DEF CON 33 - Never enough about cameras: Firmware keys hidden under the rug - Alexandru Lazar

The video details how to exploit firmware vulnerabilities in Dahua (DHA) security cameras to achieve code execution, highlighting insecure default configurations and weak authentication. A key goal is demonstrating that these devices can be compromised via buffer overflows and improper parsing, enabling remote code execution without requiring full system access.

Key Takeaways:
• Firmware extraction from DHA devices via website or flash chip reading 1:49
• File system decryption using AES-256-CBC with hardcoded key derivation and IV generation 5:36
• Stack-based buffer overflow in HTTP RPC2 handler due to incorrect string length checks 15:16
• Exploitation via memory overwrite of session structure to redirect cleanup function to system call 16:47
• Use of TFTP and LD preload to load custom libraries and achieve root shell 18:48
• Stack overflow in IPv6 host header parsing with a custom gadget that writes payload to BSS section 21:08

The researchers successfully achieved remote code execution on multiple DHA devices using a combination of reverse engineering, buffer overflow, and privilege escalation techniques, with the vendor promptly responding and releasing affected device lists.

Sources:

• 1:49 Firmware extraction methods for DHA devices
• 5:36 AES-256-CBC decryption process and key derivation
• 15:16 HTTP RPC2 buffer overflow vulnerability
• 16:47 Session structure overwrite and system call injec