search

mcw0 / DahuaConsole

Dahua Console, access internal debug console and/or other researched functions in Dahua devices. Feel free to contribute in this project.
MIT License
247 stars 72 forks source link

imou ranger 2 errors #29

Closed luzik closed 2 years ago

luzik commented 2 years ago

./env/bin/python Console.py --auth admin:XXXXXX --rhost 192.168.124.196 --proto dhip --rport 80 -d [] [Dahua Debug Console 2019-2021 bashis ] [] logon type "default" with proto "dhip" at 192.168.124.196:80 [+] Opening connection to 192.168.124.196 on port 80: Done [-] Dahua Debug Console: Trying [+] Login: Success [BEGIN SEND (192.168.124.196)] <------------------1801------------------> 20000000|44484950|00000000|00000000|91000000|00000000|91000000|00000000 {"method": "global.login", "params": {"userName": "admin", "password": "", "clientType": "Web3.0", "loginType": "Direct"}, "id": 0, "session": 0} [ END SEND (192.168.124.196)] <------------------1801------------------> [BEGIN RECV (192.168.124.196)] <------------------1917------------------> 20000000|44484950|d9649aa9|00000000|eb000000|00000000|eb000000|00000000 {"result":false,"params":{"realm":"Login to EB2711F0F250EAB5","random":"80480036-1e1f-4669-812b-70d7470d6025","encryption":"Default"},"error":{"code":268632079,"message":"Component error: login challenge!"},"id":0,"session":2845467865} [ END RECV (192.168.124.196)] <------------------1917------------------> [BEGIN SEND (192.168.124.196)] <------------------1801------------------> 20000000|44484950|d9649aa9|01000000|09010000|00000000|09010000|00000000 {"method": "global.login", "params": {"userName": "admin", "ipAddr": "127.0.0.1", "loginType": "Direct", "clientType": "Console", "authorityType": "Default", "passwordType": "Default", "password": "5D62F915E62F3BC989F6A31E27C"}, "id": 1, "session": 2845467865} [ END SEND (192.168.124.196)] <------------------1801------------------> [BEGIN RECV (192.168.124.196)] <------------------1917------------------> 20000000|44484950|d9649aa9|01000000|4d000000|00000000|4d000000|00000000 {"result":true,"params":{"keepAliveInterval":30},"id":1,"session":2845467865} [ END RECV (192.168.124.196)] <------------------1917------------------> [BEGIN SEND (192.168.124.196)] <------------------1801------------------> 20000000|44484950|d9649aa9|02000000|5e000000|00000000|5e000000|00000000 {"method": "userManager.getActiveUserInfoAll", "params": null, "id": 2, "session": 2845467865} [+] keepAlive thread: Started [ END SEND (192.168.124.196)] <------------------1801------------------> [BEGIN RECV (192.168.124.196)] <------------------1917------------------> 20000000|44484950|d9649aa9|02000000|c4000000|00000000|c4000000|00000000 {"result":true,"params":{"users":[{"Id":1,"Name":"admin","Group":"admin","ClientType":"RemoteRPC","ClientAddress":"192.168.123.10","LoginTime":"2022-05-13 19:00:25"}]},"id":2,"session":2845467865} [ END RECV (192.168.124.196)] <------------------1917------------------> [] [Active Users] admin@192.168.123.10 since 2022-05-13 19:00:25 with "RemoteRPC" (Id: 1) [BEGIN SEND (192.168.124.196)] <------------------1801------------------> 20000000|44484950|d9649aa9|06000000|4c010000|00000000|4c010000|00000000 {"method": "system.multicall", "params": [{"method": "magicBox.getDeviceType", "params": null, "id": 3, "session": 2845467865}, {"method": "magicBox.getDeviceClass", "params": null, "id": 4, "session": 2845467865}, {"method": "global.getCurrentTime", "params": null, "id": 5, "session": 2845467865}], "id": 6, "session": 2845467865} [ END SEND (192.168.124.196)] <------------------1801------------------> [BEGIN RECV (192.168.124.196)] <------------------1917------------------> 20000000|44484950|d9649aa9|06000000|da000000|00000000|da000000|00000000 {"result":true,"params":[{"result":true,"id":3,"params":{"type":"IPC-A22E-B"}},{"result":true,"id":4,"params":{"type":"IPC"}},{"result":true,"id":5,"params":{"time":"2022-05-13 19:00:25"}}],"id":6,"session":2845467865} [ END RECV (192.168.124.196)] <------------------1917------------------> [] Remote Model: IPC-A22E-B, Class: IPC, Time: 2022-05-13 19:00:25 [BEGIN SEND (192.168.124.196)] <------------------1801------------------> 20000000|44484950|d9649aa9|07000000|50000000|00000000|50000000|00000000 {"method": "system.listService", "params": null, "id": 7, "session": 2845467865} [ END SEND (192.168.124.196)] <------------------1801------------------> [BEGIN RECV (192.168.124.196)] <------------------1917------------------> 20000000|44484950|d9649aa9|07000000|65000000|00000000|65000000|00000000 {"result":false,"error":{"code":268632064,"message":"InterfaceNotFound"},"id":7,"session":2845467865} [ END RECV (192.168.124.196)] <------------------1917------------------> [Console]# services [-] Invalid command: 'help' for help [Console]# service Traceback (most recent call last): File "/home/msw/soft/DahuaConsole/Console.py", line 852, in main() File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main DebugConsole(dargs=dargs) File "/home/msw/soft/DahuaConsole/Console.py", line 28, in init self.main_console() File "/home/msw/soft/DahuaConsole/Console.py", line 239, in main_console exec(tmp) File "", line 1, in File "/home/msw/soft/DahuaConsole/dahua.py", line 97, in list_service self.check_for_service('dump') File "/home/msw/soft/DahuaConsole/net.py", line 1163, in check_for_service if not len(self.RemoteServicesCache): TypeError: object of type 'bool' has no len() [*] Closed connection to 192.168.124.196 port 80

