Crosstour CT7000 RTSP WiFi
I recently purchased a small "action camera" because it was quite cheap and thought it might be fun or useful during cycling. I didn't realise from the Amazon description (although looking at it again, I really should have), but it has WiFi, which I accidentally discovered while holding down a button as I was trying to turn it off. Checking the manual, this can be controlled using an Android app called "iSmart DV". That's not really very fun though, so I connected from my laptop.
It hosts a wireless network called "ActionCam", and can be connected to with the password "134567890". The camera takes the address 192.168.10.1 and assigns 192.168.10.10 to the connecting host. Unsurprisingly nmap informs me that the camera listens on 554, which is rtsp, but trying to connect via VLC was unsuccessful. Fortunately, we can figure that kind of thing out quite easily by downloading an APK and extracting it as if it were a zip.
[aaron@gromit ismartdv]$ grep -R 192.168.1.1
Binary file res/raw/sphost.BRN matches
Binary file res/layout/activity_test.xml matches
Binary file classes2.dex matches
[aaron@gromit ismartdv]$ strings res/raw/sphost.BRN | grep 192.168
rtsp://192.168.1.1/h264
rtsp://192.168.1.1/mjpg
192.168.0.1
192.168.1.1
192.168.1.10
dhcpd # using default settings: 192.168.1.1 192.168.1.10 10
Easy! Interestingly, the x264 encoded stream doesn't work on this camera, but the MJPEG stream seems to work fine. There does not appear to be away to change the password or to get the camera to connect to an access point.
The quality is not great either as shown with this unedited image of my garden.
<2019-09-07 Sat 13:45> I took the camera out for a ride and made a time lapse with the footage.
Related posts:
Wanting to leave a comment?
Comments and feedback are welcome by email (aaron@nospam-aaronsplace.co.uk).