a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

doc0 - 2.6, 2.7

Browse Source
This commit is contained in:
a.edenhauser
2026-10-23 08:57:05 +02:00
parent 00f8e79db7
commit 96f148a770
3 changed files with 280 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document0-Initial_Information_Gathering.md
+11 -4
View File
@@ -153,7 +153,7 @@ Once again, it reported no critical or high findings.
> The old init capture supposedly was the first real fresh setup. As mentioned, the lock has been tempered with before.
### URLs and Endpoints
## 2.6 Port Scan
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
@@ -161,11 +161,19 @@ While most of ports are common for HTTPS and SSH, there are a few interesting on
- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information
- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114
- It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted
- **#TODO: RESCAN TMRW**
- **#TODO: RESCAN**
- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port
- 8883 on mqtt.production.loqed.com: official standard port designated for MQTT over TLS (MQTTS)
Some playing around with Metasploit's `check` on these 2 endpoints couldn't find anything either.
Some playing around with Metasploit's `check` on these 2 cloud endpoints couldn't find anything either.
## 2.7 BLE
I ran ToothFairy on the lock. It's advertising name is "Loqed Inside" and it uses a fixed MAC address `FF:EC:EE:E7:32:E5`.
I obtained the [GATT table](toothfairy_reports/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](toothfairy_reports/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of hardware.
However, ToothFairy labelled `WRLS-FUZZ-002` as `FAIL`, due to the target not recovering after malformed packets were sent.
## 1.8 Collect Firmware Dump of Firmware after initial Setup
@@ -193,4 +201,3 @@ Some playing around with Metasploit's `check` on these 2 endpoints couldn't find
## 2.5 Inspection of Device During Normal Usage
## 2.6 Port Scan