Axis Remoting as an Attacker’s Entry Point

▶ Watch (01:43)

Attackers hunting for initial access go straight to Shodan and Censys, pulling every open service tied to a target organization. Moshe did the same and found Axis remoting exposed. Axis is a major IP camera vendor whose cameras run a custom Linux OS called Axis OS. Large organizations run dozens of cameras across multiple sites, so they expose Axis Camera Station and Axis Device Manager over the internet for centralized remote access. Axis documented remoting as fully encrypted and fully authenticated, safe for internet exposure.

“it is safe to expose to the internet and”

That claim is the premise of every vulnerability in this talk.

JSON Deserialization RCE Inside an Encrypted Protocol

▶ Watch (06:23)

Moshe set up a simple MitM MTLS server to intercept client-server traffic and read the protocol in cleartext. Under the encryption, Axis remoting is a JSON-based RPC system. Clients invoke server methods by sending class objects, which the server deserializes using TypeNameHandling.Auto. That setting lets the client specify exactly which .NET class gets instantiated in server memory using a $type field, and

“leads to remote code execution.” — Noam Moshe

The catch: exploiting it still requires a valid NTLM session.

MitM Escalation and Camera Pivot

▶ Watch (11:55)

With the MitM proxy still in place, Moshe ran a pass-the-hash attack against the NTLM handshake. Axis implements no NTLM signing, so after the client authenticates, he injected a YSOSerial payload and got a reverse shell on the server. The same injection works against the client side of the connection. From the compromised server, he used the Axis SDK to build a custom camera package, pushed it through Axis Device Manager, and got shell on every camera the server managed.

Pre-Auth RCE via a Hidden Anonymous Endpoint

▶ Watch (15:04)

The Axis documentation mentions a fallback HTTP port with “AES encryption.” Every route on that server requires NTLM or Kerberos, except one: the // path accepts anonymous connections. Moshe used it to initiate a key exchange, stand up RX and TX channels, and send the same deserialization payload from sections 2 and 3. He walked through the pre-auth exploitation chain walkthrough (20:01) live. Censys and Shodan returned around 6,500 exposed servers, nearly 4,000 of them in the US. People exposed them because the protocol is fully encrypted and fully authenticated, and

“whatever is encrypted is secured.” — Noam Moshe

Q&A

Did the cameras need to be patched, or is that all on the server software? Only the server software needs patching; cameras are not directly vulnerable because the attacker’s control over cameras is a legitimate feature of the Axis server, not a flaw in the cameras themselves. ▶ 24:55

Notable Quotes

it is safe to expose to the internet and Noam Moshe · ▶ 4:43

leads to remote code execution. Noam Moshe · ▶ 10:43

whatever is encrypted is secured. Noam Moshe · ▶ 23:32

Key Takeaways

  • Axis remoting’s NTLM handshake leaks the server hostname and domain to any unauthenticated scanner.
  • A hidden anonymous HTTP endpoint bypasses authentication and carries the same JSON deserialization RCE.
  • Roughly 6,500 Axis servers are internet-exposed; patches have been available for months, so update now.