View source for HNAP0wn: The Home Network Administration Protocol Owner

 ██╗  ██╗███╗   ██╗ █████╗ ██████╗  ██████╗ ██╗    ██╗███╗   ██╗
 ██║  ██║████╗  ██║██╔══██╗██╔══██╗██╔═████╗██║    ██║████╗  ██║
 ███████║██╔██╗ ██║███████║██████╔╝██║██╔██║██║ █╗ ██║██╔██╗ ██║
 ██╔══██║██║╚██╗██║██╔══██║██╔═══╝ ████╔╝██║██║███╗██║██║╚██╗██║
 ██║  ██║██║ ╚████║██║  ██║██║     ╚██████╔╝╚███╔███╔╝██║ ╚████║
 ╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝      ╚═════╝  ╚══╝╚══╝ ╚═╝  ╚═══╝

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">&#9432; Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>
</div>

<h2>Summary</h2>
<p style="text-align: justify">HNAP0wn is a graphical tool that allows us to find devices that use the Home Network Administration Protocol (HNAP) <b>([[File:HNAP Protocol.pdf]])</b>, collect information about them, and inject commands. These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See [[#Requirements |deployment]] for notes on how to deploy the project on a live system.</p>

<h2>Home Network Administration Protocol (HNAP)</h2>
<p style="text-align: justify">HNAP is a network device management protocol that allows network devices to be silently managed and administered. HNAP is based on SOAP. HNAP was designed to be a simple, lightweight protocol that is easy to implement inside of small cost-constrained hardware such as the devices used in this examination. Cisco promised three high-level benefits to vendors for implementing HNAP in a network device <sup>[https://www.cisco.com/web/partners/downloads/guest/hnap_protocol_whitepaper.pdf]</sup>:</p>
<ol>
   <li><u>Accurate topology discovery</u>:  A network device can accurately describe itself to applications that support HNAP and show detailed information about the device.</li>
   <li><u>Custom task extensibility</u>: For example, when a device with HNAP support is selected in an application, tasks related to that device can be displayed.</li>
   <li><u>Programmable API</u>: The fully programmable API suite allows devices’ network connections to be remotely managed and administered.</li>
</ol>
<p style="text-align: justify">The participants in any HNAP interaction define the two roles – an HNAP server and an HNAP client. HNAP servers are typically implemented inside of networking devices to be managed. HNAP clients are usually software applications residing on PCs or other devices that can interact with an HNAP server in order to manage it, and ultimately, the device. <sup>[https://www.cisco.com/web/partners/downloads/guest/hnap_protocol_whitepaper.pdf]</sup> A typical client-server interaction begins when a client has discovered an HNAP server on a network. It issues an HNAP discovery command in order to determine the capabilities of the device. A client then proceeds to make one or more HNAP requests to the server, which performs the desired action and returns the response.</p>

