Mission Accomplished: Shell Escape via Firmware Modification - Hikvision Security Camera

WE DID IT!!!! Finally got an unrestricted root shell by modifying one of the commands allowed from the jail.

BGA reballing video:
https://youtu.be/3DwPczusjOY

IoT Pentesting Certification from TCM:
https://certifications.tcm-sec.com/pipa/?ref=160

Need IoT pentesting services?
Please consider Brown Fine Security:
https://brownfinesecurity.com/

Come join us on Discord for some device hacking!
https://discord.gg/GjVxUnrQKC

🛠️ Stuff I Use 🛠️

🪛 Tools:
Raspberry PI Pico: https://amzn.to/3XVMS3K
XGecu Universal Programmer: https://amzn.to/4dIhNWy
Multimeter: https://amzn.to/4b9cUUG
Power Supply: https://amzn.to/3QBNSpb
Oscilloscope: https://amzn.to/3UzoAZM
Logic Analyzer: https://amzn.to/4a9IfFu
USB UART Adapter: https://amzn.to/4h4G7DD
iFixit Toolkit: https://amzn.to/44tTjMB

🫠 Soldering & Hot Air Rework Tools:
Soldering Station: https://amzn.to/4dygJEv
Microsoldering Pencil: https://amzn.to/4dxPHwY
Microsoldering Tips: https://amzn.to/3QyKhrT
Rework Station: https://amzn.to/3JOPV5x
Air Extraction: https://amzn.to/3QB28yx

🔬 Microscope Setup:
Microscope: https://amzn.to/4abMMao
Microscope 0.7X Lens: https://amzn.to/3wrV1S8
Microscope LED Ring Light: https://amzn.to/4btqiTm
Microscope Camera: https://amzn.to/3QXSXsb

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:
website: https://brownfinesecurity.com/
X: https://x.com/nmatt0
linkedin: https://www.linkedin.com/in/mattbrwn/
github: https://github.com/nmatt0/

#hacking #iot #cybersecurity