tonilopezmr / tonilopezmr.github.io

My web portfolio.
https://tonilopezmr-github-io.vercel.app
Other
4 stars 1 forks source link

Hacking Ip wifi cameras #41

Open tonilopezmr opened 5 years ago

tonilopezmr commented 5 years ago

Ansteker wifi camera

Amazon link

Take screenshot: http://192.168.10.1/media/?action=snapshot

Stream over http: http://192.168.10.1/media/?action=stream (very slow)

Change Brightness values from 0 to 10: http://192.168.10.1/media/?action=cmd&code=6&value=

Change contrast value from 0 to 10: http://192.168.10.1/media/?action=cmd&code=5&value=```

IPCam /media/ commands

Call format:

"http://192.168.10.1:80/media/?action=cmd&code=' + ID + '&value=' + arg + "&user=admin&pwd="

Commands

Command ID Caller name Arguments
1 pzt_up
2 pzt_down
3 pzt_left
4 pzt_right
5 pzt_upright
6 pzt_upleft
7 pzt_downright
8 pzt_downleft
9 pzt_loop_lr
10 pzt_loop_ud
11 pzt_loop_both
12 ptz_gotopos vlu: non-empty string
13 ptz_gotopreset vlu: non-empty string
14 imagesize_cmd_mj vlu: ?? Passed directly.
15 fps_cmd_mj vlu: ?? Passed directly.
255 wifi_rescan 0
dev_reboot 255

Get cameras

Get cameras: http://192.168.1.131/dev_finder.cgi?cmd=list&cid=9991

Change configuration

POST /goform/addStaProfile HTTP/1.1
Host: 192.168.10.1
Content-Length: 117
Cache-Control: max-age=0
Authorization: Basic YWRtaW46
Origin: http://192.168.10.1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://192.168.10.1/station/add_profile_page.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive

profile_name=PROF001&Ssid=MIWIFI_2G_Umaq&network_type=1&channel=10&security_infra_mode=7&cipher=0&passphrase=somepassword

Body summary:

profile_name    PROF001
Ssid    MIWIFI_2G_Umaq
network_type    1
channel 10
security_infra_mode 7
cipher  0
passphrase  somepassword

Change device name

POST /goform/cfgLan HTTP/1.1
Host: 192.168.1.131
Content-Length: 45
Cache-Control: max-age=0
Authorization: Basic YWRtaW46
Origin: http://192.168.1.131
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://192.168.1.131/lan_cfg.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: remember_token_P80=toni|720dc2f41eb5b9c5ab15ae8a4e862d631a21c6f0; session_P80=.eJx9jE0LgjAYgP9KvGeJSDs08LYUDxuYRrTLsLZ0Q1fs46Dif486eer8fMzAn1a6DpC3QUbAlQA0w-YOCGh-OZB9ETN9m5guEoqFpvUppvV5IJjsyEAShtuY4TKFJQIlpPHKj9sm-I778S0BmdD3K7K6i_wYmjL9lcFJy_8wJ51TL7POH1pMlcnwFWdV037V5QMRSUFA.XIghuA.96Ff3i5m4iYwIca-l7OX6uWbEmw
Connection: keep-alive

hostname=tonicamera&chklan_dhcp=on&webPort=80

File /video/cmd_req.asp

<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>cmd</title>
</head>

<script language="JavaScript" type="text/javascript">

var b_init = 0;
var cam_addr = "(local)";
var cam_port = 80;
var cam_usr = "";
var cam_pwd = "";

function init_comp() {
    b_init = 1;
}

function media_cmd(code, vlu) {
    if (b_init == 0) return;

    if (cam_addr.length == 0)
        return;
    else if (cam_addr == "(local)")
        cmd_req.location = '/media/?action=cmd&code=' + code + '&value=' + vlu;
    else
        cmd_req.location = 'http://' + cam_addr + ':' + cam_port + '/media/?action=cmd&code=' + code + '&value=' + vlu + "&user=" + cam_usr + "&pwd=" + cam_pwd;
}

function cgi_cmd(url) {
    if (b_init == 0) return;

    if (cam_addr.length == 0)
        return;
    else if (cam_addr == "(local)")
        cmd_req.location = url;
    else
        cmd_req.location = 'http://' + cam_addr + ':' + cam_port + url + "&user=" + cam_usr + "&pwd=" + cam_pwd;
}

