This site uses cookies. Learn more about cookies and changing the settings in your browser.
Using this website you agree to cookies in accordance with the current browser settings.

Livebox 2.0 ZTE ZXV10 H202N - jak dostać się do shella?

Main Page -> Forum Index -> Network, Internet -> The Internet - Access -> Livebox 2.0 ZTE ZXV10 H202N - jak dostać się do shella?

Oponeo - Prosta Droga do Nowych Opon

Author

Message

mrmarkos
Poziom 16

Joined: 17 May 2012
Posts: 293
Location: Poznań

30 Jun 2012 16:27

Livebox 2.0 ZTE ZXV10 H202N - jak dostać się do shella?

Serwus,

jak w temacie. Próbowałem wejść przez telnet i ssh na każdy z poniższych portów i zawsze otrzymuje następujące komunikaty:

Code Text - [expand]
$ telnet 192.168.1.1 49152
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
Connection closed by foreign host.

Code Text - [expand]
$ ssh 192.168.1.1 -p 49152
ssh_exchange_identification: Connection closed by remote host

Code Text - [expand]
$ nmap -A -T4 192.168.1.1
 
Starting Nmap 5.21 ( http://nmap.org ) at 2012-06-30 16:19 CEST
Nmap scan report for 192.168.1.1
Host is up (0.014s latency).
Not shown: 991 closed ports
PORT      STATE SERVICE        VERSION
80/tcp    open  http?
81/tcp    open  ssl/hosts2-ns?
139/tcp   open  netbios-ssn    Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp   open  netbios-ssn    Samba smbd 3.X (workgroup: WORKGROUP)
631/tcp   open  ipp            CUPS 1.3
2006/tcp  open  invokator?
2007/tcp  open  dectalk?
49152/tcp open  unknown
49153/tcp open  unknown
6 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=5.21%I=7%D=6/30%Time=4FEF0AE5%P=i686-pc-linux-gnu%r(GetReq
SF:uest,6C3E,"HTTP/1\.0\x20200\x20OK\r\nCache-Control:\x20must-revalidate\
SF:r\nETAG:\x20a22a1f80\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\
SF:nContent-Length:\x2027580\r\n\r\n<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3
SF:C//DTD\x20XHTML\x201\.0\x20Strict//EN\"\x20\"http://www\.w3\.org/TR/xht
SF:ml1/DTD/xhtml1-strict\.dtd\">\n<html\x20xmlns=\"http://www\.w3\.org/199
SF:9/xhtml\"\x20dir=\"ltr\"\x20lang=\"en-EN\">\n<head>\n\x20\x20<meta\x20h
SF:ttp-equiv=\"Content-Type\"\x20content=\"text/html;\x20charset=UTF-8\"\x
SF:20/>\n\x20\x20<title>Livebox</title>\n\x20\x20\n\x20\x20<link\x20href=\
SF:"/styles\.css\?a22a1f80\"\x20rel=\"stylesheet\"\x20type=\"text/css\"\x2
SF:0/>\n\x20\x20\n\x20\x20<script\x20type=\"text/javascript\">\n\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20appUrl\x20=\x20'';\n\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20appConfig\x20='pl';\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20appUid\x20=\x20'a22a1f80';\n\x20\x20\x20\x20\x20\x20\x20\x20</
SF:script>\n\n</head>\n\n<body\x20class=\"accessibility-normal\">\n\x20\x2
SF:0<img\x20src=\"/images/pl/common/transparent\.gif\?a22a1f80\"\x20style=
SF:\"display:\x20none;\"/>\n\x20\x20<img\x20src=\"/images/pl/common/header
SF:-accessibility-minus\.png\?a22a1f80\"\x20style=\"display:\x20none;\"/>\
SF:n\x20\x20<img\x20src=\"/images/pl/common/header-accessibility-plus")%r(
SF:HTTPOptions,82,"HTTP/1\.0\x20200\x20OK\r\nCache-Control:\x20must-revali
SF:date\r\nETAG:\x20a22a1f80\r\nContent-Type:\x20text/html;\x20charset=utf
SF:-8\r\nContent-Length:\x2027580\r\n\r\n")%r(RTSPRequest,6C3E,"HTTP/1\.0\
SF:x20200\x20OK\r\nCache-Control:\x20must-revalidate\r\nETAG:\x20a22a1f80\
SF:r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x202
SF:7580\r\n\r\n<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20XHTML\x201\
SF:.0\x20Strict//EN\"\x20\"http://www\.w3\.org/TR/xhtml1/DTD/xhtml1-strict
SF:\.dtd\">\n<html\x20xmlns=\"http://www\.w3\.org/1999/xhtml\"\x20dir=\"lt
SF:r\"\x20lang=\"en-EN\">\n<head>\n\x20\x20<meta\x20http-equiv=\"Content-T