<p style="text-align: justify">One can simply query all supported HNAP actions from a device by requesting the URL http://$DEVICE_IP/HNAP1/ from a web client. Since HNAP is encapsulated in HTTP, it is also the best way to determine if a device is HNAP-enabled since such devices need to reply to this request. In case of the [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|DCH-S150 Motion Sensor]] the output of that link is listed below. There may be more or less SOAPactions available depending on the devices' configuration.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">&#9432; <nowiki>http://DCH-S150/HNAP1/</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 10px !important">
 <nowiki>
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <GetDeviceSettingsResponse xmlns="http://purenetworks.com/HNAP1/">
            <GetDeviceSettingsResult>OK</GetDeviceSettingsResult>
            <Type>ConnectedHomeClient</Type>
            <DeviceName>MotionSensorDLink</DeviceName>
            <VendorName>D-Link</VendorName>
            <ModelDescription>D-Link Motion Detector</ModelDescription>
            <ModelName>DCH-S150</ModelName>
            <DeviceMacId>C4:12:F5:1C:8E:4C</DeviceMacId>
            <FirmwareVersion>1.23</FirmwareVersion>
            <FirmwareRegion>Default</FirmwareRegion>
            <LatestFirmwareVersion/>
            <HardwareVersion>A1</HardwareVersion>
            <HNAPVersion>0124</HNAPVersion>
            <PresentationURL>http://dch.local</PresentationURL>
            <CAPTCHA></nowiki><b style="color: lightblue">false</b><nowiki></CAPTCHA>
            <ModuleTypes>
                <string>Motion Sensor</string>
            </ModuleTypes>
            <SOAPActions>
                <string>http://purenetworks.com/HNAP1/Reboot</string>
                <string>http://purenetworks.com/HNAP1/SetFactoryDefault</string>
                <string>http://purenetworks.com/HNAP1/IsDeviceReady</string>
                <string>http://purenetworks.com/HNAP1/GetDeviceSettings</string>
                <string>http://purenetworks.com/HNAP1/SetDeviceSettings</string>
                <string>http://purenetworks.com/HNAP1/GetDeviceSettings2</string>
                <string>http://purenetworks.com/HNAP1/SetDeviceSettings2</string>
                <string>http://purenetworks.com/HNAP1/GetGroupSettings</string>
                <string>http://purenetworks.com/HNAP1/SetGroupSettings</string>
                <string>http://purenetworks.com/HNAP1/GetSystemLogs</string>
                <string>http://purenetworks.com/HNAP1/CleanSystemLogs</string>
                <string>http://purenetworks.com/HNAP1/GetModuleSchedule</string>
                <string>http://purenetworks.com/HNAP1/SetModuleSchedule</string>
                <string>http://purenetworks.com/HNAP1/GetModuleEnabled</string>
                <string>http://purenetworks.com/HNAP1/SetModuleEnabled</string>
                <string>http://purenetworks.com/HNAP1/GetModuleProfile</string>
                <string>http://purenetworks.com/HNAP1/SetModuleProfile</string>
                <string>http://purenetworks.com/HNAP1/GetModuleSOAPActions</string>
                <string>http://purenetworks.com/HNAP1/GetTimeSettings</string>
                <string>http://purenetworks.com/HNAP1/SetTimeSettings</string>
                <string>http://purenetworks.com/HNAP1/GetModuleGroup</string>
                <string>http://purenetworks.com/HNAP1/SetModuleGroup</string>
                <string>http://purenetworks.com/HNAP1/GetScheduleSettings</string>
                <string>http://purenetworks.com/HNAP1/SetScheduleSettings</string>
                <string>http://purenetworks.com/HNAP1/GetRecursiveSchedule</string>
                <string>http://purenetworks.com/HNAP1/SetRecursiveSchedule</string>
                <string>http://purenetworks.com/HNAP1/GetFirmwareStatus</string>
                <string>http://purenetworks.com/HNAP1/GetFirmwareValidation</string>
                <string>http://purenetworks.com/HNAP1/StartFirmwareDownload</string>
                <string>http://purenetworks.com/HNAP1/PollingFirmwareDownload</string>
                <string>http://purenetworks.com/HNAP1/CheckNewFirmware</string>
                <string>http://purenetworks.com/HNAP1/SettriggerADIC</string>
                <string>http://purenetworks.com/HNAP1/GetInternetSettings</string>
                <string>http://purenetworks.com/HNAP1/GetCurrentInternetStatus</string>
                <string>http://purenetworks.com/HNAP1/GetWLanRadios</string>
                <string>http://purenetworks.com/HNAP1/SetTriggerWirelessSiteSurvey</string>
                <string>http://purenetworks.com/HNAP1/GetSiteSurvey</string>
                <string>http://purenetworks.com/HNAP1/SetAPClientSettings</string>
                <string>http://purenetworks.com/HNAP1/GetAPClientSettings</string>
            </SOAPActions>
            <SubDeviceURLs/>
        </GetDeviceSettingsResponse>
    </soap:Body>
</soap:Envelope>
</nowiki>
</div>
</div>
</div>

<h2>Requirements</h2>
* PHP 5 Server or newer
* ECMAScript 6 [[#Compatible Browsers|Compatible Browser]]
* Optional: Nmap

<h2>Deployment</h2>
Get your copy from [[#GitLab|GitLab]]. Start the local PHP server using the <i>run.sh</i> script and open this link in browser: http://127.0.0.1:8080

 sudo bash HNAP0wn/run.sh

<p style="text-align: justify"><b>Info</b>: Port may differ. Check run.sh stdout to get the assigned port.</p>

<h2>Usage</h2>
[[file:HNAP0wn.png|400px|right|thumb|Example Usage]]
<h3>Scan Network</h3>
<p style="text-align: justify">Executes an underlying Nmap scan and displays HNAP enabled hosts together with additional information.</p>
* Located in the Sidebar. (<i>Green</i>) 
* Provides different Scan modes. (<code>Fast</code>, <code>Slow</code>, <code>Custom</code>)

<b>Info</b>: The <code>Custom</code> scan mode gives the possibility to define Nmap parameters.

<h3>Target Device</h3>
<p style="text-align: justify">Gather information about a HNAP enabled device.</p>
* Located in the Sidebar. (<i>Green</i>) 
* Provides an input field for the target IP address 
* Provides two modes. (<code>Get Device Settings</code>, <code>Brute Force Password</code>)

<b>Info</b>: <code>Target IP</code> address needs to be set! No <code>Password</code> nor <code>Username</code> needed at this point.

