1

While performing a vulnerability scan for open ports of an Android Automotive Infotainment system, I found out that port 5151 is open. Doing a netcat on the open port, reveals a continuous stream of unreadable data.

kali:~$ nc 192.168.x.x 5151       //IP of infotainment system
7ò”°R YJøOæݽ9^çÆC€E†éúaI™íÐåY—
...
... 

Here is a link to the file that contains data read from the port : android-port-5151

Since I had the root access to the Android system, I could find out that this data is related to android.car.cluster.

console:/ # netstat -ltpu                                                  
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program Name
tcp6       0      0 :::pcrd                 :::*                    LISTEN      4473/android.car.cluster

Now my question is, whether there is a way to read this data that is being pushed to the port 5151. for eg. some client application, that I can install on my Kali Machine to read the data on the port. I believe this data might include some critical information about cluster like speed readings, indicators, etc.

Android version used : android-10.0.0_r20.

Kali Machine and Infotainment system are on the same local network.

4
  • @blabb Yes I know about the hex editor. But my real question is to how to make sense of this data. Since the data is from android.car.cluster, I believe there is a way to interpret the data that is being published. It could be some cluster related data, like speed readings, indicators, etc.
    – gst
    Feb 3 at 10:59
  • As long as the data is created by the AOSP part of android.car.cluster it may be easier to check the source code of the app and it's Java/native libraries where a TCP socket is opened and what data is provided. Also download the apk from the head unit if you have adb access and reverse it and compare it if it has been extended by the car/head unit manufacturer with additional proprietary code.
    – Robert
    Feb 3 at 14:03
  • 1
  • So streaming video with some codec? That would explain the netcat result. Feb 3 at 18:49
1

I'm going to guess this is MPEG Streaming of some manner.

Here's what file run at various byte offsets into the first 10k bytes of the file produces:

598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 or more streams
838 /dev/stdin: MPEG-4 LOAS
1232 /dev/stdin: MPEG-4 LOAS
1696 /dev/stdin: MPEG sequence, H.264 video, baseline @ L 31
3204 /dev/stdin: MPEG ADTS, AAC, v4 Main, 96 kHz, surround + LFE
3220 /dev/stdin: MPEG ADTS, layer II, v2, 144 kbps, 16 kHz, Monaural
3433 /dev/stdin: MPEG ADTS, layer II, v1, 44.1 kHz, JntStereo
4889 /dev/stdin: MPEG ADTS, AAC, v4 Main, 88.2 kHz, surround + LFE
5465 /dev/stdin: MPEG ADTS, layer III, v2,   8 kbps, 22.05 kHz, 2x Monaural
5700 /dev/stdin: MPEG ADTS, AAC, v4 SSR, 88.2 kHz, stereo
5722 /dev/stdin: MPEG ADTS, layer II, v1,  32 kbps, 48 kHz, 2x Monaural
6035 /dev/stdin: MPEG ADTS, AAC, v4 Main, 44.1 kHz, stereo+center+LFE
6207 /dev/stdin: MPEG ADTS, AAC, v2 Main, 64 kHz, surround
6543 /dev/stdin: MPEG ADTS, AAC, v2, 22.05 kHz, stereo+center+LFE
6790 /dev/stdin: MPEG ADTS, AAC, v4 SSR, stereo + center
8039 /dev/stdin: MPEG ADTS, layer II, v1, 48 kHz, 2x Monaural
8683 /dev/stdin: MPEG ADTS, layer III, v1, 112 kbps, 32 kHz, Stereo
9296 /dev/stdin: MPEG-4 LOAS

Shell Scripted:

#!/bin/bash
FILE=$1
for I in {1..10000}
do
    RES=`tail -c "+$I" "$FILE" | file -`
    echo "$I $RES"
done

Here's everything it found:

3 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
7 /dev/stdin: SVR2 pure executable (USS/370)
10 /dev/stdin: DOS executable (COM, 0x8C-variant)
33 /dev/stdin: QDOS object '?z_???/??M?U?/?\????|?~Ru????U?/?}[??7?*?
aC<x??'?EI?Y'
45 /dev/stdin: DOS executable (COM)
75 /dev/stdin: PGP Secret Sub-key -
103 /dev/stdin: PGP Secret Key -
110 /dev/stdin: DOS executable (COM)
111 /dev/stdin: zlib compressed data
151 /dev/stdin: PGP symmetric key encrypted data -
242 /dev/stdin: DOS executable (COM)
253 /dev/stdin: PGP Secret Sub-key -
265 /dev/stdin: amd 29k coff noprebar executable
343 /dev/stdin: DOS executable (COM, 0x8C-variant)
384 /dev/stdin: DOS executable (COM, 0x8C-variant)
396 /dev/stdin: COM executable for DOS
490 /dev/stdin: PGP key public ring (v0) created Sat Jun 11 06:16:17 1977, 4742 days valid invalid (67) 1337 bits MPI=0xb28d1ec6effb04c5...
573 /dev/stdin: PRCS packaged project
596 /dev/stdin: zlib compressed data
598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 or more streams
621 /dev/stdin: COM executable for DOS
638 /dev/stdin: DOS executable (COM, 0x8C-variant)
682 /dev/stdin: DOS executable (COM)
718 /dev/stdin: PGP Secret Key -
723 /dev/stdin: SysEx File - PalmTree
725 /dev/stdin: PGP Secret Key -
734 /dev/stdin: COM executable for DOS
737 /dev/stdin: PGP Secret Key -
775 /dev/stdin: COM executable for DOS
788 /dev/stdin: DOS executable (COM)
823 /dev/stdin: COM executable for DOS
838 /dev/stdin: MPEG-4 LOAS
840 /dev/stdin: COM executable for DOS
929 /dev/stdin: PGP Secret Key -
940 /dev/stdin: PPMN archive data
946 /dev/stdin: DOS executable (COM)
954 /dev/stdin: DOS executable (COM)
969 /dev/stdin: lif file
973 /dev/stdin: DOS executable (COM)
982 /dev/stdin: Encore unsupported executable
1033 /dev/stdin: mc68k COFF object
1124 /dev/stdin: COM executable for DOS
1146 /dev/stdin: PGP Secret Sub-key -
1210 /dev/stdin: PGP Secret Key -
1232 /dev/stdin: MPEG-4 LOAS
1280 /dev/stdin: PARIX executable
1291 /dev/stdin: executable (RISC System/6000 V3.1) or obj module not stripped
1331 /dev/stdin: PGP Secret Key -
1358 /dev/stdin: COM executable for DOS
1386 /dev/stdin: QDOS object '??????8C???1??a?_?^???M|????!??8??қ?a?'
1428 /dev/stdin: COM executable for DOS
1446 /dev/stdin: zlib compressed data
1465 /dev/stdin: DOS executable (COM)
1484 /dev/stdin: COM executable for DOS
1534 /dev/stdin: SysEx File -
1630 /dev/stdin: Sky archive data
1639 /dev/stdin: TTComp archive, binary, 4K dictionary
1677 /dev/stdin: DOS executable (COM)
1686 /dev/stdin: Dyalog APL component file 32-bit level 2 journaled checksummed version 248.19
1695 /dev/stdin: JVT NAL sequence, H.264 video, baseline @ L 31
1696 /dev/stdin: MPEG sequence, H.264 video, baseline @ L 31
1697 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
1704 /dev/stdin: MIPSEB MIPS-III ECOFF executable not stripped - version 0.1
1707 /dev/stdin: DOS executable (COM)
1711 /dev/stdin: zlib compressed data
1726 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
1729 /dev/stdin: COM executable for DOS
1833 /dev/stdin: DOS executable (COM, 0x8C-variant)
1899 /dev/stdin: MIPSEB-LE MIPS-III ECOFF executable - version 107.107
2017 /dev/stdin: MS-DOS executable
2118 /dev/stdin: DOS executable (COM)
2378 /dev/stdin: Minix filesystem, V1, 30 char names (big endian), 10256 zones
2414 /dev/stdin: Minix filesystem, V1, 30 char names, 4681 zones
2478 /dev/stdin: PGP Secret Key -
2943 /dev/stdin: DOS executable (COM)
2958 /dev/stdin: DOS executable (COM)
3115 /dev/stdin: DOS executable (COM)
3194 /dev/stdin: TeX font metric data (v????)
3204 /dev/stdin: MPEG ADTS, AAC, v4 Main, 96 kHz, surround + LFE
3205 /dev/stdin: SysEx File - OctavePlateau
3220 /dev/stdin: MPEG ADTS, layer II, v2, 144 kbps, 16 kHz, Monaural
3231 /dev/stdin: TeX font metric data (??>?3    f
                                                 A????P)
3289 /dev/stdin: PGP Secret Sub-key -
3355 /dev/stdin: DOS executable (COM, 0x8C-variant)
3367 /dev/stdin: PGP Secret Key -
3400 /dev/stdin: DOS executable (COM, 0x8C-variant)
3406 /dev/stdin: SysEx File -
3425 /dev/stdin: DOS executable (COM, 0x8C-variant)
3430 /dev/stdin: DOS executable (COM, 0x8C-variant)
3433 /dev/stdin: MPEG ADTS, layer II, v1, 44.1 kHz, JntStereo
3468 /dev/stdin: VAX COFF executable
3469 /dev/stdin: Tower32/600/400 68020 object
3569 /dev/stdin: SysEx File - Moog
3577 /dev/stdin: COM executable for DOS
3579 /dev/stdin: SysEx File - Sequential
3687 /dev/stdin: COM executable for DOS
3698 /dev/stdin: DOS executable (COM, 0x8C-variant)
3703 /dev/stdin: SysEx File - Sequential
3769 /dev/stdin: Atari 68xxx CPX file (version ec7f)
3814 /dev/stdin: DOS executable (COM)
3838 /dev/stdin: COM executable for DOS
3849 /dev/stdin: TTComp archive, binary, 4K dictionary
3855 /dev/stdin: PGP Secret Key -
3914 /dev/stdin: PGP Secret Sub-key -
3926 /dev/stdin: SysEx File - IDP
3970 /dev/stdin: COM executable for DOS
3995 /dev/stdin: PDP-11 UNIX/RT ldp
4010 /dev/stdin: 370 sysV pure executable
4142 /dev/stdin: SysEx File - Sequential
4143 /dev/stdin: Tower/XP rel 2 object not stripped
4197 /dev/stdin: MS Windows COFF Motorola 68000 object file
4201 /dev/stdin: COM executable for DOS
4216 /dev/stdin: DOS executable (COM, 0x8C-variant)
4218 /dev/stdin: PGP Secret Key -
4246 /dev/stdin: PDP-11 overlaid pure executable not stripped
4263 /dev/stdin: PGP Secret Sub-key -
4287 /dev/stdin: SysEx File - ADA
4294 /dev/stdin: DOS executable (COM, 0x8C-variant)
4370 /dev/stdin: PGP Secret Key -
4409 /dev/stdin: DOS executable (COM)
4410 /dev/stdin: DOS executable (COM)
4418 /dev/stdin: 0421 Alliant compact executable common library
4450 /dev/stdin: PGP Secret Key -
4482 /dev/stdin: COM executable for DOS
4511 /dev/stdin: COM executable for DOS
4572 /dev/stdin: Solitaire Image Recorder format
4578 /dev/stdin: DOS executable (COM)
4589 /dev/stdin: COM executable for DOS
4606 /dev/stdin: SysEx File - Kurzweil/Future Retro, Channel 59
4630 /dev/stdin: PGP Secret Key -
4696 /dev/stdin: DOS executable (COM, 0x8C-variant)
4700 /dev/stdin: Dyalog APL version 1.5
4702 /dev/stdin: ctab data
4780 /dev/stdin: BS image, Version 33642, Quantization 35004, (Decompresses to 36657 words)
4889 /dev/stdin: MPEG ADTS, AAC, v4 Main, 88.2 kHz, surround + LFE
4934 /dev/stdin: SysEx File - Fender
4954 /dev/stdin: DOS executable (COM)
5064 /dev/stdin: SysEx File - Gulbransen
5220 /dev/stdin: DOS executable (COM, 0x8C-variant)
5254 /dev/stdin: SVr2 curses screen image, little-endian
5267 /dev/stdin: PGP Secret Key -
5281 /dev/stdin: DOS executable (COM, 0x8C-variant)
5300 /dev/stdin: DOS executable (COM, 0x8C-variant)
5301 /dev/stdin: DOS executable (COM, 0x8C-variant)
5333 /dev/stdin: COM executable for DOS
5397 /dev/stdin: hp200 (68010) BSD
5465 /dev/stdin: MPEG ADTS, layer III, v2,   8 kbps, 22.05 kHz, 2x Monaural
5505 /dev/stdin: COM executable for DOS
5510 /dev/stdin: MySQL table definition file Version 31, MySQL version -1402753788
5608 /dev/stdin: byte-swapped Berkeley vfont data
5638 /dev/stdin: DOS executable (COM, 0x8C-variant)
5656 /dev/stdin: DOS executable (COM)
5682 /dev/stdin: DOS executable (COM)
5695 /dev/stdin: SysEx File -
5700 /dev/stdin: MPEG ADTS, AAC, v4 SSR, 88.2 kHz, stereo
5712 /dev/stdin: DOS executable (COM, 0x8C-variant)
5722 /dev/stdin: MPEG ADTS, layer II, v1,  32 kbps, 48 kHz, 2x Monaural
5728 /dev/stdin: SysEx File - Kawai
5742 /dev/stdin: squeezed data, original name G??`g(??1`ﮉ:E??ejc?
5787 /dev/stdin: SysEx File -
5798 /dev/stdin: PARIX executable
5812 /dev/stdin: floppy image data (IBM SaveDskF, old)
5830 /dev/stdin: executable (RISC System/6000 V3.1) or obj module
5874 /dev/stdin: PGP Secret Sub-key -
5880 /dev/stdin: DOS executable (COM)
5882 /dev/stdin: SVR2 pure executable (Amdahl-UTS) not stripped - version 280614372
5913 /dev/stdin: PGP Secret Sub-key -
5942 /dev/stdin: COM executable for DOS
5982 /dev/stdin: COM executable for MS-DOS
5989 /dev/stdin: COM executable for MS-DOS
5994 /dev/stdin: COM executable for MS-DOS
5999 /dev/stdin: COM executable for DOS
6000 /dev/stdin: MIPSEB-LE ECOFF executable - version 150.146
6002 /dev/stdin: COM executable for DOS
6005 /dev/stdin: COM executable for DOS
6007 /dev/stdin: COM executable for DOS
6008 /dev/stdin: COM executable for DOS
6010 /dev/stdin: COM executable for DOS
6021 /dev/stdin: DOS executable (COM, 0x8C-variant)
6035 /dev/stdin: MPEG ADTS, AAC, v4 Main, 44.1 kHz, stereo+center+LFE
6112 /dev/stdin: PGP Secret Key -
6207 /dev/stdin: MPEG ADTS, AAC, v2 Main, 64 kHz, surround
6214 /dev/stdin: DOS executable (COM, 0x8C-variant)
6230 /dev/stdin: DOS executable (COM, 0x8C-variant)
6265 /dev/stdin: COM executable for DOS
