Hack de décodeur SFR

[thxer]

Je reprends donc ta recherche dans le but final de produire un script permettant le contrôle du décodeur via le réseau.
J'effectue en ce moment le scan nmap et poste le retour.
Quand j'aurai un peu plus de temps j'irai plus loin dans la recherche.

A savoir qu'un scan trop approfondit fait crasher la box et la met en sécurité totale.

---

Résultat du scan :

Code BASH :



14:02:57 user@n-pn:~# nmap -sS -sU -T4 -A -v 192.168.1.86

Starting Nmap 6.25 ( http://nmap.org ) at 2013-05-24 14:03 CEST
NSE: Loaded 106 scripts for scanning.
NSE: Script Pre-scanning.
Initiating ARP Ping Scan at 14:03
Scanning 192.168.1.86 [1 port]
Completed ARP Ping Scan at 14:03, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 14:03
Completed Parallel DNS resolution of 1 host. at 14:03, 0.01s elapsed
Initiating SYN Stealth Scan at 14:03
Scanning NETGEM-XXXXX (192.168.1.86) [1000 ports]
Discovered open port 80/tcp on 192.168.1.86
Completed SYN Stealth Scan at 14:03, 0.62s elapsed (1000 total ports)
Initiating UDP Scan at 14:03
Scanning NETGEM-XXXXXX (192.168.1.86) [1000 ports]
Increasing send delay for 192.168.1.86 from 0 to 50 due to max_successful_tryno increase to 5
Increasing send delay for 192.168.1.86 from 50 to 100 due to max_successful_tryno increase to 6
Warning: 192.168.1.86 giving up on port because retransmission cap hit (6).
Increasing send delay for 192.168.1.86 from 100 to 200 due to 11 out of 11 dropped probes since last increase.
Increasing send delay for 192.168.1.86 from 200 to 400 due to 11 out of 11 dropped probes since last increase.
UDP Scan Timing: About 6.34% done; ETC: 14:11 (0:07:38 remaining)
Increasing send delay for 192.168.1.86 from 400 to 800 due to 11 out of 11 dropped probes since last increase.
UDP Scan Timing: About 9.60% done; ETC: 14:13 (0:09:34 remaining)
UDP Scan Timing: About 13.03% done; ETC: 14:14 (0:10:07 remaining)
UDP Scan Timing: About 34.53% done; ETC: 14:17 (0:09:31 remaining)
UDP Scan Timing: About 41.21% done; ETC: 14:18 (0:08:43 remaining)
UDP Scan Timing: About 47.36% done; ETC: 14:18 (0:07:55 remaining)
UDP Scan Timing: About 52.89% done; ETC: 14:18 (0:07:09 remaining)
UDP Scan Timing: About 58.41% done; ETC: 14:18 (0:06:21 remaining)
UDP Scan Timing: About 64.09% done; ETC: 14:18 (0:05:32 remaining)
UDP Scan Timing: About 69.30% done; ETC: 14:18 (0:04:45 remaining)
UDP Scan Timing: About 74.36% done; ETC: 14:18 (0:03:57 remaining)
UDP Scan Timing: About 79.57% done; ETC: 14:18 (0:03:10 remaining)
UDP Scan Timing: About 84.80% done; ETC: 14:18 (0:02:22 remaining)
UDP Scan Timing: About 90.01% done; ETC: 14:18 (0:01:33 remaining)
UDP Scan Timing: About 95.14% done; ETC: 14:18 (0:00:46 remaining)
Completed UDP Scan at 14:19, 974.83s elapsed (1000 total ports)
Initiating Service scan at 14:19
Scanning 16 services on NETGEM-XXXXX(192.168.1.86)
Service scan Timing: About 6.25% done; ETC: 14:32 (0:12:00 remaining)
Completed Service scan at 14:21, 116.19s elapsed (16 services on 1 host)
Initiating OS detection (try #1) against NETGEM-XXX (192.168.1.86)
Retrying OS detection (try #2) against NETGEM-XXX (192.168.1.86)
Retrying OS detection (try #3) against NETGEM-XXX (192.168.1.86)
Retrying OS detection (try #4) against NETGEM-XXX (192.168.1.86)
Retrying OS detection (try #5) against NETGEM-XXX (192.168.1.86)
NSE: Script scanning 192.168.1.86.
Initiating NSE at 14:21
Completed NSE at 14:22, 30.12s elapsed
Nmap scan report for NETGEM-XXX (192.168.1.86)
Host is up (0.0024s latency).
Not shown: 1984 closed ports
PORT      STATE         SERVICE        VERSION
80/tcp    open          http?
| http-methods: GET POST HEAD OPTIONS SUBSCRIBE
| Potentially risky methods: SUBSCRIBE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
|_http-title: netbox HTTP server - Error 403
68/udp    open|filtered dhcpc
135/udp   open|filtered msrpc
434/udp   open|filtered mobileip-agent
775/udp   open|filtered acmaint_transd
1040/udp  open|filtered netarx
1900/udp  open|filtered upnp
6971/udp  open|filtered unknown
18360/udp open|filtered unknown
21967/udp open|filtered unknown
25157/udp open|filtered unknown
32769/udp open|filtered filenet-rpc
47808/udp open|filtered bacnet
49161/udp open|filtered unknown
49222/udp open|filtered unknown
61319/udp open|filtered unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port80-TCP:V=6.25%I=7%D=5/24%Time=519F5ADA%P=x86_64-unknown-linux-gnu%r
SFGetRequest,131,"HTTP/1\.0\x20403\x20Forbidden\r\nDate:\x20Fri,\x2024\x
...</html>");
MAC Address: XXXXX (Netgem)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=6.25%E=4%D=5/24%OT=80%CT=1%CU=2%PV=Y%DS=1%DC=D%G=Y%M=000430%TM=51
OS:9F5B72%P=x86_64-unknown-linux-gnu)SEQ(SP=BD%GCD=1%ISR=C0%TI=Z%CI=Z%II=I%
OS:TS=7)OPS(O1=M5ACST11NW0%O2=M5ACST11NW0%O3=M5ACNNT11NW0%O4=M5ACST11NW0%O5
OS:=M5ACST11NW0%O6=M5ACST11)WIN(W1=1680%W2=1680%W3=1680%W4=1680%W5=1680%W6=
OS:1680)ECN(R=Y%DF=Y%T=40%W=16B0%O=M5ACNNSNW0%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=1680%S=O%A=S+%F=AS%O=M5ACST1
OS:1NW0%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=4
OS:0%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=16
OS:4%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 1.768 days (since Wed May 22 19:56:28 2013)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=189 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE
HOP RTT     ADDRESS
1   2.40 ms NETGEM-XXXX (192.168.1.86)

NSE: Script Post-scanning.
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1134.34 seconds
           Raw packets sent: 2515 (93.647KB) | Rcvd: 2134 (105.305KB)