• June 26, 2017, 08:45:06 PM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Author Topic: nmap says ssh on 8992, anyone know the password?  (Read 12430 times)

bs27975

  • Level 2 Member
  • **
  • Posts: 61
nmap says ssh on 8992, anyone know the password?
« on: April 28, 2013, 10:50:12 PM »

An nmap probe of my DCS-2132L reveals ssh is running on port 8992. Anyone know the password?

ssh -p 8992 admin@{myipaddress} does indeed prompt for a password, however no password I know of works.
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2028
Re: nmap says ssh on 8992, anyone know the password?
« Reply #1 on: April 29, 2013, 07:03:23 PM »

An nmap probe of my DCS-2132L reveals ssh is running on port 8992. Anyone know the password?

ssh -p 8992 admin@{myipaddress} does indeed prompt for a password, however no password I know of works.

Nice find.

I am seeing anything for a username @ ipaddress asks for password.

There is a post here about turning on telnet to a camera... which works. I haven't tried that.
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2028
Re: nmap says ssh on 8992, anyone know the password?
« Reply #2 on: April 29, 2013, 07:04:58 PM »

An nmap probe of my DCS-2132L reveals ssh is running on port 8992. Anyone know the password?

ssh -p 8992 admin@{myipaddress} does indeed prompt for a password, however no password I know of works.

check this out here

http://forums.dlink.com/index.php?topic=52180.0
Logged

bs27975

  • Level 2 Member
  • **
  • Posts: 61
Re: nmap says ssh on 8992, anyone know the password?
« Reply #3 on: April 29, 2013, 07:59:53 PM »

check this out here

http://forums.dlink.com/index.php?topic=52180.0

Thanks. No joy (http://CamIPAdress/cgi/admin/telnetd.cgi?command=on), but thanks. ("404 Not Found, The requested URL /cgi/admin/telnetd.cgi was not found on this server.")

A post-nmap scan shows no telnet active. (No telnet appeared prior, either, at the time I notice ssh on 8992.) And, no, root/admin did not work for ssh.

Nothing particularly obvious from strings, on the firmware, either.

Makes me wonder (assuming ssh success) ... if a polling scp from a computer is possible / useful rather than the small ftp files. Hmmm.
Logged

duccio

  • Level 2 Member
  • **
  • Posts: 28
Re: nmap says ssh on 8992, anyone know the password?
« Reply #4 on: October 02, 2013, 10:14:43 AM »

Any luck with 8992 port?
Logged

evilslon

  • Level 2 Member
  • **
  • Posts: 34
Re: nmap says ssh on 8992, anyone know the password?
« Reply #5 on: October 02, 2013, 10:09:26 PM »

Nothing particularly obvious from strings, on the firmware, either.

You will not find anything interesting in firmware file because:
1. It seems to be encrypted!
2. It's AFAIK does not contain root filesystem (which is contains in non flashable area of memory)!

Any luck with 8992 port?
Well... First i want to say that i'm owner of 2210 and my camera also have port 8992 opened and listening for ssh-connection, and i'm also want to get a password for ssh (which is, i bet, the same for all D-Link cube series cameras). In some way i have got /etc/passwd file from camera's internal filesystem and now trying to bruteforce the MD5 hash, but its will take VERY much time.
« Last Edit: October 02, 2013, 10:39:16 PM by evilslon »
Logged

bs27975

  • Level 2 Member
  • **
  • Posts: 61
Re: nmap says ssh on 8992, anyone know the password?
« Reply #6 on: October 03, 2013, 01:28:01 AM »

May you have success with decrypting the passwords!

Thanks for working on it. I'll be most gratified if you can share any success you achieve.

An insane element of the camera is ... set it up wi-fi in one location, then move to another - you're screwed until you do a factory reset. It won't pay attention to any wired new DHCP address given to it.

Here's hoping one can ssh in under such circumstance and re-IP it to something on the new local net. (To then get normal config access to fix things up for the new location!)

(*&^*&^(*^)(&_)(*)(*&(*&%^(*&%^(*
Logged

evilslon

  • Level 2 Member
  • **
  • Posts: 34
Re: nmap says ssh on 8992, anyone know the password?
« Reply #7 on: October 03, 2013, 03:20:55 AM »

I'll be most gratified if you can share any success you achieve.
Of course i will do it! Our cameras is based on Linux which is free & open and i think it must stay free and open to anyone who wants to modify any part of it despite of device where it is installed!
Logged

evilslon

  • Level 2 Member
  • **
  • Posts: 34
Re: nmap says ssh on 8992, anyone know the password?
« Reply #8 on: October 03, 2013, 11:49:57 PM »

Got it! Success!!!
Don't forget that i'm using DCS-2210, so password for 2132L may be different. Username for my camera's ssh is root and the password is tms320dm365. Thanks to many peoples who helped me a lot while i worked on searching of this password! Enjoy!
Logged

bs27975

  • Level 2 Member
  • **
  • Posts: 61
Re: nmap says ssh on 8992, anyone know the password?
« Reply #9 on: October 05, 2013, 03:04:56 AM »

Wonderful! Thank you so much for sharing. I confirm this password works for me.

Sadly, I'm not normally on site where this camera is at, and had but little time for more than just testing the password. But I did get in, and could see, for example, /etc/resolv.conf has a single line of nameserver 192.168.1.1. (Never mind that that's the default network, not what it has since been changed to.)
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2028
Re: nmap says ssh on 8992, anyone know the password?
« Reply #10 on: October 05, 2013, 03:51:07 PM »

Got it! Success!!!
Don't forget that i'm using DCS-2210, so password for 2132L may be different. Username for my camera's ssh is root and the password is tms320dm365. Thanks to many peoples who helped me a lot while i worked on searching of this password! Enjoy!

That's the name of a TI chip.

 https://www.google.com/search?q=tms320dm365

datasheet/specs

http://www.ti.com/product/tms320dm365


« Last Edit: October 05, 2013, 03:53:08 PM by RYAT3 »
Logged

fousa

  • Level 2 Member
  • **
  • Posts: 46
Re: nmap says ssh on 8992, anyone know the password?
« Reply #11 on: October 10, 2013, 07:27:18 AM »

First of all, I would like to thanks evilslon for the effort.

I've been exploring the system. DCS-2332L here.

The camera is based on MontaVista Linux Professional Edition 5.
Processor: ARM926EJ-S rev5
Hardware: DaVinci DM365 IPNC

Videos e Pictures in /mnt/mmc

Now, what are the useful applications of this discovery? Can all share?

I already have 2 applications.
1- My camera creates hundreds of .log files, I don't know why. I reported and didn't get an answer so I run a command to delete all.
find /mnt/mmc/ -name "*.log" -print0 | xargs -0 rm -rf

2- I want to send all videos at once to a FTP, not just one at time of the motion. Didn't had success with polling scp. Discovered system have a ftpput. So I used it.
find /mnt/mmc/Video/ -name "*.avi" | while read filename; do /usr/bin/ftpput -v -u YOUR_FTP_USER -p YOUR_FTP_PASS IP_OR_DOMAIN:21 /FTP_FOLDER/${filename##*/} $filename; done;

I'm also trying a service that moves files from FTP to dropbox automatically.
« Last Edit: October 10, 2013, 07:42:46 AM by fousa »
Logged

bs27975

  • Level 2 Member
  • **
  • Posts: 61
Re: nmap says ssh on 8992, anyone know the password?
« Reply #12 on: October 10, 2013, 08:30:14 AM »

Very cool, thanks for sharing.

Presumably one could set up a cronjob from another system to do such maintenance, even.

(Might consider djmount for upnp file manipulation too, for that matter.)

And if you are able to set up a user / certificate, should be able to do so passwordless.

Seem like you should be able to scp directly into your dropbox folder, and avoid ftp entirely.

For 1., you might consider find /mnt/mmc/ -name "*.log" -delete

For 2., you might consider sshfs

[Never mind the scp comment, just noticed you tried it. Oops.]
« Last Edit: October 10, 2013, 08:33:31 AM by bs27975 »
Logged

camaro4life18

  • Level 1 Member
  • *
  • Posts: 1
Re: nmap says ssh on 8992, anyone know the password?
« Reply #13 on: July 04, 2014, 07:55:28 AM »

When I try to putty into the camera on port 8992, all I see is this...

SSH-2.0-OpenSSH_4.4


I don't get a prompt to login with.
Logged