Emtec N200: Network footprint

The N200 runs Linux and is network-enabled by default. It supports local storage (USB and SD-Card). As such I bought it hoping I could extend it in ways not originally intended by the device manufacturer. Lets get to work:

A network scan reveals some interesting details:

# nmap n200
Starting Nmap 4.76 ( http://nmap.org )
Interesting ports on 192.168.n2.00:
Not shown: 997 closed ports
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
8082/tcp open blackice-alerts
MAC Address: 00:CE:39:DE:DB:EF (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.89 seconds

Port 80 was to be expected, everything these days has a web-interface, however functional. Port 23 for Telnet was a happy discovery, and promised deep-level access into the device.

On port 23 we find the expected login prompt, and we get a root shell without a password. Swell. We will set a password later on.

Unfortunately, the N200 doesn't have netstat -plunt, even worse, it has no netstat at all.

Edit: I found a compatible busybox binary with netstat builtin.

/tmp/usbmounts/sda1/bin # ./busybox1.9.1 netstat -lunt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8082 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN
udp 0 0 0.0.0.0:8086 0.0.0.0:*
udp 0 0 0.0.0.0:54450 0.0.0.0:*
udp 0 0 0.0.0.0:1900 0.0.0.0:*

Even more unknown ports! 1900 is supposed to be UPNP. Through testing, the 'DvdPlayer' binary is known to be the one using all these ports. But what for?

Note: Anybody know a way to show listening ports (with processes) without netstat?

I turned to the webpage, hoping for something that resembles the web interface of my Dreambox 800, including a PDA-usable virtual remote control. Some pointers pertaining to Port 8082, perhaps it being the admin port for some software component, like a builtin transcoding UPNP MediaServer ... </wishful_thinking>

The webpage was -well- rather limited. I suppose its useful for the integer-adding-impaired, but apart from that? Back at the root shell, with ps we find inetd running, enabled services are telnetd and httpd, both of which are symbolic links in /usr/sbin/ pointing to busybox.

Inspecting the contents of /var/www/cgi-bin/ it becomes visible, that the webpage summing up 2 number is meant to demonstrate the ease at which one could add more functionality through simple shell scripts.

All this is great news, but we still don't know what Port 8082 is about? It's probably not 'blackice-alerts'!

I tried connecting to it, which worked, but after that i pretty much hit a dead end for now:

# telnet n200 8082
Trying 192.168.N2.00...
Connected to 192.168.N2.00.
Escape character is '^]'.
help
?
test
W
X
menu
^]
telnet> quit
Connection closed.

No matter, what I typed, no returned output at all.

Thanks for reading; if you have some useful info (or praise), please do leave a comment.

Examining N200: 'DvdPlayer' - The Main program (Part1)

Startup & commandline options

The main program on the Emtec N200 is DvdPlayer. It resides in /usr/local/bin. The script to start it is /usr/local/etc/rcS. DvdPlayer itself then creates a few dozen forks.
After telneting to the Device, the command stopall allows the user to shutdown the GUI. Following that it is possible to relaunch it with commandline options.

To find out the available options:

/usr/local/bin # DvdPlayer --help
CMD: mkdir -p /tmp/netb/smb
In my system...
CMD: mkdir -p /tmp/smb
In my system...
CMD: ifconfig > /tmp/netb/samba_my_ip
In my system...
file system 2, sector 4294966272
mount to /usr/local/etc/hdd/volumes/HDD1
file system 4, sector 262144
mount to na
file system 3, sector 262144
mount to /usr/local/etc/hdd/root
MediaServer.cpp , 433 bind local IP fail !!error = Unknown error 125
station id [467] not found!
station id [2049] not found!

mele_iradio_init ok!

s_n_stations = 236

GrandMa Revision: 188778
rev: v7.1.1 r1193 by fengyh@MeleSoft at Jul 22 15:39:16 2009
Unrecognized option: --
DvdPlayer: -h -l [on/off] -o -p -f [NTSC/PAL]
-h: help
-l [on/off]: user input logging switch, defaultly off
-o : output file for output. Defaultly log.txt will be written
-p : output file for timing information logging
-f [NTSC/PAL]: select TV system (encoder)
-s [POWER/EJECT/RTC]: select start mode
-r [0/1/2/3/4/5/6/7/8]: set region code
-A : audio dumpfile
-V : video dumpfile
-S : size for debug memory
-t: calulate AP starting time

mele_iradio_release !


I'm not quite sure, what the first block of messages is trying to tell me, but the lower half is quite helpful. There are also some terms that seem noteworthy, like mele_iradio, MediaServer and GrandMa Revision. The Firmware version number Emtec uses is also contained here (rev: v7.1.1 r1193)

If you can shed some light on the meaning of the first half, please do so in the comments section. I will soon publish another post about the actual options, and how they can be applied in a permanent fashion.

Thanks for reading.