doc0 - 1.6 further analysis
This commit is contained in:
@@ -157,21 +157,15 @@ Once again, it reported no critical or high findings.
|
||||
|
||||
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
|
||||
|
||||
|Endpoint|Ports|TLS|Cipher|
|
||||
|:-|:-|:-|:-|
|
||||
|app-ratings.shelly.cloud|22, 80, 443, 8000|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|
||||
|changelog-backend.shelly.cloud|22, 80, 443|v1.2|ECDHE-ECDSA-AES256-GCM-SHA384|
|
||||
|control.shelly.cloud|22, 80|v1.3|TLS_AES_256_GCM_SHA384|
|
||||
|integrations.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|
||||
|paypal.shelly.cloud|22, 80, 443, 8000|v1.3|ECDHE-RSA-AES256-GCM-SHA384|
|
||||
|repo.shelly.cloud|22, 80, 443|v1.3|TLS_AES_256_GCM_SHA384|
|
||||
|shelly-101-eu.shelly.cloud|22, 80, 443, **31234**|v1.3|TLS_AES_256_GCM_SHA384|
|
||||
|shelly-120-eu.shelly.cloud|22, 80, 443, **6113**|v1.3|TLS_AES_256_GCM_SHA384|
|
||||
|shelly-infra1-eu.shelly.cloud|22, 80, 443, 8000, **9443**|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|
||||
|api.production.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|
||||
|mqtt.production.loqed.com|80, 443, 8080, **8883**|v1.3|TLS_AES_128_GCM_SHA256|
|
||||
While most of ports are common for HTTPS and SSH, there are a few interesting ones:
|
||||
- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information
|
||||
- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114
|
||||
- It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted
|
||||
- **#TODO: RESCAN TMRW**
|
||||
- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port
|
||||
- 8883 on mqtt.production.loqed.com: official standard port designated for MQTT over TLS (MQTTS)
|
||||
|
||||
> Includes the old init.
|
||||
Some playing around with Metasploit's `check` on these 2 endpoints couldn't find anything either.
|
||||
|
||||
## 1.8 Collect Firmware Dump of Firmware after initial Setup
|
||||
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-22 10:50 +0200
|
||||
NSE: Loaded 158 scripts for scanning.
|
||||
NSE: Script Pre-scanning.
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:50
|
||||
Completed Parallel DNS resolution of 1 host. at 10:50, 0.06s elapsed
|
||||
Initiating Ping Scan at 10:50
|
||||
Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [4 ports]
|
||||
Completed Ping Scan at 10:50, 0.02s elapsed (1 total hosts)
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:50
|
||||
Completed Parallel DNS resolution of 1 host. at 10:50, 0.09s elapsed
|
||||
Initiating SYN Stealth Scan at 10:50
|
||||
Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [65535 ports]
|
||||
Discovered open port 80/tcp on 34.79.5.199
|
||||
Discovered open port 443/tcp on 34.79.5.199
|
||||
Discovered open port 22/tcp on 34.79.5.199
|
||||
SYN Stealth Scan Timing: About 23.86% done; ETC: 10:52 (0:01:39 remaining)
|
||||
SYN Stealth Scan Timing: About 60.39% done; ETC: 10:52 (0:00:40 remaining)
|
||||
Completed SYN Stealth Scan at 10:52, 142.30s elapsed (65535 total ports)
|
||||
Initiating Service scan at 10:52
|
||||
Scanning 3 services on shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Completed Service scan at 10:52, 12.25s elapsed (3 services on 1 host)
|
||||
Initiating OS detection (try #1) against shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Retrying OS detection (try #2) against shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time.
|
||||
Initiating Traceroute at 10:52
|
||||
Completed Traceroute at 10:52, 0.02s elapsed
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:52
|
||||
Completed Parallel DNS resolution of 1 host. at 10:52, 0.50s elapsed
|
||||
NSE: Script scanning 34.79.5.199.
|
||||
Initiating NSE at 10:52
|
||||
Completed NSE at 10:53, 43.74s elapsed
|
||||
Initiating NSE at 10:53
|
||||
Completed NSE at 10:54, 44.14s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.01s elapsed
|
||||
Nmap scan report for shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Host is up (0.0092s latency).
|
||||
rDNS record for 34.79.5.199: 199.5.79.34.bc.googleusercontent.com
|
||||
Not shown: 65532 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.20 (Ubuntu Linux; protocol 2.0)
|
||||
80/tcp open http nginx 1.24.0 (Ubuntu)
|
||||
|_http-cors: GET POST OPTIONS
|
||||
| http-methods:
|
||||
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||
|_http-title: Did not follow redirect to https://shelly-101-eu.shelly.cloud/
|
||||
443/tcp open ssl/http nginx 1.24.0 (Ubuntu)
|
||||
|_http-cors: GET POST
|
||||
| http-methods:
|
||||
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||
| http-auth:
|
||||
| HTTP/1.1 401 Unauthorized\x0D
|
||||
|_ Server returned status 401 but no WWW-Authenticate header.
|
||||
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
|
||||
Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (91%), DD-WRT v24-sp2 (Linux 2.4.37) (91%), Linux 3.2 (89%), Linux 4.4 (87%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (87%), VMware Player virtual NAT device (85%)
|
||||
No exact OS matches for host (test conditions non-ideal).
|
||||
Network Distance: 2 hops
|
||||
TCP Sequence Prediction: Difficulty=255 (Good luck!)
|
||||
IP ID Sequence Generation: Randomized
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
TRACEROUTE (using port 80/tcp)
|
||||
HOP RTT ADDRESS
|
||||
1 0.07 ms 192.168.212.2
|
||||
2 0.08 ms 199.5.79.34.bc.googleusercontent.com (34.79.5.199)
|
||||
|
||||
NSE: Script Post-scanning.
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Read data files from: /usr/share/nmap
|
||||
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
Nmap done: 1 IP address (1 host up) scanned in 247.40 seconds
|
||||
Raw packets sent: 131254 (5.778MB) | Rcvd: 15144 (606.380KB)
|
||||
@@ -0,0 +1,88 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<?xml-stylesheet href="file:///usr/share/nmap/nmap.xsl" type="text/xsl"?><nmaprun args="nmap -p 1-65535 -T4 -A -v shelly-101-eu.shelly.cloud" profile_name="Intense scan, all TCP ports" scanner="nmap" start="1792659018" startstr="Thu Oct 22 10:50:18 2026" version="7.99" xmloutputversion="1.04"><scaninfo type="syn" protocol="tcp" numservices="65535" services="1-65535"></scaninfo><verbose level="1"></verbose><debugging level="0"></debugging><output type="interactive">Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-22 10:50 +0200
|
||||
NSE: Loaded 158 scripts for scanning.
|
||||
NSE: Script Pre-scanning.
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating NSE at 10:50
|
||||
Completed NSE at 10:50, 0.00s elapsed
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:50
|
||||
Completed Parallel DNS resolution of 1 host. at 10:50, 0.06s elapsed
|
||||
Initiating Ping Scan at 10:50
|
||||
Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [4 ports]
|
||||
Completed Ping Scan at 10:50, 0.02s elapsed (1 total hosts)
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:50
|
||||
Completed Parallel DNS resolution of 1 host. at 10:50, 0.09s elapsed
|
||||
Initiating SYN Stealth Scan at 10:50
|
||||
Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [65535 ports]
|
||||
Discovered open port 80/tcp on 34.79.5.199
|
||||
Discovered open port 443/tcp on 34.79.5.199
|
||||
Discovered open port 22/tcp on 34.79.5.199
|
||||
SYN Stealth Scan Timing: About 23.86% done; ETC: 10:52 (0:01:39 remaining)
|
||||
SYN Stealth Scan Timing: About 60.39% done; ETC: 10:52 (0:00:40 remaining)
|
||||
Completed SYN Stealth Scan at 10:52, 142.30s elapsed (65535 total ports)
|
||||
Initiating Service scan at 10:52
|
||||
Scanning 3 services on shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Completed Service scan at 10:52, 12.25s elapsed (3 services on 1 host)
|
||||
Initiating OS detection (try #1) against shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Retrying OS detection (try #2) against shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time.
|
||||
adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time.
|
||||
Initiating Traceroute at 10:52
|
||||
Completed Traceroute at 10:52, 0.02s elapsed
|
||||
Initiating Parallel DNS resolution of 1 host. at 10:52
|
||||
Completed Parallel DNS resolution of 1 host. at 10:52, 0.50s elapsed
|
||||
NSE: Script scanning 34.79.5.199.
|
||||
Initiating NSE at 10:52
|
||||
Completed NSE at 10:53, 43.74s elapsed
|
||||
Initiating NSE at 10:53
|
||||
Completed NSE at 10:54, 44.14s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.01s elapsed
|
||||
Nmap scan report for shelly-101-eu.shelly.cloud (34.79.5.199)
|
||||
Host is up (0.0092s latency).
|
||||
rDNS record for 34.79.5.199: 199.5.79.34.bc.googleusercontent.com
|
||||
Not shown: 65532 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.20 (Ubuntu Linux; protocol 2.0)
|
||||
80/tcp open http nginx 1.24.0 (Ubuntu)
|
||||
|_http-cors: GET POST OPTIONS
|
||||
| http-methods:
|
||||
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||
|_http-title: Did not follow redirect to https://shelly-101-eu.shelly.cloud/
|
||||
443/tcp open ssl/http nginx 1.24.0 (Ubuntu)
|
||||
|_http-cors: GET POST
|
||||
| http-methods:
|
||||
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||
| http-auth:
|
||||
| HTTP/1.1 401 Unauthorized\x0D
|
||||
|_ Server returned status 401 but no WWW-Authenticate header.
