terça-feira, 13 de junho de 2017

Lenco WiFi Radio - DIR 100 : Telnet Access

Last week I got a new gadget, a Alarm Clock/WiFi Radio that can also play music from USB or UPNP or DLNA.


Pretty nice. But I want to know MORE.
Opened up NMap and scanned the Radio for open ports:


PORT     STATE SERVICE VERSION

23/tcp   open  telnet  security DVR telnetd (many brands)

80/tcp   open  http    AGK WiFi Internet radio http config

|_http-server-header: magic iradio

|_http-title: AirMusic

8080/tcp open  http    BusyBox httpd 1.13

MAC Address: XX:XX:XX:XX:XX:XX (Shenzhen Bilian Electronicltd)



Oh, hello there telnet, and it also has a webserver.
The webserver is probably incomplete:


 
Nothing is clickable, and the images aren't loading.

But the telnet, I searched the web for similar radios, and found a GitHub link: https://github.com/kayrus/iradio
login: root
password: password

There we go, we're in.
Inside the UIData folder there are some .bin files. I guess they are some kind of images. I opened a few in notepad++ and:
 


 
 
 
 
 
Hmm you can't see it? Let me give you a hand:


 
 
 
 
 
 
Yes, thats a "text" ascii like battery icon. The file name is "bat_1_step.bin" 

And thats all for now. Going to mess more with this after my finals.


Edit:
Found more info: https://sites.google.com/site/tweakradje/devices/abeo-internet-radio

Also here are the images with a better look:
 
 


A "colorful" 7:
 



A Bw 7: