Accessing the Linux Filesystem on a Chuango IP116 (sonix-00B027089014) security camera
I recently took apart an old security camera I had laying around only to find that it has a serial port inside. Being intrigued by this I hooked up an FTDI serial breakout board to the first of the two serial interfaces. It's a 3.3V serial interface running at 115200 baud.
Fortunately, Chuango haven't locked down the serial interface and after the system's done initializing, we can log in as root. To get the root password, I dumped the 16MB of flash memory and looked at the data which turned out to be JFFS2 partitions.
Having mounted those I got access to the linux file structure. To get the root password I used John The Ripper on the MD5 hash found in /root/etc_default/shadow. After less than a second the program spat out the root password.
Rather underwhelmingly, it's "1234".
Anyway, if you want to tinker with your security camera, there's your password. I couldn't find it anywhere else on the internet so I decided to upload it here. Thanks for reading!