBox telnetd
6668/tcp open irc
|_irc-info: Unable to open connection
Service Info: Host: anyka; Device: webcam; CPE: cpe:/h:dlink:dcs-932l

I tried many combinations of user/password to enter it via telnet/ssh: none successful.

I even got to dismantle it as I assumed something was wrong with the WiFi chip (as it never gets to tell me that it successfully connected), my idea was to replace at some point in time.

Anyway, now I have just tried to connect with a different NEW account using TuyaSmart in a NEW network and it did connect and it works perfectly!!!

Any help on why I can't connect with my usual accoutn in my usual networks? I would love to be able to somehow connect to it via linux and forget about the awful TuyaSmart app but I would be happy just having it running in TuyaSmart.

PD: Now when I do nmap I get a different message:
PORT STATE SERVICE VERSION
21/tcp open ftp BusyBox ftpd (D-Link DCS-932L IP-Cam camera)
23/tcp open telnet BusyBox telnetd
6668/tcp open irc?
|_irc-info: Unable to open connection
| fingerprint-strings:
| LANDesk-RC:
| ]Q/M
| \xc7zK
| NotesRPC:
| _/O%
| ?mvf
| GFa>
| g,hJ
| #s8C
| #R.|n
| lR_n
|_ 5pI#t
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at Nmap Fingerprint Submitter 2.0 :
SF-Port6668-TCP:V=7.93%I=7%D=1/17%Time=65A819F1%P=x86_64-pc-linux-gnu%r(LA
SF:NDesk-RC,10B,"\0\0U\xaa\0\0\0\0\0\0\0\x08\0\0\0\xfb\0\0\0\x003\.3\0\0\0
SF:\0\0\0-X\0\0\0\x01\x93\xd9\xf5\x98N\x80\x17-\xcb\x1f,B>\x0b}\xd83\$\xb4
SF:\x01\x90\xcb5\x9f\xda\xe8r\x07,\xe7\xaa\x89\|2\xd2\xad\xaa\xfe\x08\x14\
SF:x88\x8a\xa26M\xbc\xbf\xa7\x7f\x1e\xa4\xc5\xf3<<\x90\x1a\xaa\t6\)-\xa0\x
SF:9e\xc9\xd7\xbb\xa0\x1dVZ\xf3\x13I\xa8\*\xf6\xaa\xccU\r\xd8\xa8\x08`\xfd
SF:\xc7\x84\x1a\xdeW\xb4\xbc\$&\n\xb0\xd34\xde\x03\xf5\x11\]Y\)\x14\xb8\xb
SF:2\)\xaaw\x18#v\x84\xa9,\xda\xfd\?\x97\xdd\xb5\x01\xf8\xb2nB\x92\xbb\xd5
SF:\xcf\x89\xcfV\xa0;7\x8c\xb9\xd3\x0bcB\xca\xd0\x1d\xd6\x1a\x87\xf00%\x0c
SF:\xf05\xfai\x9b~\x85\xdb\]Q/M\x98\xcf\xc0\x8cIL\|\xe0\xf69\xe2q4\xe5\xb7
SF:i\x91\xc33\xd3\xbcMj\x98\x11m\x05%\xf0\xb9\x03\?\0\xbfAEe\x06Y\xcb\xd1/
SF:\xc9\xfeM\xf3v\x06\x83\xe2\\\xc7zK\xff\xed:,\xf0\)N\0\0\xaaU")%r(NotesR
SF:PC,1000,"\0\0U\xaa\0\0\0\0\0\0\0\x20\0\0\x04\\\0\0\0\0\xc2\xea\0\xd1_<\
SF:x80\xdc\xdb`t\xde\x9cQ\xe5V\xfc\xb2\x80\0\x8e\x12\x87\x16\x1e\x01\xda\x
SF:a8\xc7\"\.\x11/@\xde\xcb\xe0%p\x9e\xad\x8e\n\0\xe2Dn\xd5\x08jU\x02\xce\
SF:x9a\x8a\xecl\xa0\x01\x0f\x0br\x85R\x9e\xab`A\x9a\xf6\x08\xb4I\xf4\xba\x
SF:f4\x12{\x995c\x10i\xed\xdb\x99\x94OEX\xe0\x9fD\?\xcb\x92\xc2K\x88\x89QF
SF:\xf08M\xfe\x15\xf2\xdc\xe5\x86M\\l\x98\xbf\xc2_/O%\x8d\x9f\"\xc0y\x97\x
SF:9f\xfb\x95\x84e\x14\)\xa1~\xc7\xcfz\x89\x1e\xdd\xcch6\x98\xe27\xf0\xc1\
SF:x82K\xeen\x03\xca\x82\x8e\x8bLK\x87\xc7\x20\xa2\xa9\xd0\xb6\xe7\x97\x88
SF:\xc9\xa82\xad\xc0c\xed\x01\x16\xac\x80\xef\x9e}{Z\x10q\xa8\]\xed\xfc\xa
SF:a3\*\xda\xc5\tnB\xc8F\xae\xdf\xcb\x90>\?\x0b\x08\x1f\xadY\x16\x92\x03=0
SF:\xdf\xd6\xba\xab\xdbF\x8f\xb0/r,\x14q\xc8\xa5\xb39\xf1\xaa\xb0={\xe1\xa
SF:5\xc5t\x02\x20\x16\xa60\x84S\xb8\x88\xf7f\?\xb3\x9d\x83\xe7w\xfad\xc2X3
