Awaab Kheiri | Cybersecurity Researcher

Hardware Security Assessment: $10 IoT Camera Firmware Analysis

Tue, 15 Sep 2026 15:15:00 +0000

TL;DR

Find Part 1 of the series and Part 2 of the series

I got the appropriate tools to dump the camera’s firmware directly from the camera’s flash chip. I managed to get it off, and now I have a complete “copy” of the device’s firmware to analyze.

When examining the firmware, a number of important features were discovered. Firstly, unlike what I thought, RTSP was not disabled, it is active and available. Stream credentials were found in a configuration file in the firmware image.

Dynamic Analysis of njRAT v0.6.4

Thu, 02 Jul 2026 13:06:00 +0000

Introduction

Following the static analysis of the sample, I came up with a few findings that needed confirmation, as well as, some things that are either contradicting or weird that needed further clarification. In this post I will try to clarify/confirm these things through dynamic analysis.

Main Findings

From the static analysis I gathered some clues and made the following hypothesis;

The main exe is only a dropper and not the actual payload/malicious software.
The presence of the malware is unknown to the user since ShowInTaskBar is set to false and the opacity of the window is set to 0.0.
Conflicting manifests suggest that one of them (the default) is used as a decoy or a means to escalate privileges.
Uses TCP Client to communicate and possibly exfiltrate data to the C2 server.
Uses camera and microphone
Makes changes to the registry for persistence
Makes configuration changes to the firewall
zaaptoo C2 server

The main goal of this paper is to go through my setup, the problems faced, the tools I used and finally confirm the above hypothesis through dynamic analysis.

Static Analysis of njRAT v0.6.4

Mon, 29 Jun 2026 10:41:00 +0000

Introduction

The njRAT is a RAT which was seen for the first time in 2012 and has since been linked to a developer referred to as njq8. njRAT has been popularly used in targeted campaigns in the Middle East and North Africa region and stands out due to the wide variety of capabilities that it possesses, such as keylogging, credential theft, remote shells, and camera spying. In this paper, I perform a static analysis of njRAT version 0.6.4 which is hosted in the theZoo malware repository. The analysis involves the examination of sample ID, execution, persistence, capabilities, encryption techniques, and attribution.

Hardware Security Assessment: $10 IoT Camera Network Analysis

Mon, 13 Apr 2026 08:44:00 +0000

WhatsApp Image 2026-04-14 at 12.29.40

Introduction

After being stalled by a faulty RX pin on the UART interface in a prior hardware-level analysis, I turned to the network layer. This latter effort is focused on capturing and decoding the packets of data sent to and from the camera to determine the underlying tech stack and possible entry points.

Methodology

Since the hardware interface proved to be not so reliable, I resorted to a wireless traffic analysis. The camera will act as a local Access Point (AP), and it can be hardwired to the device and a smartphone app. I took advantage of this network of ad-hoc that I was at the center of communication channel.

Hardware Security Assessment: $10 IoT Camera UART Extraction & Firmware Analysis

Sun, 12 Apr 2026 22:36:00 +0000

WhatsApp Image 2026-04-12 at 18.58.26

Target

The Target is a $10 IoT security camera. The camera has many features like remote microphone, infrared (night vision), saving footage to an internal SD card, a companion mobile application, panning and tilting. This many features in such a cheap device could be home to a large attack surface, anything from video feed capture to microphone eavesdropping. Additionally, low cost-focused devices such as this most likely call home and/or have unencrypted video and audio data transmission.

Simple Encryptor HTB Challenge

Fri, 06 Mar 2026 21:45:00 +0000

Simple Encryptor Cover

Reconnaissance

The unzipped folder contains 2 files. “encrypt” and “flag.enc”. I started by running the standard commands to learn more about the files.

code

someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ cat flag.enc
Z5�b�>�����u���9�K�!�C#qe�'K%

code

someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ file flag.enc
flag.enc: data

code

someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ file encrypt
encrypt: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0bddc0a794eca6f6e2e9dac0b6190b62f07c4c75, for GNU/Linux 3.2.0, not stripped

code

someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ strings encrypt
/lib64/ld-linux-x86-64.so.2
libc.so.6
srand
fopen
ftell
time
__stack_chk_fail
fseek
fclose
malloc
fwrite
fread
__cxa_finalize
__libc_start_main
GLIBC_2.4
GLIBC_2.2.5
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
u+UH
dH3<%(
[]A\A]A^A_
flag
flag.enc
:*3$"
GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.8061
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
encrypt.c
__FRAME_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
fread@@GLIBC_2.2.5
_edata
fclose@@GLIBC_2.2.5
__stack_chk_fail@@GLIBC_2.4
__libc_start_main@@GLIBC_2.2.5
srand@@GLIBC_2.2.5
__data_start
ftell@@GLIBC_2.2.5
__gmon_start__
__dso_handle
_IO_stdin_used
time@@GLIBC_2.2.5
__libc_csu_init
malloc@@GLIBC_2.2.5
fseek@@GLIBC_2.2.5
__bss_start
main
fopen@@GLIBC_2.2.5
fwrite@@GLIBC_2.2.5
__TMC_END__
_ITM_registerTMCloneTable
__cxa_finalize@@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.plt.sec
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.data
.bss
.comment

code

someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ chmod +x encrypt
someone@someone:~/HTB/ReverseEngineering/simple/rev_simpleencryptor$ ./encrypt

Nothing special there, although I realized that there is the word flag and flag.enc, so I changed the file name to flag and it outputted another file called flag.enc with different content.