<h4>Get Device Settings</h4> 
<p style="text-align: justify">Displays device information gathered via <code><nowiki>http://$IP/HNAP1/</nowiki></code> and extends the sidebar by all supported HNAP actions available executables for the target device.</p>

<h4>Brute Force Password</h4> 
<p style="text-align: justify">Tries all numeric combinations from <code>000000</code> to <code>999999</code> until a HNAP login was succesfull.</p>

<p style="text-align: justify"><b>Info</b>: The Username <code>Admin</code> and Password <code>000000</code> is used to initialize if none was set manually.</p>
<p style="text-align: justify"><b>Info</b>: The keyspace of <code>^[0-9]{6}$</code> is adapted for use with [[Examination_of_mydlink™_home_devices|mydlink™ home devices]].</p>

<h3>Exploit</h3>
<p style="text-align: justify">Area to define <code>Username</code> and <code>Password</code>. These credentials are used to inject HNAP Actions discovered via <code>Get Device Settings</code>.</p>
* Located in the Sidebar. (<i>Green</i>) 
* Provides an input field for the <code>Username</code> and <code>Password</code>.

<p style="text-align: justify"><b>Info</b>: If <code>Brute Force Password</code> was previously run with success, then <code>Username</code> and <code>Password</code> are already set.</p>

<h4>HNAP Actions</h4>
<p style="text-align: justify">Loaded after successfully executing <code>Get Device Settings</code>. Grouped into different groups. (<code>Method</code>, <code>Getter</code>, <code>Setter</code>, <code>Getter & Setter</code>)</p>
* Loaded at the bottom of the Sidebar. (<i>Green</i>) 
* Provides a button for every available action.

<b>Info</b>: Non-working HNAP actions may need a more complex SOAP action syntax, which could not be generated dynamically. In these cases use the <code>Custom</code> mode. Information about the correct syntax may be found here: [[File:HNAP Protocol.pdf]]

<h4>Simple</h4>
Simple actions executed once clicked on the according button in the sidebar. Results are displayed in the main container. (<i>Grey</i>)  
Simple actions span over the following the groups: <code>Method</code>, <code>Getter</code>, <code>Setter</code>

<b>Info</b>: <code>Reboot</code> and <code>SetFactoryDefaults</code> require confirmation.
 
<h4>Getter / Setter</h4>
When executing this kind of action, the <code>Getter</code> action is executed on click, while the resulting table gives the possibility to change its values and send the update via the matching <code>Setter</code> action.

<b>Info</b>: The result of a <code>Getter</code> is considered as a template to use it with its <code>Setter</code>.

<h4>Custom</h4>
More complex HNAP actions can be executed here. Set HNAP action and parameters manually.

<b>Info</b>: For advanced users experienced with the HNAP xmlns.

<h3>Terminal</h3>
Terminal emulation. Commands are executed by the local PHP server as sudoer and results are returned.
* Located at the bottom. (<i>Black</i>)
* Locally catched commands: <code>history</code>, <code>clear</code>, <code>!^[0-9]$</code>
* Arrow up and down to navigate through the history.

<b>Info</b>: Use deterministic commands only. Timeout after 30s execution time.

<h2>Additional Information</h2>
<h3>GitLab</h3>
* https://git.fh-campuswien.ac.at/JPDoe/hnap0wn

<h3>Demo</h3>
<span style="font-size: 50px; line-height: 50px; padding-left: 10px">
[[File:HNAP0wn_Structure_and_Execution.mov]]
[[File:HNAP0wn_Structure_and_Execution.mp4]]
[[File:HNAP0wn_Structure_and_Execution.webm]]
</span>

<h3>License</h3>
This project is licensed under the MIT License.

<h3>Compatible Browsers</h3>
* Chrome: ≥58
* Edge: ≥14
* Firefox: ≥54
* Safari: ≥10
* Opera: ≥55 

<h3>Development Environment</h3>
<h4>Localhost</h4>
* MacOS Mojave 10.14.4 (18E226)
* Darwin Kernel 18.5.0 x86_64
* Chrome 75.0.3770.142 (Official Build) (64-bit)
* PHP 7.1.23 Development Server
* Nmap 7.70

<h4>Tested devices</h4>
<ul>
   <li>[[D-LINK® DCH-G020 Gateway Connected Home Hub|D-Link® DCH-G020 Gateway Connected Home Hub]]</li>
   <li>[[D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|D-Link® DCH-S150 Home Wi-Fi Motion Sensor]]</li>
</ul>

<h2>Related Work</h2>
<ul>
   <li>[[Examination_of_mydlink™_home_devices]]</li>
</ul>

[[Category:Documentation]]