From 00f8e79db7521b2c6f5f5b23e1480577b4fbb2a9 Mon Sep 17 00:00:00 2001 From: "a.edenhauser" Date: Thu, 22 Oct 2026 12:02:57 +0200 Subject: [PATCH] doc0 - 1.6 further analysis --- Document0-Initial_Information_Gathering.md | 22 ++---- nmap/shelly-101-eu-shelly-cloud.nmap | 86 +++++++++++++++++++++ nmap/shelly-120-eu-shelly-cloud.nmap | 88 ++++++++++++++++++++++ 3 files changed, 182 insertions(+), 14 deletions(-) create mode 100644 nmap/shelly-101-eu-shelly-cloud.nmap create mode 100644 nmap/shelly-120-eu-shelly-cloud.nmap diff --git a/Document0-Initial_Information_Gathering.md b/Document0-Initial_Information_Gathering.md index c643385..5e80b88 100644 --- a/Document0-Initial_Information_Gathering.md +++ b/Document0-Initial_Information_Gathering.md @@ -157,21 +157,15 @@ Once again, it reported no critical or high findings. I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings: -|Endpoint|Ports|TLS|Cipher| -|:-|:-|:-|:-| -|app-ratings.shelly.cloud|22, 80, 443, 8000|v1.2|ECDHE-RSA-AES256-GCM-SHA384| -|changelog-backend.shelly.cloud|22, 80, 443|v1.2|ECDHE-ECDSA-AES256-GCM-SHA384| -|control.shelly.cloud|22, 80|v1.3|TLS_AES_256_GCM_SHA384| -|integrations.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256| -|paypal.shelly.cloud|22, 80, 443, 8000|v1.3|ECDHE-RSA-AES256-GCM-SHA384| -|repo.shelly.cloud|22, 80, 443|v1.3|TLS_AES_256_GCM_SHA384| -|shelly-101-eu.shelly.cloud|22, 80, 443, **31234**|v1.3|TLS_AES_256_GCM_SHA384| -|shelly-120-eu.shelly.cloud|22, 80, 443, **6113**|v1.3|TLS_AES_256_GCM_SHA384| -|shelly-infra1-eu.shelly.cloud|22, 80, 443, 8000, **9443**|v1.2|ECDHE-RSA-AES256-GCM-SHA384| -|api.production.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256| -|mqtt.production.loqed.com|80, 443, 8080, **8883**|v1.3|TLS_AES_128_GCM_SHA256| +While most of ports are common for HTTPS and SSH, there are a few interesting ones: +- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information +- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114 + - It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted + - **#TODO: RESCAN TMRW** +- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port +- 8883 on mqtt.production.loqed.com: official standard port designated for MQTT over TLS (MQTTS) -> Includes the old init. +Some playing around with Metasploit's `check` on these 2 endpoints couldn't find anything either. ## 1.8 Collect Firmware Dump of Firmware after initial Setup diff --git a/nmap/shelly-101-eu-shelly-cloud.nmap b/nmap/shelly-101-eu-shelly-cloud.nmap new file mode 100644 index 0000000..4a6cd98 --- /dev/null +++ b/nmap/shelly-101-eu-shelly-cloud.nmap @@ -0,0 +1,86 @@ +Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-22 10:50 +0200 +NSE: Loaded 158 scripts for scanning. +NSE: Script Pre-scanning. +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating Parallel DNS resolution of 1 host. at 10:50 +Completed Parallel DNS resolution of 1 host. at 10:50, 0.06s elapsed +Initiating Ping Scan at 10:50 +Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [4 ports] +Completed Ping Scan at 10:50, 0.02s elapsed (1 total hosts) +Initiating Parallel DNS resolution of 1 host. at 10:50 +Completed Parallel DNS resolution of 1 host. at 10:50, 0.09s elapsed +Initiating SYN Stealth Scan at 10:50 +Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [65535 ports] +Discovered open port 80/tcp on 34.79.5.199 +Discovered open port 443/tcp on 34.79.5.199 +Discovered