It is a 1 MP IP camera (bullet design) with PoE (IEEE 802.3af) support. Hardware looks good, software is crap. Web interface is Chinese and requires Active-X or something to become functional.

One can telnet to port 9527 to get some kind of console with a login (admin / [blank]); there is a help command:

----------------------Console Commands----------------------------
                 232 Comm dump
              485Pro 485 Protocol!
             ability Net Ability Utility!
                  ad AD debug interface!
               alarm Alarm status!
            autoshut auto shut the DVR

             bitrate Dump BitRate infomation!
                 cfg Config Help Utility!
                comm Comm Input String
              encode Encode commands!
               front front board utility!

                  fs Fs debug interface!
                heap Dump heap status!
                help Try help!
           infoframe InfoFrame Console Utility!
                 log Log utility!
              netitf NetInterFace Dump!
                netm NetManager Dump!
               onvif Onvif debug msg!
              packet Packet usage!
                 ptz ptz dump!
                quit Quit!
              reboot Reboot the system!
              record Record console utility!
            resource CPU usage!
                 rtp RTP Dump!
               shell Linux shell prompt!
            shutdown Shutdown the system!
                snap Snap Console Utility!
              thread Dump application threads!
                time Set SystemTime!
               timer Dump application timers!
             upgrade Upgrade utility!
                user Account Information!
                 ver version info!
             xmcloud XmCloud Dump!
To see details, please use 'cmd -h'

My firmware version seems to be:

V4.02.R12.00006510.10010.140300, BuildTime: 2015-09-10 10:20:36

One can see available users and permissions with user -a, even passwords are shown:

{
   "Groups" : [
      {
         "AuthorityList" : [
            "ShutDown",
            "ChannelTitle",
            "RecordConfig",
            "Backup",
            "StorageManager",
            "Account",
            "SysInfo",
            "QueryLog",
            "DelLog",
            "SysUpgrade",
            "AutoMaintain",
            "GeneralConfig",
            "TourConfig",
            "TVadjustConfig",
            "EncodeConfig",
            "CommConfig",
            "NetConfig",
            "AlarmConfig",
            "VideoConfig",
            "PtzConfig",
            "PTZControl",
            "DefaultConfig",
            "Talk_01",
            "IPCCamera",
            "ImExport",
            "Monitor_01",
            "Replay_01"
         ],
         "Memo" : "administrator group",
         "Name" : "admin"
      },
      {
         "AuthorityList" : [ "Monitor_01", "Replay_01" ],
         "Memo" : "user group",
         "Name" : "user"
      }
   ],
   "Users" : [
      {
         "AuthorityList" : [
            "ShutDown",
            "ChannelTitle",
            "RecordConfig",
            "Backup",
            "StorageManager",
            "Account",
            "SysInfo",
            "QueryLog",
            "DelLog",
            "SysUpgrade",
            "AutoMaintain",
            "GeneralConfig",
            "TourConfig",
            "TVadjustConfig",
            "EncodeConfig",
            "CommConfig",
            "NetConfig",
            "AlarmConfig",
            "VideoConfig",
            "PtzConfig",
            "PTZControl",
            "DefaultConfig",
            "Talk_01",
            "IPCCamera",
            "ImExport",
            "Monitor_01",
            "Replay_01"
         ],
         "Group" : "admin",
         "Memo" : "admin 's account",
         "Name" : "admin",
         "NoMD5" : null,
         "Password" : "tlJwpbo6",
         "Reserved" : true,
         "Sharable" : true
      },
      {
         "AuthorityList" : [ "Monitor_01" ],
         "Group" : "user",
         "Memo" : "default account",
         "Name" : "default",
         "NoMD5" : null,
         "Password" : "OxhlwSG8",
         "Reserved" : false,
         "Sharable" : false
      }
   ]
}

In order to play a video stream (Stream 0, 1280x720, 15 fps):

vlc rtsp://192.168.1.17:554/user=admin_password=tlJwpbo6_channel=1_stream=0.sdp?real_stream

or (Stream 1, 704x576, 25 fps):

vlc rtsp://192.168.1.17:554/user=admin_password=tlJwpbo6_channel=1_stream=1.sdp?real_stream

The camera seems to be based on a Hisilicon Hi3518E.pdf SoC (ARM9 with H.264/MJPEG). Hacking already done, seems easys to get serial. buildroot is available...

Telnet password for root is: xmhdipc Here we go:

# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000

posted at: 22:58 | path: /configuration | permanent link