SF:\x84\xa6\^8\x88{!\x97@\xeb\xf3\xf3\x9d,\xd1o\xc1\x80\x20`\xc3\xbb\xb3sS
SF:e\xea\xc0Nm\xb7\?\x17\xbe6\xc9\xf6HW\xa6\x18D\xb1\x8dS\xaeB\xe9g\xfctw\
SF:xd2\xf7\x076\xc4\x05r\x19\xe0\xd9Zd\xfa\xd3\xfb\xc1q\xe2D\xfc\xca\xd4\x
SF:9b\x03\xa7\x97\xe0\xe3\xcd`D\x90\x99\x96\x0e\xe0\x05G\xf3c\x0b\x97\x87\
SF:x20<\x1e\xa2\x04E\xd1r\xc2\x971\x19\(\x15\xdc\xb1\x1eSI\x88\xe9\x99\x1b
SF:\x0bC\x8f{\?\x11_\x95\xda\xd9\xe9-\x9cXJ\xe0\xd6\xf4\x7f\xfd\xb7\xe27y\
SF:xf4\xa3\x82\xe8\?mvf\xef\xb5\x82s\xa0\xd1\xf4cTw\x0bx\xd3\xfdS`,\xbf\x9
SF:20\xfc\xb0\xf0>\n'\x08\x81\xa2\xa2\xb7\x1a\xfe\xa7\xf2lE\xa8\xc1\x84\xa
SF:d5f\x91r\xbc\xa0\xaf\xfe\xf5\xf2\xbfB\xce\xa8Ng\x16\xd22V\xd6\xc4A\xe3\
SF:x86\x1fh\xcf\xfc;\xe5-a\xfa\xee\n\x81\xbe\xb0\xee\x85\x13\xab\xaf\xa3q\
SF:xc9\x7f\x10\xa9\xd6\(\xc4\x9a\xd3qb\xc7\x81\x8c\x88\x02u\xf7\xb1\xf2\x1
SF:a8\x9bU\x06%\x96\x8b\xf9X\xa9\x94DLe\xff\xdc\xb2\xd2\xbb\xd9F\xed\xa15\
SF:xce;I\x8f\xae\xc8\xa7B\x0e\xe6ph\xa1\xac\xac\x08\t\xa6\xa7a\xf3i\x02\xc
SF:4\x8f\x01\xfc\x1e\xfc\x10n~%\xbf\xaf\xdd\xacj>\xb7cxf\xf0\x06\xfa\xa3\x
SF:ee\x8b-Z\+\xe0\xac\xd0\x19\xe9\xae\x1f\x0c\xc7\xb29\xbe\xd2GFa>\xe7\x20
SF:\x08z\xcd\xafLC\xdc\xf77\x0c\.\xdb7\x1c\x7f\xc1\xc56m\xe4\x91I\+\xfc\x0
SF:c\xff\xb4\x9f=\xe6\xaf<\xa3\xb2\x02\xcc\xf5~\"\xc4g,hJ\xf2\x13\xb8\x1b\
SF:x1b\(\xcc\xd8j\x94\xa2\xb9\x8a#\xd4\xb6\x8dq!\xect;\xf6\xac\xbf#s8C\x8c
SF:l\xca\xc5\x89\xfe`\x96\xee\xb8y\xb1t\xe8y\xc4\xe3\x92g\x14\xdf_\xec\x02
SF:\xd01O\x08\xe3\xfb\xd3\)\xca\xccTy\xcd\xdcd\x0bp\xa8\x1c\xc1r\xb7\x86\x
SF:bc\x8e\xdd%\xf8\xd6\xec#R\.\|n\xd8\xe2\x89\$G\x92\xf7\xd8\xbaz\xf0K\xe3
SF:\xe7\xd2,\x92lR_n\xd6\xa6\xbe\xdb\xd3\xb32;\x1dMD\x9e\x95\x0f\xb5fak\xe
SF:15pI#t\x1av,U\xd1\xc2\xe1t\xffI\x86\x94C\xb6;\x10\xba\x9b\xa3\x15\xfeL~
SF:\xbf\xe8\xdb\x20\x1b\xac\xf8v\xb9\x083\x90HW\xa6\x18D\xb1\x8dS\xaeB\xe9
SF:g\xfctw\xd2\x94\xd6\x83\xa7\xaa\rl\xc0\xa6\xbf\n\x93`\x91\x98\x95\*\xe8
SF:\x0fp\x84\xd7o\x9a\xc6\x84y\xee\xaey\xee\x92");
Service Info: Host: anyka; Device: webcam; CPE: cpe:/h:dlink:dcs-932l
 
If you scanned a QR code with a phone app then you are connecting you to your cam via P2P meaning it's using their cloud....your connectivity issues are most likely with their cloud (or your account) especially since you "....check(ed) via my router I see that the camera has a local IP address."
 
Last edited:
  • Like
Reactions: flc99
If you scanned a QR code with a phone app then you are connecting you to your cam via P2P meaning it's using their cloud....your connectivity issues are most likely with their cloud (or your account) especially since you "....check(ed) via my router I see that the camera has a local IP address."

Hi TonyR, thank you very much for you answer. I appreciate it.

Besides, I am very inexperienced in the world of IP cameras but is there any chance that I can "hack" my camera? I have seen that people flash some files via an SD card and then they can use their camera as they wish. I would love to just be able to use an open-source tool and free myself from this dodgy P2P. Does anybody now any hack that might "free" my camera? I am willing to take risks.