# Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot  
# Date: 28 July 2021  
# Exploit Author: Ivan Nikolsky (enty8080)  
# Vendor Homepage:  
# Version: Denver SHO-110 (all firmware versions)  
# Tested on: Denver SHO-110  
Backdoor was found in a Denver SHO-110 IP Camera. Maybe other models also have this backdoor too.  
So, the backdoor located in the camera's second http service, allows the attacker to get a snapshot through `/snapshot` endpoint. There are two http services in camera: first - served on port 80, and it requires authentication, and the second - served on port 8001, and it does not require authentication.  
It's possible to write a script that will collect snapshots and add them to each other, so the attacker will be able to disclosure the camera stream.