SF:ype\"\x20content=\"text/html;\x20charset=UTF-8\"\x20/>\n\x20\x20<title>
SF:Livebox</title>\n\x20\x20\n\x20\x20<link\x20href=\"/styles\.css\?a22a1f
SF:80\"\x20rel=\"stylesheet\"\x20type=\"text/css\"\x20/>\n\x20\x20\n\x20\x
SF:20<script\x20type=\"text/javascript\">\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20appUrl\x20=\x20'';\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20ap
SF:pConfig\x20='pl';\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20appUid\x20=\
SF:x20'a22a1f80';\n\x20\x20\x20\x20\x20\x20\x20\x20</script>\n\n</head>\n\
SF:n<body\x20class=\"accessibility-normal\">\n\x20\x20<img\x20src=\"/image
SF:s/pl/common/transparent\.gif\?a22a1f80\"\x20style=\"display:\x20none;\"
SF:/>\n\x20\x20<img\x20src=\"/images/pl/common/header-accessibility-minus\
SF:.png\?a22a1f80\"\x20style=\"display:\x20none;\"/>\n\x20\x20<img\x20src=
SF:\"/images/pl/common/header-accessibility-plus");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port81-TCP:V=5.21%T=SSL%I=7%D=6/30%Time=4FEF0AF9%P=i686-pc-linux-gnu%r(
SF:GetRequest,16F,"HTTP/1\.0\x20307\x20Temporary\x20Redirect\r\nTE:\x20chu
SF:nked\r\nTransfer-Encoding:\x20chunked\r\nContent-Type:\x20text/html\r\n
SF:Location:\x20/homeAuthentificationRemote\.html\r\n\r\nD3\r\n<html><head
SF:><title>Temporary\x20Redirect</title></head><body><h1>307\x20-\x20Tempo
SF:rary\x20Redirect</h1><p>This\x20page\x20has\x20moved\x20to\x20<a\x20hre
SF:f=\"/homeAuthentificationRemote\.html\">/homeAuthentificationRemote\.ht
SF:ml</a></body></html>\n\r\n0\r\n\r\n")%r(HTTPOptions,16F,"HTTP/1\.0\x203
SF:07\x20Temporary\x20Redirect\r\nTE:\x20chunked\r\nTransfer-Encoding:\x20
SF:chunked\r\nContent-Type:\x20text/html\r\nLocation:\x20/homeAuthentifica
SF:tionRemote\.html\r\n\r\nD3\r\n<html><head><title>Temporary\x20Redirect<
SF:/title></head><body><h1>307\x20-\x20Temporary\x20Redirect</h1><p>This\x
SF:20page\x20has\x20moved\x20to\x20<a\x20href=\"/homeAuthentificationRemot
SF:e\.html\">/homeAuthentificationRemote\.html</a></body></html>\n\r\n0\r\
SF:n\r\n")%r(RTSPRequest,16F,"HTTP/1\.0\x20307\x20Temporary\x20Redirect\r\
SF:nTE:\x20chunked\r\nTransfer-Encoding:\x20chunked\r\nContent-Type:\x20te
SF:xt/html\r\nLocation:\x20/homeAuthentificationRemote\.html\r\n\r\nD3\r\n
SF:<html><head><title>Temporary\x20Redirect</title></head><body><h1>307\x2
SF:0-\x20Temporary\x20Redirect</h1><p>This\x20page\x20has\x20moved\x20to\x
SF:20<a\x20href=\"/homeAuthentificationRemote\.html\">/homeAuthentificatio
SF:nRemote\.html</a></body></html>\n\r\n0\r\n\r\n")%r(FourOhFourRequest,F7
SF:,"HTTP/1\.0\x20404\x20Not\x20Found\r\nCache-Control:\x20public,max-age=
SF:31536000\r\nETAG:\x20a22a1f80\r\nTE:\x20chunked\r\nTransfer-Encoding:\x
SF:20chunked\r\nContent-Type:\x20text/html\r\n\r\n58\r\n<html><head><title
SF:>Not\x20Found</title></head><body><h1>404\x20-\x20Not\x20Found</h1></bo
SF:dy></html>\n\r\n0\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port2006-TCP:V=5.21%I=7%D=6/30%Time=4FEF0AFE%P=i686-pc-linux-gnu%r(RPCC
SF:heck,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\
SF:x0f\x06\x10\x04\0\x04p\x01\0")%r(DNSVersionBindReq,27,"MBUS:B/4\.1\.0\.
SF:0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x0
SF:1\0")%r(SSLSessionReq,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff
SF:\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(SMBProgNeg,27,"MBUS:B
SF:/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04
SF:\0\x04p\x01\0")%r(FourOhFourRequest,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\x
SF:ff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(SIPOpti
SF:ons,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x