open port 22/tcp on 34.79.5.199 +SYN Stealth Scan Timing: About 23.86% done; ETC: 10:52 (0:01:39 remaining) +SYN Stealth Scan Timing: About 60.39% done; ETC: 10:52 (0:00:40 remaining) +Completed SYN Stealth Scan at 10:52, 142.30s elapsed (65535 total ports) +Initiating Service scan at 10:52 +Scanning 3 services on shelly-101-eu.shelly.cloud (34.79.5.199) +Completed Service scan at 10:52, 12.25s elapsed (3 services on 1 host) +Initiating OS detection (try #1) against shelly-101-eu.shelly.cloud (34.79.5.199) +Retrying OS detection (try #2) against shelly-101-eu.shelly.cloud (34.79.5.199) +adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time. +Initiating Traceroute at 10:52 +Completed Traceroute at 10:52, 0.02s elapsed +Initiating Parallel DNS resolution of 1 host. at 10:52 +Completed Parallel DNS resolution of 1 host. at 10:52, 0.50s elapsed +NSE: Script scanning 34.79.5.199. +Initiating NSE at 10:52 +Completed NSE at 10:53, 43.74s elapsed +Initiating NSE at 10:53 +Completed NSE at 10:54, 44.14s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.01s elapsed +Nmap scan report for shelly-101-eu.shelly.cloud (34.79.5.199) +Host is up (0.0092s latency). +rDNS record for 34.79.5.199: 199.5.79.34.bc.googleusercontent.com +Not shown: 65532 filtered tcp ports (no-response) +PORT STATE SERVICE VERSION +22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.20 (Ubuntu Linux; protocol 2.0) +80/tcp open http nginx 1.24.0 (Ubuntu) +|_http-cors: GET POST OPTIONS +| http-methods: +|_ Supported Methods: GET HEAD POST OPTIONS +|_http-title: Did not follow redirect to https://shelly-101-eu.shelly.cloud/ +443/tcp open ssl/http nginx 1.24.0 (Ubuntu) +|_http-cors: GET POST +| http-methods: +|_ Supported Methods: GET HEAD POST OPTIONS +| http-auth: +| HTTP/1.1 401 Unauthorized\x0D +|_ Server returned status 401 but no WWW-Authenticate header. +Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port +Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (91%), DD-WRT v24-sp2 (Linux 2.4.37) (91%), Linux 3.2 (89%), Linux 4.4 (87%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (87%), VMware Player virtual NAT device (85%) +No exact OS matches for host (test conditions non-ideal). +Network Distance: 2 hops +TCP Sequence Prediction: Difficulty=255 (Good luck!) +IP ID Sequence Generation: Randomized +Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + +TRACEROUTE (using port 80/tcp) +HOP RTT ADDRESS +1 0.07 ms 192.168.212.2 +2 0.08 ms 199.5.79.34.bc.googleusercontent.com (34.79.5.199) + +NSE: Script Post-scanning. +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Read data files from: /usr/share/nmap +OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 247.40 seconds + Raw packets sent: 131254 (5.778MB) | Rcvd: 15144 (606.380KB) diff --git a/nmap/shelly-120-eu-shelly-cloud.nmap b/nmap/shelly-120-eu-shelly-cloud.nmap new file mode 100644 index 0000000..d9602ac --- /dev/null +++ b/nmap/shelly-120-eu-shelly-cloud.nmap @@ -0,0 +1,88 @@ + +Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-22 10:50 +0200 +NSE: Loaded 158 scripts for scanning. +NSE: Script Pre-scanning. +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating NSE at 10:50 +Completed NSE at 10:50, 0.00s elapsed +Initiating Parallel DNS resolution of 1 host. at 10:50 +Completed Parallel DNS resolution of 1 host. at 10:50, 0.06s elapsed +Initiating Ping Scan at 10:50 +Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [4 