Victure VD300 Video Doorbell RTSP?

BillyJZera

n3wb
Joined
Feb 2, 2022
Messages
4
Reaction score
2
Location
United Kingdom
Hey guys! I have two Victure VD300 doorbells and I've recently setup ISpy Agent DVR for my other security cameras. I'm now curious to see if I can obtain an ONVIF stream from my doorbells.

I recall when I bought these doorbells they did claim to have RTSP support, but it's proving to perhaps not be so true.

When I browse to the doorbell's IP in a browser, I am prompted for credentials. There is no sign of any credentials in the instruction booklet, nor are the manufacturers forthcoming with any information as to what these credentials may be. All the standard default usernames and password combinations I've attempted have worked.

I did find a thread somewhere that suggested someone was able to obtain the credentials from the doorbell's flash memory, but no info as to how they did it. Using a micro USB cable, there doesn't seem to be any way to access the flash memory as I think this port is only for charging.

It seems to me that if I can obtain the credentials in some way, there may be some more clues in whatever the HTTP portal may reveal.

Any ideas guys? Would appreciate any help.

Thanks!
 

TonyR

IPCT Contributor
Joined
Jul 15, 2014
Messages
16,445
Reaction score
38,162
Location
Alabama
On another forum a person claimed to have found a URL with WireShark that works with another Victure cam.
Try this below with VLC, your cam's IP and insure you place 2 slashes after RTSP and the colon:

Code:
rtsp:/192.168.1.15/cam/realmonitor?channel=1&subtype=1
 

David L

IPCT Contributor
Joined
Aug 2, 2019
Messages
7,932
Reaction score
20,757
Location
USA
Hey guys! I have two Victure VD300 doorbells and I've recently setup ISpy Agent DVR for my other security cameras. I'm now curious to see if I can obtain an ONVIF stream from my doorbells.

I recall when I bought these doorbells they did claim to have RTSP support, but it's proving to perhaps not be so true.

When I browse to the doorbell's IP in a browser, I am prompted for credentials. There is no sign of any credentials in the instruction booklet, nor are the manufacturers forthcoming with any information as to what these credentials may be. All the standard default usernames and password combinations I've attempted have worked.

I did find a thread somewhere that suggested someone was able to obtain the credentials from the doorbell's flash memory, but no info as to how they did it. Using a micro USB cable, there doesn't seem to be any way to access the flash memory as I think this port is only for charging.

It seems to me that if I can obtain the credentials in some way, there may be some more clues in whatever the HTTP portal may reveal.

Any ideas guys? Would appreciate any help.

Thanks!
Not familiar with your Doorbell but have you tried any of the suggested (RTSP) URLs:


VLC is a good place to test RTSP:

From our 101:

⦁ RTSP Streaming for VLC (VideoLAN Media Player) Under Media/Open Network Stream (Ctrl+N)...Enter your RTSP Link/Info for Live Video Stream
 

BillyJZera

n3wb
Joined
Feb 2, 2022
Messages
4
Reaction score
2
Location
United Kingdom
On another forum a person claimed to have found a URL with WireShark that works with another Victure cam.
Try this below with VLC, your cam's IP and insure you place 2 slashes after RTSP and the colon:

Code:
rtsp:/192.168.1.15/cam/realmonitor?channel=1&subtype=1
Thanks mate but no dice with that URL sadly.
 

BillyJZera

n3wb
Joined
Feb 2, 2022
Messages
4
Reaction score
2
Location
United Kingdom
I also just found that if I browse in windows file explorer to: \\IPADDRESS\Device, it also prompts me for the credentials. If I can get these credentials this may also allow me to access the flash memory. Perhaps I need to try and brute force the creds.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland

BillyJZera

n3wb
Joined
Feb 2, 2022
Messages
4
Reaction score
2
Location
United Kingdom
Currently running bruteforce with a 1 million password file.

These doorbells are used with the cloudedge app, so it must be using some kind of streaming protocol for the app to access it.

Must be a way of exploiting this to use the camera in ISpy which is my aim.
 

DaHype

n3wb
Joined
May 19, 2022
Messages
3
Reaction score
0
Location
Vienna
Hello. I also have the VD300. And i try since weeks to get the Stream address. @BillyJZera did you find an solution?

I would like to integrate it in my Home Assistant. For that i need the RSTP Stream.
I contacted already the Seller Victure, they told it´s not possible. But i cant believe that, because there must be an crypted Stream to the App....

Would be great if someone already found an solution for that.
 

DaHype

n3wb
Joined
May 19, 2022
Messages
3
Reaction score
0
Location
Vienna
Any Idea how to get the RTSP Stream out?
I tried to debug the App CloudEdge, i get some IP´s and Ports, but no one from that works.

Screenshot_20220520-124250_PCAPdroid.jpg
 

DaHype

n3wb
Joined
May 19, 2022
Messages
3
Reaction score
0
Location
Vienna
It seems i have to gave it up and sell the cam :-(
The Seller Victure want help. They told there exists no stream inside the App, thats not correct, because the App must become an Stream from the Cam, only with that the Cloud Streaming works!
So the Cam send an Stream to the CloudEdge App where the Stream encrypted goes to an Chinese Server. But the Problem is, that the UDP Ports change each times i open Stream on App again.
I don´t find in the App a permanent Streaming address :-(

Any Idea????
 
Last edited:
Top