function cmd_req_setcam(adr, prt, usr, pwd) {
    cam_addr = adr;
    cam_port = prt;
    cam_usr = usr;
    cam_pwd = pwd;
}

function pzt_speed(vlu) {
    cgi_cmd('/set_misc.cgi?ptz_patrol_rate=' + vlu );
}

function stream_cam_contrl_cgi(prm, vlu)
{
    cgi_cmd('/camera_control.cgi?param=' + prm + '&value=' + vlu);
}

function stream_mode(vlu) {
    stream_cam_contrl_cgi('6', vlu);
}
function stream_bitrate(vlu) {
    stream_cam_contrl_cgi('7', vlu);
}
function mj_bitrate(vlu) {
    stream_cam_contrl_cgi('8', vlu);
}

function pzt_start(vlu)
{
    media_cmd('2', vlu);
}
function pzt_stop(vlu)
{
    media_cmd('3', vlu);
}
function pzt_up(isrun)
{
    if ( isrun == 1)
        pzt_start('1');
    else
        pzt_stop('1');
}
function pzt_down(isrun)
{
    if ( isrun == 1)
        pzt_start('2');
    else
        pzt_stop('2');
}
function pzt_left(isrun)
{
    if ( isrun == 1)
        pzt_start('3');
    else
        pzt_stop('3');
}
function pzt_right(isrun)
{
    if ( isrun == 1)
        pzt_start('4');
    else
        pzt_stop('4');
}
function pzt_upleft(isrun) {
    if (isrun == 1)
        pzt_start('6');
    else
        pzt_stop('6');
}
function pzt_upright(isrun) {
    if (isrun == 1)
        pzt_start('5');
    else
        pzt_stop('5');
}
function pzt_downleft(isrun) {
    if (isrun == 1)
        pzt_start('8');
    else
        pzt_stop('8');
}
function pzt_downright(isrun) {
    if (isrun == 1)
        pzt_start('7');
    else
        pzt_stop('7');
}
function pzt_loop_ud(isrun)
{
    if ( isrun == 1)
        pzt_start('10');
    else
        pzt_stop('10');
}
function pzt_loop_lr(isrun)
{
    if ( isrun == 1)
        pzt_start('9');
    else
        pzt_stop('9');
}
function pzt_loop_both(isrun)
{
    if ( isrun == 1)
        pzt_start('11');
    else
        pzt_stop('11');
}

function contrast_cmd(vlu)
{
    media_cmd('5', vlu);
}

function brightness_cmd(vlu)
{
    media_cmd('6', vlu);
}

function imagesize_cmd(vlu)
{
    media_cmd('7', vlu);
}
function imagesize_cmd_mj(vlu)
{
    media_cmd('14', vlu);
}

function fps_cmd(vlu)
{
    media_cmd('8', vlu);
}
function fps_cmd_mj(vlu)
{
    media_cmd('15', vlu);
}

function img_fh(vlu) {
    if (vlu == true)
        media_cmd('9', 12);
    else if(vlu == false)
        media_cmd('9', 11);
    else 
        media_cmd('9', vlu);
}

function img_fv(vlu) {
    if (vlu == true)
        media_cmd('9', 22);
    else if ( vlu == false)
        media_cmd('9', 21);
    else 
        media_cmd('9', vlu);
}

function ptz_savepos(vlu) {
    if ( isNaN(vlu) || vlu.toString().length == 0) return ;
    media_cmd('11', vlu);
}

function ptz_gotopos(vlu) {
    if ( isNaN(vlu) || vlu.toString().length == 0) return ;
    media_cmd('12', vlu);
}
function ptz_gotopreset(vlu) {
    if ( isNaN(vlu) || vlu.toString().length == 0) return ;
    media_cmd('13', vlu);
}

function imagesize_mj_cmd(vlu)
{
    media_cmd('7', vlu);
}

function wifi_rescan() {
    media_cmd('255', '0');
}

function wifi_funset(autorbt) {
        cgi_cmd('/set_wifi_fun.cgi?wifi_autorbt='+ autorbt);
}

function dev_reboot() {
    media_cmd('255', '255');
//    alert('Reboot');
}

</script>

<body >
<iframe name="cmd_req" style="display:none"></iframe>
</body>

</html>

######## Multi camera File

<html>
<head>

<!-- CSS -->
<link rel="stylesheet" href="/css/style_blk.css" type="text/css"/>
<script type="text/javascript" src="/lang/b28n.js"></script>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<title>Camera Config</title>
<style type="text/css">
.ipc_name
{
    margin-left:20px;
    margin-top:5px;
    margin-bottom:5px;
    width:120px;
}
</style>
<script language="JavaScript" type="text/javascript">

