Iot on binreaper

Born Insecure: What Firmware Analysis Reveals About IoT Security Debt

Fri, 13 Mar 2026 00:00:00 +0000

I spent several weeks analyzing the firmware and cloud communication protocol of a popular consumer WiFi camera line. Seven firmware images across six models spanning five years of production — from late 2019 through November 2024.

What I found wasn’t the kind of vulnerability that gets introduced by a bad commit or fixed in a patch Tuesday. These are architectural decisions made early in the product’s life that propagated unchanged across every model, every revision, every year. Shared cryptographic keys with trivially guessable passphrases. A plaintext cloud signaling channel with no integrity protection. An internal command execution daemon that pipes unsanitized input straight into system().

HTB CCTV — ZoneMinder SQLi to Root via motionEye Signed API Command Injection

Mon, 09 Mar 2026 00:00:00 +0000

TL;DR

Log into ZoneMinder with default credentials (admin:admin), use CVE-2024-51482 (SQL injection) to extract the bcrypt password hash for user mark, crack it (opensesame), SSH in, then exploit motionEye (running as root on localhost:8765) by forging HMAC-signed API requests using the admin password hash from the config file to inject a command into the on_event_start hook, and trigger it via the motion HTTP control API.

Enumeration

Port Scan

22/tcp — OpenSSH 9.6p1 Ubuntu
80/tcp — Apache 2.4.58 (Ubuntu) → redirects to http://cctv.htb/

Add cctv.htb to /etc/hosts and browse to port 80.

Cracking Passwords from Embedded Linux Devices: The musl DES Crypt $ Salt Problem

Wed, 04 Mar 2026 00:00:00 +0000

When extracting /etc/shadow from embedded Linux devices — routers, IoT gateways, cameras — you’ll occasionally encounter password hashes that every standard cracking tool refuses to touch. Not because the hash is strong, but because the C library that generated it plays by slightly different rules.

This post documents a specific case: DES crypt hashes with a $ character in the salt, generated by musl libc on an OpenWrt-based router. The fix is a one-character substitution that makes the hash crackable in seconds.