search

mcw0 / Tools

Some tools
MIT License
47 stars 27 forks source link

Empty config for EZ-IP #8

Open rapi3 opened 4 years ago

rapi3 commented 4 years ago

Any idea how to read unscrambled config ? thank you

tested for IPC-D2B20-ZS:

    Vendor: EZIP, Build: 2018-09-18 21:57:52, Version: 2.622.0000000.4.R
    Web: 3.2.1.16089, OEM: 0000000, Package: EZIP_IPC-XXBXX-Leto_EngSpnPrt_P
and
[+] [System]
    Vendor: EZIP, Build: 2019-03-01 12:22:29, Version: 2.680.0000000.2.R
    Web: 3.2.1.20272, OEM: 0000000, Package: EZIP_IPC-XXBXX-Leto_EngSpnPrt_P

[*] [Dahua JSON Debug Console 2019,2020 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.22.155 on port 80: Done
[+] Dahua JSON Console: Dump config
[+] Login: Success
[+] Started keepAlive thread
[*] Remote device: IPC-D2B20-ZS
{
    "params": {}
}
[*] All done
mcw0 commented 4 years ago

Interesting...

1, try "config members" when you are connected w/ valid creds on my script. 2, if that do not work try "config DVRIP" to see if that give any output.

Please let me know the outcome.

rapi3 commented 4 years ago

no luck; maybe because there is no service console available ?

[*] [Dahua JSON Debug Console 2019,2020 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.22.155 on port 80: Done
[-] Dahua JSON Console: Service Console do not exist on remote device
[+] Login: Success
[+] Started keepAlive thread
[*] Remote device: IPC-D2B20-ZS
[*] All done
[*] [Dahua JSON Debug Console 2019,2020 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.22.155 on port 80: Done
[+] Dahua JSON Console: Device info
[+] Login: Success
[+] Started keepAlive thread
[*] Remote device: IPC-D2B20-ZS
[+] [System]
    Vendor: EZIP, Build: 2019-03-01 12:22:29, Version: 2.680.0000000.2.R
    Web: 3.2.1.20272, OEM: 0000000, Package: EZIP_IPC-XXBXX-Leto_EngSpnPrt_P
[+] [Storage]
    Device: /dev/mmcblk0, Mount: /mnt/sd/mmcblk0p0, Access: ReadWrite
    Total: 29612.0 MB, Used: 592.3125 MB, Free: 29019.6875 MB
[+] [Encrypt Info]
    Asymmetric: RSA, Cipher(s): AES; ROAE, RSA Passphrase: 010001
    RSA Modulus: CD1C1ECB40E9.......A9D4D07
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9..........BwIDAQAB
-----END PUBLIC KEY-----
[*] All done
[*] [Dahua JSON Debug Console 2019,2020 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.22.155 on port 80: Done
[+] Dahua JSON Console: Dump services
[+] Login: Success
[+] Started keepAlive thread
[*] Remote device: IPC-D2B20-ZS
[-] Failure: {'result': False, 'error': {'code': 268632064, 'message': 'InterfaceNotFound'}, 'id': 3, 'session': 1904708868}
[*] All done
mcw0 commented 3 years ago

Perhaps long shot, but try to replace "All" with "ANY", might help you to get the config. Line 3423 in updated script

rapi3 commented 3 years ago

no luck ;(

[*] [Dahua JSON Debug Console 2019-2021 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.xxx.xxx on port 80: Done
[+] Login: Success
[*] Remote Model: IPC-D2B20-ZS, Class: IPC, Time: 2021-01-25 21:43:20
{
    "params": {}
}
[+] Logout
[*] Closed connection to 192.168.xxx.xxx port 80
[*] All done
[+] Successful instance termination of IPC-D2B20-ZS (192.168.xxx.xxx)

for --service I get this error:

[*] [Dahua JSON Debug Console 2019-2021 bashis <mcw noemail eu>]
[+] Opening connection to 192.168.xxx.xxx on port 80: Done
[+] Login: Success
[*] Remote Model: IPC-D2B20-ZS, Class: IPC, Time: 2021-01-25 21:46:15
Traceback (most recent call last):
  File "dahua2a.py", line 6726, in <module>
    status = DebugConsole()
  File "dahua2a.py", line 732, in __init__
    return self.Dump()
  File "dahua2a.py", line 1119, in Dump
    self.dh.listService("{} {}".format("service",args.dump_argv if args.dump_argv else "all"))
  File "dahua2a.py", line 2872, in listService
    if self.RemoteServicesCache.get('result'):
AttributeError: 'bool' object has no attribute 'get'
[+] Successful instance termination of IPC-D2B20-ZS
mcw0 commented 3 years ago

bummer, thx for info. Will try to get one EZIP one day to check out this more.

