i`ve connected with winscp, scp protocol, root, cisco2016*
found:
/etc/nk_sysconfig (line 2534+, no ddns entries)
/etc/flash/etc/nk_sysconfig (2610+, shows my ddns entries)
/tmp/nk_sysconfig (shows my ddns entries. i think its the 24h temporary config, that will stored after 24h from tmp to the resistend flash?)
-------------- snip - interesting part of the config file ---------------------------------
[DDNS1]
ID="STATUS="NO"&SERVICE="dyndns"&USERNAME=""&PASSWORD=""&HOSTNAME=""&RESULT="""
ID="STATUS="YES"&SERVICE="3322"&USERNAME="DOMin8or"&PASSWORD="dslrxxxxxxxx969"&HOSTNAME="mydomain.spdns.de"&RESULT="""
ID="STATUS="NO"&SERVICE="qnodns"&USERNAME=""&PASSWORD=""&HOSTNAME=""&RESULT=""&"
NUMBER=3
[DDNS2]
ID="STATUS="YES"&SERVICE="dyndns"&USERNAME="DOMin8or"&PASSWORD="dslrxxxxxxx969"&HOSTNAME="mydomain.spdns.de"&RESULT="""
ID="STATUS="NO"&SERVICE="3322"&USERNAME=""&PASSWORD=""&HOSTNAME=""&RESULT="""
ID="STATUS="NO"&SERVICE="qnodns"&USERNAME=""&PASSWORD=""&HOSTNAME=""&RESULT=""&"
NUMBER=3
---------------snap---- end of the interesting part from config file------------------------
webinterface base folder:
/usr/local/EasyAccess/www/cgi-bin
/usr/local/EasyAccess/www/htdocs
website for dyndns config
/usr/local/EasyAccess/www/htdocs/adv_ddns.htm
/usr/local/EasyAccess/www/htdocs/edit_adv_ddns.htm
(this does the input field check, could be tricked to insert complete update url incl all user data)
unfortunaley the base update adress, 3322.org & dyndns.org seems to be hardcoded.
i havent found any script.
only on github i found an interesting file, but it is already compiled. that suxx for my skillz.
if i have the sourcecode in a higher level language, i think i can modify it.
https://github.com/odit/rv042/tree/mast ... dns_update
on the cisco, the bin file is under:
/bin/ddns_update
if i call it, it answear:
~ # ddns_update
DDNS1 ID 3 = [NO]
DDNS2 ID 3 = [NO]
DDNS3 ID 3 = [NO]
DDNS4 ID 3 = [NO]
DDNS1 ID 3 = [NO]
DDNS2 ID 3 = [NO]
DDNS3 ID 3 = [NO]
DDNS4 ID 3 = [NO]
no --help possible.
it seems hardcoded and i want to see inside
![Souriant :-)](./images/smilies/icon_e_smile.gif)
maybe the hardcodet source could be modified a little bit, that the url from the form/config file
is called only, instead of of the hardcoded adresses.
everything what we need to call ddns_update, is inside the config file/webinterface.
loginname, password, update url. there is absolutely no need to bind dyndns.org or 3322.org to the variables...
i think its done by changing one line in the source, maybe deleting some useless crap lines.
alternativly it could complete replaced by better readable cgi script?
thx
update, i uploaded the bin file to an online disassembler, but i havent found the hardcoded part.
the disassembler is interesting and shows clearnames for the functions. but not comparable to ida. it shows not the referred textblocks. it looks horrible.
https://www.onlinedisassembler.com/odaweb/cDP4dBRX
Project:
File: ddns_update
Format: ELF 64-bit MSB executable
MIPS
MIPS64 rel2 version 1 (SYSV)
dynamically linked (uses shared libs)
for GNU/Linux 2.6.13
not stripped
Size: 41.7 KB
MD5: 02336de38783c9b2577ca245a2d1ae5e
SHA-1: 19e42a88216ad56a99f05f5903a0d010c11150ed
Address Type Name
0x120001460 T _init
0x1200014e0 T __start
0x120001530 t hlt
0x120001540 t call_gmon_start
0x120001570 t __do_global_dtors_aux
0x1200015e8 t frame_dummy
0x120001620 T find_special_word
0x1200016a0 T Generate_DDNS_Update_Header
0x1200016c4 T isService
0x12000176c T isWanIp
0x12000180c T isWan
0x1200018ac T printHex_T
0x120001a18 T setDdnsStatus
0x120001afc T Generate_DDNS_Update_Packet
0x120001edc T Converse_Wire_To_Name
0x120001f58 T parseRecvbuf
0x1200025b0 T getWanIp
0x120002654 T Converse_Name_To_Wire
0x12000277c T Generate_Zone_Section
0x1200027d0 T strncpyz
0x12000282c T Generate_Update_Section
0x1200028d4 T getTimeStatus
0x120002a94 T getNowTime
0x120002c74 T hmac_md5
0x120002e3c T Generate_TSIG_Sigature
0x1200031e0 T Generate_Additional_Section
0x1200032a8 T Generate_DNS_Messages
0x120003378 T ddns_printf
0x120003418 T name_get_value
0x120003604 T setQDns
0x1200039bc T Ddns_Main
0x120003da4 T isDdnsEnable
0x120003e70 T main
0x1200041f0 T base64enc
0x1200042cc T base64dec
0x120004428 T base_printf
0x1200044d0 T MD5Init
0x12000450c t Encode
0x120004588 t MD5_memcpy
0x1200045b4 t MD5_memset
0x1200045d8 t MD5Transform
0x1200053b0 T MD5Update
0x1200054dc T MD5Final
0x1200055b0 T __libc_csu_fini
0x1200055b8 T __libc_csu_init
0x120005670 t __do_global_ctors_aux
0x1200056e0 t .MIPS.stubs
0x120005900 T _fini
a C decomiler would be nicer... or the original source in C, or what ever it was.