HackTheBox -- Pterodactyl (MEDIUM) Experience

Wed, 04 Mar 2026 13:06:00 +0000

Introduction

This write‑up contains spoilers for the entire user flag.

This is my second time attempting a medium-difficulty machine on Hack The Box. Before starting, I searched for write-ups and passed one of them to Claude, instructing it not to reveal any solutions and only give hints when requested. From there, I worked through the machine step by step, using the hints and my own analysis to reach the user flag.

ZTE ZXHN H298A Home Gateway – Hardware Recon & Boot Process Analysis

Mon, 02 Feb 2026 08:46:00 +0000

Introduction

The target device is ZTE ZXHN H298A Home Gateway, a commercial router commonly provided by ISPs. This post highlights how I got physical access of the router, found and interface UART and finally analyzed the boot process. I have not performed any type of exploitation or code execution yet.

Enclosure Router

Objectives

Gain physical access to the PCB
Identify exposed UART interface
Identify UART pads and interface with its console
Analyze boot process and identify attack surfaces

Threat Model

Attacker Capabilities

Physical access to the device
Ability to disasemble the enclosure and access the PCB
Ability to interface with exposed debug interfaces
Tooling limited to low cost;
- USB-to-TTL adapter
- Generic Saleae Logic Analyzer
- Soldering Iron

Assests of Interest

UART console access level
Bootloader interaction capabilities
Firmware and filesystem access
Credentials or configuration data
Debug interfaces left exposed in production

Methodology

Device Teardown

The enclosure could be popped open and the PCB could simply unscrews from the enclosure. I have not taken any destructive measures to get physical access to the PCB. I then visually inspected the PCB for 4 exposed test points, headers and unpopulated pads.

PCB inside the enclosure

Reverse Engineering Challenge: Silent Oracle

Fri, 05 Dec 2025 16:00:00 +0000

Overview

This reverse-engineering challenge was part of the Neurogrid CTF hosted by HTB.

The task included a Docker instance and a local source file mirroring the remote service (chall). Running it displayed an ASCII witch and prompted for an unknown input string. Any incorrect input produced a failure message.

The initial objective was simple: determine the exact string the program expected and check whether submitting it would reveal a flag.

HackTheBox -- Imagery (MEDIUM) Experience

Sat, 15 Nov 2025 16:00:00 +0000

ImageryCard

Intro

This write‑up contains spoilers for the entire user flag.

This was my first time attempting a medium-difficulty machine on Hack The Box. Before starting, I searched for write-ups and passed one of them to an AI assistant, instructing it not to reveal any solutions and only give hints when requested. From there, I worked through the machine step by step, using the hints and my own analysis to reach the final root.

HackTheBox -- Soulmate (Easy) Experience

Mon, 22 Sep 2025 00:00:00 +0000

Reconnaissance

I started with enumerating the network using nmap.

bash

nmap -sC -sV -oA nmap/nmap 10.10.11.86

This is the output of nmap

bash
Starting Nmap 7.97 ( https://nmap.org ) at 2025-09-22 00:42 +0000
Nmap scan report for 10.10.11.86
Host is up (0.20s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soulmate.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.99 seconds

I gather that this is a web app running on port 80 and I need to add it to my /etc/hosts file.

HackTheBox -- Code (EASY) Experience

Sat, 26 Apr 2025 04:00:00 +0000

HTB Code

Reconnaissance

As usual we begin with the nmap scan.

nmap -sC -sV -oA scan 10.10.XX.XX

This nets us the following output;

code

Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-26 07:39 EDT
Nmap scan report for 10.10.11.62
Host is up (0.18s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)
| 256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)
|_ 256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)
5000/tcp open http Gunicorn 20.0.4
|_http-title: Python Code Editor
|_http-server-header: gunicorn/20.0.4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.44 seconds

From this I could see that there is ssh running as usual but then there is this service I have never seen before running on port 5000 Gunicorn version 20.0.4. I’ll take note of that. Navigating to http://10.10.XX.XX:5000 we are greeted with a python editor, immediately the first thing that came to mind was some sort of code execution using the code editor.

Simple Physics Simulation: Humble Beginnings

Mon, 30 Dec 2024 00:19:00 +0000

Introduction

As I am continuing my C endeavors, I have started working on a simple physics simulation. The main idea of the project is to simulate particles; as I want this project to simulate what happens in real life when you suspend some particles in the air and then letting go of them and observing what happens - the collisions between the particles and the walls etc.

The Project So Far

The project currently only displays a rectangle on the screen. Which then a simple algorithm generates a circle from the square.

Resume

Mon, 01 Jan 0001 00:00:00 +0000