|
||||
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
|
||||
Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (91%), DD-WRT v24-sp2 (Linux 2.4.37) (91%), Linux 3.2 (89%), Linux 4.4 (87%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (87%), VMware Player virtual NAT device (85%)
|
||||
No exact OS matches for host (test conditions non-ideal).
|
||||
Network Distance: 2 hops
|
||||
TCP Sequence Prediction: Difficulty=255 (Good luck!)
|
||||
IP ID Sequence Generation: Randomized
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
TRACEROUTE (using port 80/tcp)
|
||||
HOP RTT ADDRESS
|
||||
1 0.07 ms 192.168.212.2
|
||||
2 0.08 ms 199.5.79.34.bc.googleusercontent.com (34.79.5.199)
|
||||
|
||||
NSE: Script Post-scanning.
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Initiating NSE at 10:54
|
||||
Completed NSE at 10:54, 0.00s elapsed
|
||||
Read data files from: /usr/share/nmap
|
||||
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
Nmap done: 1 IP address (1 host up) scanned in 247.40 seconds
|
||||
Raw packets sent: 131254 (5.778MB) | Rcvd: 15144 (606.380KB)
|
||||
</output><host comment=""><status state="up"></status><address addr="34.79.5.199" vendor="" addrtype="ipv4"></address><hostnames><hostname name="shelly-101-eu.shelly.cloud" type="user"></hostname><hostname name="199.5.79.34.bc.googleusercontent.com" type="PTR"></hostname></hostnames><ports><extraports count="65532" state="filtered"></extraports><port portid="22" protocol="tcp"><state state="open" reason="syn-ack" reason_ttl="128"></state><service conf="10" method="probed" name="ssh" product="OpenSSH" version="9.6p1 Ubuntu 3ubuntu13.20" extrainfo="Ubuntu Linux; protocol 2.0"></service></port><port portid="80" protocol="tcp"><state state="open" reason="syn-ack" reason_ttl="128"></state><service conf="10" method="probed" name="http" product="nginx" version="1.24.0" extrainfo="Ubuntu"></service></port><port portid="443" protocol="tcp"><state state="open" reason="syn-ack" reason_ttl="128"></state><service conf="10" method="probed" name="http" product="nginx" version="1.24.0" extrainfo="Ubuntu"></service></port></ports><os><portused state="open" proto="tcp" portid="22"></portused><osmatch name="Actiontec MI424WR-GEN3I WAP" accuracy="91" line="1307"><osclass vendor="Linux" osfamily="Linux" type="WAP" osgen="" accuracy="91"></osclass></osmatch><osmatch name="DD-WRT v24-sp2 (Linux 2.4.37)" accuracy="91" line="48884"><osclass vendor="Linux" osfamily="Linux" type="general purpose" osgen="2.4.X" accuracy="91"></osclass></osmatch><osmatch name="Linux 3.2" accuracy="89" line="68214"><osclass vendor="Linux" osfamily="Linux" type="general purpose" osgen="3.X" accuracy="89"></osclass></osmatch><osmatch name="Linux 4.4" accuracy="87" line="71285"><osclass vendor="Linux" osfamily="Linux" type="general purpose" osgen="4.X" accuracy="87"></osclass></osmatch><osmatch name="Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012" accuracy="87" line="92072"><osclass vendor="Microsoft" osfamily="Windows" type="general purpose" osgen="2012" accuracy="87"></osclass></osmatch><osmatch name="VMware Player virtual NAT device" accuracy="85" line="112674"><osclass vendor="VMware" osfamily="Player" type="specialized" osgen="" accuracy="85"></osclass></osmatch></os><uptime seconds="" lastboot=""></uptime><tcpsequence index="255" difficulty="Good luck!" values="571E355C,28F624DB,68060926,784F3BE4,63E361DE,5B7953B5"></tcpsequence><ipidsequence class="Randomized" values="495D,BCC4,FB1C,B507,369A,4DA5"></ipidsequence><tcptssequence class="none returned (unsupported)" values=""></tcptssequence><trace proto="tcp" port="80"><hop ttl="1" rtt="0.07" ipaddr="192.168.212.2" host=""></hop><hop ttl="2" rtt="0.08" ipaddr="34.79.5.199" host="199.5.79.34.bc.googleusercontent.com"></hop></trace></host><runstats><finished time="1792659266" timestr="Thu Oct 22 10:54:26 2026"></finished><hosts up="1" down="0" total="1"></hosts></runstats></nmaprun>
|
||||
Reference in New Issue
Block a user