SF:0f\x06\x10\x04\0\x04p\x01\0")%r(NotesRPC,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\
SF:x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(WM
SF:SRequest,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\
SF:x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(oracle-tns,27,"MBUS:B/4\.1\.0\.0\0
SF:\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0
SF:");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port2007-TCP:V=5.21%I=7%D=6/30%Time=4FEF0AFE%P=i686-pc-linux-gnu%r(RPCC
SF:heck,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\
SF:x0f\x06\x10\x04\0\x04p\x01\0")%r(DNSVersionBindReq,27,"MBUS:B/4\.1\.0\.
SF:0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x0
SF:1\0")%r(SSLSessionReq,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff
SF:\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(SMBProgNeg,27,"MBUS:B
SF:/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04
SF:\0\x04p\x01\0")%r(FourOhFourRequest,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\x
SF:ff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(SIPOpti
SF:ons,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x
SF:0f\x06\x10\x04\0\x04p\x01\0")%r(NotesRPC,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\
SF:x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(WM
SF:SRequest,27,"MBUS:B/4\.1\.0\.0\0\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\
SF:x1e\x0f\x06\x10\x04\0\x04p\x01\0")%r(oracle-tns,27,"MBUS:B/4\.1\.0\.0\0
SF:\0\0\0\x01\xff\xff\xff\xff\0\0\0\0\0\t\x1e\x0f\x06\x10\x04\0\x04p\x01\0
SF:");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49152-TCP:V=5.21%I=7%D=6/30%Time=4FEF0AE5%P=i686-pc-linux-gnu%r(Fou
SF:rOhFourRequest,52,"HTTP/1\.1\x20404\x20Not\x20Found\r\nConnection:\x20c
SF:lose\r\nDate:\x20Sat,\x2030\x20Jun\x202012\x2016:19:17\x20GMT\r\n\r\n")
SF:%r(GetRequest,52,"HTTP/1\.1\x20404\x20Not\x20Found\r\nConnection:\x20cl
SF:ose\r\nDate:\x20Sat,\x2030\x20Jun\x202012\x2016:19:18\x20GMT\r\n\r\n")%
SF:r(SIPOptions,44,"HTTP/1\.1\x20501\x20Unimplimented\r\nConnection:\x20cl
SF:ose\r\nContent-Length:\x200\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49153-TCP:V=5.21%I=7%D=6/30%Time=4FEF0AEA%P=i686-pc-linux-gnu%r(Get
SF:Request,B1,"HTTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\nSERVER:\
SF:x20Linux/2\.6\.18\.8,\x20UPnP/1\.0\r\nCONTENT-LENGTH:\x2060\r\nCONTENT-
SF:TYPE:\x20text/html\r\n\r\n<html><body><h1>500\x20Internal\x20Server\x20
SF:Error</h1></body></html>")%r(HTTPOptions,A5,"HTTP/1\.0\x20501\x20Not\x2
SF:0Implemented\r\nSERVER:\x20Linux/2\.6\.18\.8,\x20UPnP/1\.0\r\nCONTENT-L
SF:ENGTH:\x2054\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>501\x
SF:20Not\x20Implemented</h1></body></html>")%r(RPCCheck,9D,"HTTP/0\.0\x204
SF:00\x20Bad\x20Request\r\nSERVER:\x20Linux/2\.6\.18\.8,\x20UPnP/1\.0\r\nC
SF:ONTENT-LENGTH:\x2050\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><
SF:h1>400\x20Bad\x20Request</h1></body></html>")%r(FourOhFourRequest,B1,"H
SF:TTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\nSERVER:\x20Linux/2\.6
SF:\.18\.8,\x20UPnP/1\.0\r\nCONTENT-LENGTH:\x2060\r\nCONTENT-TYPE:\x20text
SF:/html\r\n\r\n<html><body><h1>500\x20Internal\x20Server\x20Error</h1></b
SF:ody></html>");
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.15 - 2.6.23 (embedded)
Network Distance: 1 hop
 
Host script results:
|_nbstat: NetBIOS name: LIVEBOX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
|_smbv2-enabled: Server doesn't support SMBv2 protocol
| smb-os-discovery:  
|   OS: Unix (Samba 3.0.37)
|   Name: WORKGROUP\Unknown
|_  System time: 2012-06-30 18:21:09 UTC+0
 
HOP RTT      ADDRESS
1   14.34 ms 192.168.1.1
 
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 149.60 seconds