Butterlate.setTextDomain("video");

var ipaddr_port = _("ipaddr_port");
var user_pwd = _("user_pwd");
var str_del = _("delete");
var curr_cam = -1;

function initTranslation()
{
    var e = document.getElementById("p_title");
    e.innerHTML = _("multi_cam_cfg");

    e = document.getElementById("cam1_local");
    e.innerHTML = _("cam1_local");
    e = document.getElementById("cam2");
    e.innerHTML = _("cam2");
    e = document.getElementById("cam3");
    e.innerHTML = _("cam3");
    e = document.getElementById("cam4");
    e.innerHTML = _("cam4");
    e = document.getElementById("cam5");
    e.innerHTML = _("cam5");
    e = document.getElementById("cam6");
    e.innerHTML = _("cam6");
    e = document.getElementById("cam7");
    e.innerHTML = _("cam7");
    e = document.getElementById("cam8");
    e.innerHTML = _("cam8");
    e = document.getElementById("cam9");
    e.innerHTML = _("cam9");

    e = document.getElementById("ali_2");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_3");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_4");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_5");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_6");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_7");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_8");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");
    e = document.getElementById("ali_9");
    e.innerHTML = "&nbsp;&nbsp;" + _("alias");

    e = document.getElementById("dev_lst_lan");
    e.innerHTML = _("dev_lst_lan");

    e = document.getElementById("btn_save");
    e.value = _("btn_save");
    e = document.getElementById("btn_cancel");
    e.value = _("btn_cancel");
    e = document.getElementById("btn_scan");
    e.value = _("btn_scan");
    e = document.getElementById("btn_Addto");
    e.value = _("btn_Addto");

}

function checkRange(str, min, max) {
    if (isNaN(str))
        return false;

    d = parseInt(str, 10);
    if (d > max || d < min) {
        return false;
    }
    return true;
}

function checkinput_port(inp) {
    if (!checkRange(inp.value, 1, 32767)) {
        alert('Port format error.');
        inp.focus();
        return false;
    }
    return true;
}

function CheckValue(){
/*
    if (document.mcamCfg.cam_adr1.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt1) )
            return false;
    }

    if (document.mcamCfg.cam_adr2.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt2) )
            return false;
    }
    if (document.mcamCfg.cam_adr3.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt3))
            return false;
    }
    if (document.mcamCfg.cam_adr4.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt4))
            return false;
    }
    if (document.mcamCfg.cam_adr5.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt5))
            return false;
    }
    if (document.mcamCfg.cam_adr6.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt6))
            return false;
    }
    if (document.mcamCfg.cam_adr7.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt7))
            return false;
    }
    if (document.mcamCfg.cam_adr8.value.length > 0) {
        if (!checkinput_port(document.mcamCfg.cam_prt8))
            return false;
    }
    */
    for ( i = 1; i < 9; ++ i )
    {
        if ( document.getElementById("cam_nam" + i).value.length == 0 && document.getElementsByName("cam_adr" + i)[0].value.length > 1 )
            document.getElementById("cam_nam" + i).value = document.getElementsByName("cam_adr" + i)[0].value
    }
    return true;
}

function del_set(idx) {
    var nm = "cam_adr" + idx;
    document.getElementsByName(nm)[0].value = "";
    /*
    nm = "cam_prt" + idx;
    document.getElementsByName(nm)[0].value = "";
    */
    nm = "cam_usr" + idx;
    document.getElementsByName(nm)[0].value = "";
    nm = "cam_pwd" + idx;
    document.getElementsByName(nm)[0].value = "";
    nm = "cam_nam" + idx;
    document.getElementsByName(nm)[0].value = "";
}

function show_cam(idx)
{

    if ( curr_cam > 0 )
    {
        document.getElementById("cam_cfga" + curr_cam ).style.display="none";
        document.getElementById("cam_cfgb" + curr_cam ).style.display="none";
    }

    if ( document.getElementById("cam_cfga" + idx).style.display=='' )
    {
        document.getElementById("cam_cfga" + idx).style.display='none';
        document.getElementById("cam_cfgb" + idx).style.display='none';
    }
    else
    {
        document.getElementById("cam_cfga" + idx).style.display='';
        document.getElementById("cam_cfgb" + idx).style.display='';
    }
    curr_cam = idx;
}

