a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

doc0 - 1.6 further analysis

Browse Source
This commit is contained in:
a.edenhauser
2026-10-22 12:02:57 +02:00
parent 70ab0354eb
commit 00f8e79db7
3 changed files with 182 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document0-Initial_Information_Gathering.md
+8 -14
View File
@@ -157,21 +157,15 @@ Once again, it reported no critical or high findings.
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
|Endpoint|Ports|TLS|Cipher|
|:-|:-|:-|:-|
|app-ratings.shelly.cloud|22, 80, 443, 8000|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|changelog-backend.shelly.cloud|22, 80, 443|v1.2|ECDHE-ECDSA-AES256-GCM-SHA384|
|control.shelly.cloud|22, 80|v1.3|TLS_AES_256_GCM_SHA384|
|integrations.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|paypal.shelly.cloud|22, 80, 443, 8000|v1.3|ECDHE-RSA-AES256-GCM-SHA384|
|repo.shelly.cloud|22, 80, 443|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-101-eu.shelly.cloud|22, 80, 443, **31234**|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-120-eu.shelly.cloud|22, 80, 443, **6113**|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-infra1-eu.shelly.cloud|22, 80, 443, 8000, **9443**|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|api.production.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|mqtt.production.loqed.com|80, 443, 8080, **8883**|v1.3|TLS_AES_128_GCM_SHA256|
While most of ports are common for HTTPS and SSH, there are a few interesting ones:
- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information
- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114
- It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted
- **#TODO: RESCAN TMRW**
- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port
- 8883 on mqtt.production.loqed.com: official standard port designated for MQTT over TLS (MQTTS)
> Includes the old init.
Some playing around with Metasploit's `check` on these 2 endpoints couldn't find anything either.
## 1.8 Collect Firmware Dump of Firmware after initial Setup