Hiding Behind a CCTV - Turning a Hikvision RCE into a Covert Network Proxy
In this blog, I’ll show how a single unauthenticated vulnerability in a Hikvision CCTV camera gave me not just a root shell on the device, but a covert network proxy, routing my traffic through the camera so every packet appeared to come from a surveillance device instead of my machine. Prologue “Quis custodiet ipsos custodes?” (Who watches the watchmen?) - Juvenal A CCTV camera’s entire purpose is to watch. It records everything in its field of view, day and night, trusting that nobody will turn the lens around. But nobody watches the watcher. Behind the lens is a computer, an embedded Linux system, with its own processor, its own network stack, and its own firmware. If that firmware carries an unpatched vulnerability, the device built to expose intruders becomes the perfect place to hide. ...