function makeRequest(url, islst) {
    var http_request = false;
    if (window.XMLHttpRequest) { // Mozilla, Safari,...
        http_request = new XMLHttpRequest();
        if (http_request.overrideMimeType) {
            http_request.overrideMimeType('text/xml');
        }
    } else if (window.ActiveXObject) { // IE
        try {
            http_request = new ActiveXObject("Msxml2.XMLHTTP");
        } catch (e) {
            try {
            http_request = new ActiveXObject("Microsoft.XMLHTTP");
            } catch (e) {}
        }
    }
    if (!http_request) {
        alert('Giving up :( Cannot create an XMLHTTP instance');
        return false;
    }
    //http_request.onreadystatechange = alertContents;
    http_request.open('GET', url, false);
    http_request.send(null);
    if ( islst )
    {
        //alert("Call URL" + url + " Res " + http_request.status + " Txt:" + http_request.responseText)
        if(http_request.status==200) { 
              var lst = http_request.responseText;
              SetDevFinderList(lst);
        }
    }
}

var dev_lst_rec = new Array();
function SetDevFinderList(lst)
{
    var dvlst = document.getElementById("lst_dev");
    var itms = new Array();

    dev_lst_rec = lst.split('\n');
    dvlst.options.length = 0;

    //alert("Find List " + lst + " Rec " + dev_lst_rec.length);

    for ( i =0; i < dev_lst_rec.length; ++ i )
    {
        itms = dev_lst_rec[i].split(";");

        if ( itms.length > 2 )
        {
            var itm = new Option(itms[0] + "(" + itms[1] + ":" + itms[2] + ")", i);
            dvlst.options.add(itm);
        }
    }
}

function DevFinderReadList()
{
    document.getElementById("btn_scan").disabled="";
    makeRequest("/dev_finder.cgi?cmd=list&cid="+ parseInt(1000000*Math.random()), true);
}

function DevFinderRefresh()
{
    document.getElementById("btn_scan").disabled="disabled";
    setTimeout("DevFinderReadList()", 4000);
    makeRequest("/dev_finder.cgi?cmd=scan&cid=" + parseInt(1000000*Math.random()), false);
}

function select_finder_rec()
{
    var i = document.getElementById("lst_dev").value;
    if ( i < 0 || i >= dev_lst_rec.length ) return ;
    if ( curr_cam < 1 || curr_cam >8 ) return ;
    if ( dev_lst_rec[i]== null )  return ;
    itms = dev_lst_rec[i].split(";");
    if ( itms.length < 2 ) return ;

    var nm = "cam_adr" + curr_cam;

    if ( document.getElementsByName(nm)[0].value.length >1 ) return ;

    document.getElementsByName(nm)[0].value = itms[1] + ":" + itms[2];
    /*nm = "cam_prt" + curr_cam;
    document.getElementsByName(nm)[0].value = itms[2];
    */
    nm = "cam_nam" + curr_cam;
    document.getElementsByName(nm)[0].value = itms[0];
}

function PageInit()
{
    initTranslation();

    var cmbdev = document.getElementById("sel_Cam");
    var itm = new Option(_("cam2"),1); 
    cmbdev.options.add(itm);
    itm = new Option(_("cam3"),2); 
    cmbdev.options.add(itm);
    itm = new Option(_("cam4"),3); 
    cmbdev.options.add(itm);
    itm = new Option(_("cam5"),4); 
    cmbdev.options.add(itm);
    itm = new Option(_("cam6"),5); 
    cmbdev.options.add(itm);
    itm = new Option(_("cam7"),6);
    cmbdev.options.add(itm);
    itm = new Option(_("cam8"),7);
    cmbdev.options.add(itm);
    itm = new Option(_("cam9"),8);
    cmbdev.options.add(itm);
    cmbdev.value = 1;

    DevFinderRefresh();
}

function DevAddTo()
{
    var cmbdev = document.getElementById("sel_Cam");
    if ( cmbdev.value == null ) return ;

    show_cam(cmbdev.value);
    select_finder_rec();
}

</script>

</head>

<body onload="PageInit()">

    <!-- Content box onload="checkStreamMode();"-->
    <div id="content-box">
        <div id="content-box-in">

            <!-- Content left -->
            <div id="content-box-in-all">
                <div id="content-box-in-left-in">

