Default ssh credentials from the Rigol DHO814 - Page 1
Forum section: electronics / testgear

author: user1783
author_rank: Newbie
timestamp: January 10, 2024, 11:02:16 pm
content: Hello together,I have the Rigol DHO814 Oscilloscope. I have connected the scope via LAN to my test / labor Network. By performing of a nmap scan i have identified, that there is a ssh server on the scope available.Does someone know the default credentials because on the Internet I find nothing.BR

author: cte
author_rank: Regular Contributor
timestamp: January 13, 2024, 05:03:37 pm
content: I don't know the root password, but the Rigol DHO800/900 series runs on Android, so you can use theandroid debug bridgefor shell access.adb connect <ip-address>:55555adb shellUPDATE:UserRandy222posted a pretty good description here:https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5280037/#msg5280037

author: ebastler
author_rank: Super Contributor
timestamp: January 13, 2024, 07:52:04 pm
content: According tothis post, ftp access works with user "admin" and password "rigol". Any chance those credentials might work for ssh also?

author: gabiz_ro
author_rank: Regular Contributor
timestamp: January 13, 2024, 08:52:11 pm
content: I may be wrong but ssh server is started but without any configuration loaded to say so.If my memory doesn't trick me even with known password can't connect.In other words ssh server is started but config files aren't present at expected path.There is a script startssh that pass arguments for files path, never tried direct but after kill ssh process and run startssh worked.You may also generate and replace id_rsa key and other required files with your keysFor Rigol default you may use a good gpu and hashcat to crack the keyTo not spend much time password is seven letter long, just for testing.I do this and find password to be adilzhu

author: Fungus
author_rank: Super Contributor
timestamp: January 13, 2024, 09:17:09 pm
content: I don't think it will do much anyway.ADB is much more useful.

author: cte
author_rank: Regular Contributor
timestamp: January 13, 2024, 10:30:47 pm
content: None of the username / password combinations worked.But the ssh server has public key authentication enabled. You can use adb to add your own public key to /data/ssh/authorized_keys. The file will be overwritten with default values on the next reboot, though.❯ ssh -oHostKeyAlgorithms=+ssh-rsa root@172.23.0.109Host key fingerprint is SHA256:T/ZGjMJBBlryAc60zFdp7ydOMsvJUQCk/OqYz0ytCJ8+---[RSA 2048]----+| +o*o+. || B B =+ || X o..o || o . .oo || . So+ o || o +=+o. ||. o .o O.oo || o X . = .. || E.* |+---------+rk3399_rigol:/ # iduid=0(root) gid=0(root) groups=0(root),rk3399_rigol:/ # uname -aLinux localhost 4.4.126 #72 SMP PREEMPT Tue Jul 18 13:47:35 CST 2023 aarch64rk3399_rigol:/ # uptime06:29:19 up 44 min, 0 users, load average: 4.14, 4.25, 4.10rk3399_rigol:/ #BTW: There are three public keys enabled by default:adil@ubuntu-SSD,sj03955@rigol.comandandroid@rigol.com. So whoever has the matching private key can log in to your scope should you open port 22 to the public.

author: lownoise
author_rank: Contributor
timestamp: January 14, 2024, 05:38:07 am
content: You can put your key at the end of start_rigol_app.sh, then it will be loaded at every start.Btw, with ">>" the key will be added, with ">" the other three keys will be overwritten

author: Randy222
author_rank: Frequent Contributor
timestamp: January 15, 2024, 03:22:03 pm
content: Quote from: lownoise on January 14, 2024, 05:38:07 amThat doesn't work for me./system is a ro filesystem by the time that start script runs.I will post full how-to SSH in the hacking thread -->https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/@cte , it could be for support reasons? I have seen such with other vendors for other products, they tell you "open ssh for my IP", then ssh in to poke around at the problem you created. But yeah, do not expose you scope to public.

author: gabiz_ro
author_rank: Regular Contributor
timestamp: January 15, 2024, 04:51:59 pm
content: you may remount /system as rw

author: Randy222
author_rank: Frequent Contributor
timestamp: January 15, 2024, 04:58:24 pm
content: Quote from: gabiz_ro on January 15, 2024, 04:51:59 pmyes, but from when/where you do it matters.in via adb as su - (aka root), amount -o remount,rw /systemfails.if I remount direct from adb, it works.

author: lownoise
author_rank: Contributor
timestamp: January 15, 2024, 05:27:51 pm
content: There are two authorized_keys...original: \system\etc\ssh\authorized_keys (ro)and a copy : \data\ssh\authorized_keys (overwritten at every restart)I had no idea how to get my key into the original \system\etc\ssh\authorized_keys,so i add it to \data\ssh\authorized_keys on every restart with the entry in the start_rigol_app.shBoth solutions work, but adding the key to the original \system\etc\ssh\authorized_keys is of course the better solution

author: Randy222
author_rank: Frequent Contributor
timestamp: January 15, 2024, 08:39:37 pm
content: Quote from: lownoise on January 15, 2024, 05:27:51 pmDid editing just the keys file in /data/ssh/ survive a reboot?sshd_config points directly to the auth keys file in /data/ssh/I'll go check, but when I edited the keys file in /system/etc/ssh/ , my edits somehow showed up in the keys file in /data/ssh/I don't see any symlink between the two.I suspect some start script copies the file from /system over to /data

author: cte
author_rank: Regular Contributor
timestamp: January 15, 2024, 10:01:55 pm
content: @Randy222: The start script is in/system/bin/start-ssh(see below)Actual copying is done here:if [[ ! -f $AUTHORIZED_KEYS && -f $DEFAULT_AUTHORIZED_KEYS ]]; thencat $DEFAULT_AUTHORIZED_KEYS > $AUTHORIZED_KEYSfiCode:#!/system/bin/shumask 077# DEBUG=1DSA_KEY=/data/ssh/ssh_host_dsa_keyDSA_PUB_KEY=/data/ssh/ssh_host_dsa_key.pubRSA_KEY=/data/ssh/ssh_host_rsa_keyRSA_PUB_KEY=/data/ssh/ssh_host_rsa_key.pubAUTHORIZED_KEYS=/data/ssh/authorized_keysDEFAULT_AUTHORIZED_KEYS=/system/etc/security/authorized_keys.defaultif [ ! -f $DSA_KEY ]; then/system/bin/ssh-keygen -t dsa -f $DSA_KEY -N ""chmod 600 /$DSA_KEYchmod 644 $DSA_PUB_KEYfiif [ ! -f $RSA_KEY ]; then/system/bin/ssh-keygen -t rsa -f $RSA_KEY -N ""chmod 600 /$RSA_KEYchmod 644 $RSA_PUB_KEYfiif [[ ! -f $AUTHORIZED_KEYS && -f $DEFAULT_AUTHORIZED_KEYS ]]; thencat $DEFAULT_AUTHORIZED_KEYS > $AUTHORIZED_KEYSfiif [ "1" == "$DEBUG" ] ; then# run sshd in debug mode and capture output to logcat/system/bin/logwrapper /system/bin/sshd -f /system/etc/ssh/sshd_config -D -delse# don't daemonize - otherwise we can't stop the sshd service/system/bin/sshd -f /system/etc/ssh/sshd_config -Dfi

author: Randy222
author_rank: Frequent Contributor
timestamp: January 15, 2024, 10:26:18 pm
content: Quote from: cte on January 15, 2024, 10:01:55 pmI guess I missed it, wasn't looking for it, kinda suspected what was going on after my edit to keys file in /system/etc/sshNot sure why they copy back the keys file, and then reference /data/ssh/ keys file in sshd_config , maybe so you can edit the keys file in /data area since /data is mounted rw ?