mcw0 commented 3 years ago

FYI, EZIP seems not to contain full Dahua set. In fact, after done some quick research, EZIP are actually Huawei and using Huawei LiteOS

Will close this issue now, but will still remember to get my hands on one or two EZIP, as I find this interesting.

rapi3 commented 3 years ago

I found this that work for EZ-IP, maybe you can implement in your work and I can test it. https://gist.github.com/gxfxyz/48072a72be3a169bc43549e676713201

mcw0 commented 3 years ago

Thanks a lot my friend for sharing, adding 'requests' lib for http/https are in my workflow for next update (and a lot more), however the tests so far seems not to allow attach to the console at all, same with 'events'. Still good thing to get in for other purposes.

rapi3 commented 3 years ago

I tested few commands from DAHUA API V2.76 2019-07-25 and it work:

Get the current time on the device

print(dahua.current_time())

Make a raw RPC request to get serial number

print(dahua.request(method="magicBox.getSerialNo"))

Make a raw RPC request to get Device Class

print(dahua.request(method="magicBox.getDeviceClass"))

Make a raw RPC request to get Device Type

print(dahua.request(method="magicBox.getDeviceType"))

Make a raw RPC request to get Hardware Version

print(dahua.request(method="magicBox.getHardwareVersion"))

Make a raw RPC request to get Vendor Information

print(dahua.request(method="magicBox.getVendor"))

Make a raw RPC request to get Software Information

print(dahua.request(method="magicBox.getSoftwareVersion"))

2021-04-30 21:01:23 {u'session': u'528b1ab7bb23f2877010495', u'params': {u'sn': u'----edited----'}, u'result': True, u'id': 4} {u'session': u'528b1ab7bb23f2877010495', u'params': {u'type': u'IPC'}, u'result': True, u'id': 5} {u'session': u'528b1ab7bb23f2877010495', u'params': {u'type': u'IPC-D2B20-ZS'}, u'result': True, u'id': 6} {u'session': u'528b1ab7bb23f2877010495', u'params': {u'version': u'1.00'}, u'result': True, u'id': 7} {u'session': u'528b1ab7bb23f2877010495', u'params': {u'Vendor': u'EZIP'}, u'result': True, u'id': 8} {u'session': u'528b1ab7bb23f2877010495', u'params': {u'version': {u'Version': u'2.680.0000000.2.R', u'WebVersion': u'3.2.1.20272', u'BuildDate': u'2019-03-01', u'SecurityBaseLineVersion': u'V1.4'}}, u'result': True, u'id': 9}

mcw0 commented 3 years ago

Sure, but try below cmd (need some rework to work with that script).

query_args = { "method": "configManager.getConfig", "params": { "name": "All", }, "session": self.SessionID, "id": self.ID }

rapi3 commented 3 years ago

My python skills are 0, I get this error: TypeError: get_config() takes exactly 2 arguments (1 given)

From api I seen that it require file name and All Syntax http:///cgi-bin/Config.backup?action=All Method GET Description Download all the settings of a device as a file named Config.Backup by default. Example http://192.168.1.108/cgi-bin/Config.backup?action=All

    def get_config(self, params):
        """Get configurations."""

        method = "configManager.getConfig"
        r = self.request(method=method, params=params)

        if r['result'] is False:
            raise RequestError(str(r))
mcw0 commented 3 years ago

You are missing 'params' when you call 'get_config()'

call like this: dahua = DahuaRpc(host="192.168.1.10", username="admin", password="password") dahua.login()

params = {"name": "All"}
dahua.get_config(params)

Still, I really do not think that will work for you anyhow.

Why?

Well, basically the "only" difference is the used protocol. In my script I use 'DVRIP and DHIP', in that script, it using 'http/https' (with python lib requests: https://pypi.org/project/requests/).

The JSON syntax is the same, doesn't matter if you will use protocol 'DHIP/DVRIP/HTTP(s)'.

And by the way, this is undocumented API, what you reading is Dahua official CGI API.