                    <div id="frame_block">
                    <h3 id="p_title">Multi camera monitor configuration&hellip;</h3>
                     <center>
                     <form method="post" name="mcamCfg" action="/goform/formSetMultiCamCfg" onsubmit="return CheckValue()">
                        <table width="700" border="0" cellpadding="2" cellspacing="1">
                            <tr>
                              <td class="subpart"id="dev_lst_lan" >Device List in LAN</td>
                              <td class="subpart" width="420" >
                                  <select id="lst_dev" name="lstDevRec" size="4" style="width: 360px; height: 90px">
                                  </select>
                                  <br />
                                  <input type="button" style="width:100px;" value="Scan" id="btn_scan" onclick="DevFinderRefresh();" />
                                  <input type="button" style="width:100px;" value="AddTo" id="btn_Addto" onclick="DevAddTo();" />
                                  <select id="sel_Cam" name="SelCam" style="width:120px;"></select>
                              </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" id="cam1_local" >Camera 1 [local camera]</td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" ><a href="#" onclick="show_cam(1)" id="cam2" > Camera 2 </a> <span id="ali_2">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam1" name="cam_nam1" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga1" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr1" value=":" maxlength="120" />                                 
                                </td>
                            </tr>
                            <tr id="cam_cfgb1" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr1" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd1" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(1);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>

                            <tr>
                              <td class="subpart" colspan="2"><a href="#" onclick="show_cam(2)" id="cam3">Camera 3 </a> <span id="ali_3">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam2" name="cam_nam2" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga2" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr2" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb2" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr2" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd2" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(2);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" ><a href="#" onclick="show_cam(3)" id="cam4"> Camera 4 </a> <span id="ali_4">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam3" name="cam_nam3" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga3" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr3" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb3" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr3" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd3" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(3);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" ><a href="#" onclick="show_cam(4)" id="cam5"> Camera 5 </a> <span id="ali_5">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam4" name="cam_nam4" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga4" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr4" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb4" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr4" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd4" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(4);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" ><a href="#" onclick="show_cam(5)" id="cam6"> Camera 6 </a> <span id="ali_6">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam5" name="cam_nam5" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga5" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr5" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb5" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr5" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd5" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(5);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2" ><a href="#" onclick="show_cam(6)" id="cam7"> Camera 7 </a> <span id="ali_7">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam6" name="cam_nam6" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga6" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr6" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb6" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr6" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd6" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(6);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2"><a href="#" onclick="show_cam(7)" id="cam8" > Camera 8</a> <span id="ali_8">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam7" name="cam_nam7" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga7" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr7" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb7" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr7" value="" maxlength="120">   
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd7" value="" type="password" maxlength="12">      
                                 <button onclick="del_set(7);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>
                            <tr>
                              <td class="subpart" colspan="2"><a href="#" onclick="show_cam(8)" id="cam9" > Camera 9</a> <span id="ali_9">&nbsp;&nbsp;</span>: <input class="ipc_name" id="cam_nam8" name="cam_nam8" type="text" maxlength="20" value="" /> </td>
                            </tr>
                            <tr id="cam_cfga8" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(ipaddr_port)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:320px;" name="cam_adr8" value=":" maxlength="120">  
                                </td>
                            </tr>
                            <tr id="cam_cfgb8" style="display:none">
                              <td class="head"><script type="text/javascript">document.write(user_pwd)</script></td>
                              <td>&nbsp;&nbsp;
                                <input style="width:150px;" name="cam_usr8" value="" maxlength="120"/>  
                                    &nbsp;: &nbsp;
                                 <input style="width:150px;" name="cam_pwd8" value="" type="password" maxlength="12"/>     
                                 <button onclick="del_set(8);" type="button" style="width:80;"><script type="text/javascript">document.write(str_del)</script></button>
                                </td>
                            </tr>

                        <tr>
                          <td align="right">&nbsp;&nbsp;</td>
                          <td></td>
                        </tr>                        

                        <tr>
                      <td align="center" colspan="2">
                        <input type="submit" style="width:120px;" value="Save" id="btn_save" />&nbsp;&nbsp;
                        <input type="reset"  style="width:120px;" value="Cancel" id="btn_cancel" onclick="window.location.reload()" />
                      </td>
                      </tr>                 
                        </table>
                        <br />
                    </form>
                    </center>
                    </div>  

                </div>
            </div>
        </div>
    </div>

</body>
</html>

References

All information about DigiHero IPCam camera Yi hack v3 (also there are information about v1 and v2 Hi3518E-IP-Camera