ports] +Completed Ping Scan at 10:50, 0.02s elapsed (1 total hosts) +Initiating Parallel DNS resolution of 1 host. at 10:50 +Completed Parallel DNS resolution of 1 host. at 10:50, 0.09s elapsed +Initiating SYN Stealth Scan at 10:50 +Scanning shelly-101-eu.shelly.cloud (34.79.5.199) [65535 ports] +Discovered open port 80/tcp on 34.79.5.199 +Discovered open port 443/tcp on 34.79.5.199 +Discovered open port 22/tcp on 34.79.5.199 +SYN Stealth Scan Timing: About 23.86% done; ETC: 10:52 (0:01:39 remaining) +SYN Stealth Scan Timing: About 60.39% done; ETC: 10:52 (0:00:40 remaining) +Completed SYN Stealth Scan at 10:52, 142.30s elapsed (65535 total ports) +Initiating Service scan at 10:52 +Scanning 3 services on shelly-101-eu.shelly.cloud (34.79.5.199) +Completed Service scan at 10:52, 12.25s elapsed (3 services on 1 host) +Initiating OS detection (try #1) against shelly-101-eu.shelly.cloud (34.79.5.199) +Retrying OS detection (try #2) against shelly-101-eu.shelly.cloud (34.79.5.199) +adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200515 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time. +adjust_timeouts2: packet supposedly had rtt of -200892 microseconds. Ignoring time. +Initiating Traceroute at 10:52 +Completed Traceroute at 10:52, 0.02s elapsed +Initiating Parallel DNS resolution of 1 host. at 10:52 +Completed Parallel DNS resolution of 1 host. at 10:52, 0.50s elapsed +NSE: Script scanning 34.79.5.199. +Initiating NSE at 10:52 +Completed NSE at 10:53, 43.74s elapsed +Initiating NSE at 10:53 +Completed NSE at 10:54, 44.14s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.01s elapsed +Nmap scan report for shelly-101-eu.shelly.cloud (34.79.5.199) +Host is up (0.0092s latency). +rDNS record for 34.79.5.199: 199.5.79.34.bc.googleusercontent.com +Not shown: 65532 filtered tcp ports (no-response) +PORT STATE SERVICE VERSION +22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.20 (Ubuntu Linux; protocol 2.0) +80/tcp open http nginx 1.24.0 (Ubuntu) +|_http-cors: GET POST OPTIONS +| http-methods: +|_ Supported Methods: GET HEAD POST OPTIONS +|_http-title: Did not follow redirect to https://shelly-101-eu.shelly.cloud/ +443/tcp open ssl/http nginx 1.24.0 (Ubuntu) +|_http-cors: GET POST +| http-methods: +|_ Supported Methods: GET HEAD POST OPTIONS +| http-auth: +| HTTP/1.1 401 Unauthorized\x0D +|_ Server returned status 401 but no WWW-Authenticate header. +Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port +Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (91%), DD-WRT v24-sp2 (Linux 2.4.37) (91%), Linux 3.2 (89%), Linux 4.4 (87%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (87%), VMware Player virtual NAT device (85%) +No exact OS matches for host (test conditions non-ideal). +Network Distance: 2 hops +TCP Sequence Prediction: Difficulty=255 (Good luck!) +IP ID Sequence Generation: Randomized +Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + +TRACEROUTE (using port 80/tcp) +HOP RTT ADDRESS +1 0.07 ms 192.168.212.2 +2 0.08 ms 199.5.79.34.bc.googleusercontent.com (34.79.5.199) + +NSE: Script Post-scanning. +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Initiating NSE at 10:54 +Completed NSE at 10:54, 0.00s elapsed +Read data files from: /usr/share/nmap +OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 247.40 seconds + Raw packets sent: 131254 (5.778MB) | Rcvd: 15144 (606.380KB) +
 \ No newline at end of file