mcw0 commented 2 years ago

Many thanks for the report, very useful!

"system.listService" do not give anything back, and reporting "InterfaceNotFound" w/ 'False'. My code do not expect 'False' and thats why it crashing when the code trying to check the size with 'len()'.

I will take this with me to the new update/rewrite I'm currently working on.

Best, bashis

luzik commented 2 years ago

It would be awesome to have some kind of test script, because I believe there are more errors with this half-dahua-api

[Console]# dhp2p
[+] [DH DMSS P2P]
    Enable: True, Status: (null), Detail: Online
Traceback (most recent call last):
  File "/home/msw/soft/DahuaConsole/Console.py", line 852, in <module>
    main()
  File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main
    DebugConsole(dargs=dargs)
  File "/home/msw/soft/DahuaConsole/Console.py", line 28, in __init__
    self.main_console()
  File "/home/msw/soft/DahuaConsole/Console.py", line 239, in main_console
    exec(tmp)
  File "<string>", line 1, in <module>
  File "/home/msw/soft/DahuaConsole/dahua.py", line 1156, in get_remote_info
    tmp.get('ProxyAddr'),
AttributeError: 'NoneType' object has no attribute 'get'
[*] Closed connection to 192.168.124.196 port 80

[Console]# config all
[-] [config_members] Error: {'code': 268959743, 'message': 'Unknown error! error code was not set in service!'}

 --dump service
[*] [Dahua Debug Console 2019-2021 bashis <mcw noemail eu>]
[*] logon type "default" with proto "dhip" at 192.168.124.196:80
[+] Opening connection to 192.168.124.196 on port 80: Done
[+] Login: Success
[*] [Active Users]
    admin@192.168.123.10 since 2022-05-16 21:13:50 with "RemoteRPC" (Id: 1)
[*] Remote Model: IPC-A22E-B, Class: IPC, Time: 2022-05-16 21:13:50
Traceback (most recent call last):
  File "/home/msw/soft/DahuaConsole/Console.py", line 852, in <module>
    main()
  File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main
    DebugConsole(dargs=dargs)
  File "/home/msw/soft/DahuaConsole/Console.py", line 25, in __init__
    self.dump()
  File "/home/msw/soft/DahuaConsole/Console.py", line 326, in dump
    self.dh.listService("{} {}".format("service", self.dargs.dump_argv if self.dargs.dump_argv else "all"))
AttributeError: 'DahuaFunctions' object has no attribute 'listService'
[*] Closed connection to 192.168.124.196 port 80

 --dump device
[*] [Dahua Debug Console 2019-2021 bashis <mcw noemail eu>]
[*] logon type "default" with proto "dhip" at 192.168.124.196:80
[+] Opening connection to 192.168.124.196 on port 80: Done
[+] Login: Success
[*] [Active Users]
    admin@192.168.123.10 since 2022-05-16 21:14:52 with "RemoteRPC" (Id: 1)
[*] Remote Model: IPC-A22E-B, Class: IPC, Time: 2022-05-16 21:14:52
Traceback (most recent call last):
  File "/home/msw/soft/DahuaConsole/Console.py", line 852, in <module>
    main()
  File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main
    DebugConsole(dargs=dargs)
  File "/home/msw/soft/DahuaConsole/Console.py", line 25, in __init__
    self.dump()
  File "/home/msw/soft/DahuaConsole/Console.py", line 330, in dump
    self.dh.getRemoteInfo('device')
AttributeError: 'DahuaFunctions' object has no attribute 'getRemoteInfo'
[*] Closed connection to 192.168.124.196 port 80

 --dump discover
[*] [Dahua Debug Console 2019-2021 bashis <mcw noemail eu>]
[*] logon type "default" with proto "dhip" at 192.168.124.196:80
[+] Opening connection to 192.168.124.196 on port 80: Done
[+] Login: Success
[*] [Active Users]
    admin@192.168.123.10 since 2022-05-16 21:15:42 with "RemoteRPC" (Id: 1)
[*] Remote Model: IPC-A22E-B, Class: IPC, Time: 2022-05-16 21:15:42
Traceback (most recent call last):
  File "/home/msw/soft/DahuaConsole/Console.py", line 852, in <module>
    main()
  File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main
    DebugConsole(dargs=dargs)
  File "/home/msw/soft/DahuaConsole/Console.py", line 25, in __init__
    self.dump()
  File "/home/msw/soft/DahuaConsole/Console.py", line 334, in dump
    self.dh.deviceDiscovery("{} {}".format("discover", self.dargs.dump_argv))
AttributeError: 'DahuaFunctions' object has no attribute 'deviceDiscovery'
[*] Closed connection to 192.168.124.196 port 80

--dump log
[*] [Dahua Debug Console 2019-2021 bashis <mcw noemail eu>]
[*] logon type "default" with proto "dhip" at 192.168.124.196:80
[+] Opening connection to 192.168.124.196 on port 80: Done
[+] Login: Success
[*] [Active Users]
    admin@192.168.123.10 since 2022-05-16 21:16:11 with "RemoteRPC" (Id: 1)
[*] Remote Model: IPC-A22E-B, Class: IPC, Time: 2022-05-16 21:16:11
[ERROR] No such dump: log
Traceback (most recent call last):
  File "/home/msw/soft/DahuaConsole/Console.py", line 852, in <module>
    main()
  File "/home/msw/soft/DahuaConsole/Console.py", line 846, in main
    DebugConsole(dargs=dargs)
  File "/home/msw/soft/DahuaConsole/Console.py", line 25, in __init__
    self.dump()
  File "/home/msw/soft/DahuaConsole/Console.py", line 346, in dump
    log.error('No such dump: {}'.format(self.dargs.dump))
  File "/home/msw/soft/DahuaConsole/env/lib/python3.9/site-packages/pwnlib/log.py", line 424, in error
    raise PwnlibException(message % args)
pwnlib.exception.PwnlibException: No such dump: log
[*] Closed connection to 192.168.124.196 port 80
luzik commented 2 years ago

Also please keep in mind that there is home assistant onvif service where PTZ and stream are working fine with this model. I do not know if this is part of this project. I am just using rroller/dahua and found your Console project. It would be awesome to have access to camera person and sound detectors somehow. I can provide my help with tests :)

mcw0 commented 2 years ago

Firstly, as Dahua says to me: IMOU isn't Dahua (still they are, IMOU is sub of Dahua) Secondly, this version of script is 'Pre-alpha'.

Still, I do work on another version w/ more JSON returns and and not True/False/JSON. Nevertheless, I really appreciate your reporting, and also gave me another reason for purchasing 'imou ranger 2c' :)

luzik commented 2 years ago

If you want to buy one, please note that 2MP version is better under low light conditions, and there are two versions on market IPC-A22EP-A/B and IPC-A22EP-D. A/B is better because it have 1/2.7'' vs 1/2.9'' sensor size.

luzik commented 2 years ago

Damn it. There was mistake in issue topic!. Mine camera is range 2, not ranger 2c.

mcw0 commented 2 years ago

I've seen other similar issues here , some IMOU simply seems not to be fully Dahua - or at least lacking lots functionality, so this script will note work with them.

I have and had several IMOUs (for example: IMOU G42/G22/NVR1104HS), but they seems to be more at Dahua code as they work flawlessly