6321 /dev/stdin: MS Windows COFF PA-RISC object file
6346 /dev/stdin: DOS executable (COM)
6347 /dev/stdin: DOS executable (COM)
6380 /dev/stdin: COM executable for DOS
6408 /dev/stdin: PGP symmetric key encrypted data - Blowfish (128 bit key, 16 rounds)
6441 /dev/stdin: SysEx File - Clavia
6470 /dev/stdin: PGP Secret Sub-key -
6543 /dev/stdin: MPEG ADTS, AAC, v2, 22.05 kHz, stereo+center+LFE
6564 /dev/stdin: DOS executable (COM)
6653 /dev/stdin: DOS executable (COM, 0x8C-variant)
6684 /dev/stdin: Tower32/800 68010 compatible object object not stripped
6724 /dev/stdin: SysEx File - Baldwin
6731 /dev/stdin: DOS executable (COM)
6790 /dev/stdin: MPEG ADTS, AAC, v4 SSR, stereo + center
6795 /dev/stdin: DOS executable (COM, 0x8C-variant)
6797 /dev/stdin: DOS executable (COM, 0x8C-variant)
6799 /dev/stdin: DOS executable (COM, 0x8C-variant)
6852 /dev/stdin: PGP Secret Sub-key -
6941 /dev/stdin: OS9/68K module: re-entrant ghost system-state
6980 /dev/stdin: DOS executable (COM)
6985 /dev/stdin: DOS executable (COM, 0x8C-variant)
7018 /dev/stdin: PGP Secret Sub-key -
7028 /dev/stdin: VISX image file
7044 /dev/stdin: DOS executable (COM)
7067 /dev/stdin: DOS executable (COM)
7192 /dev/stdin: DOS executable (COM, 0x8C-variant)
7221 /dev/stdin: PARIX object
7354 /dev/stdin: PGP Secret Sub-key -
7373 /dev/stdin: PGP Secret Sub-key -
7538 /dev/stdin: DOS executable (COM)
7539 /dev/stdin: DOS executable (COM)
7659 /dev/stdin: SYMMETRY i386 .o
7735 /dev/stdin: COM executable for DOS
7935 /dev/stdin: zlib compressed data
8011 /dev/stdin: Atari MSA archive data, 63152 sectors per track, starting track: 46999, ending track: 5759
8018 /dev/stdin: PGP Secret Sub-key -
8033 /dev/stdin: AIX core file fulldump
8039 /dev/stdin: MPEG ADTS, layer II, v1, 48 kHz, 2x Monaural
8050 /dev/stdin: PGP Secret Sub-key -
8077 /dev/stdin: COM executable for DOS
8098 /dev/stdin: zlib compressed data
8110 /dev/stdin: PGP Secret Sub-key -
8338 /dev/stdin: COM executable for DOS
8347 /dev/stdin: PGP Secret Key -
8352 /dev/stdin: PGP Secret Sub-key -
8382 /dev/stdin: PGP Secret Key -
8429 /dev/stdin: PGP Secret Sub-key -
8442 /dev/stdin: COM executable for DOS
8550 /dev/stdin: PGP Secret Sub-key -
8561 /dev/stdin: DOS executable (COM)
8683 /dev/stdin: MPEG ADTS, layer III, v1, 112 kbps, 32 kHz, Stereo
8727 /dev/stdin: SysEx File - Clarity
8729 /dev/stdin: DOS executable (COM, 0x8C-variant)
8734 /dev/stdin: Intel ia64 COFF object file, not stripped, 23296 sections, symbol offset=0x911b1400, 1284708587 symbols, optional header size 57568
8738 /dev/stdin: SysEx File -
8742 /dev/stdin: raw G3 (Group 3) FAX
8746 /dev/stdin: DOS executable (COM)
8754 /dev/stdin: PDP-11 UNIX/RT ldp
8755 /dev/stdin: MIPSEB Ucode
8764 /dev/stdin: MIPSEL-BE Ucode
8766 /dev/stdin: Intel ia64 COFF object file, stripped, 57560 sections, symbol offset=0x813b142f, -1778167612 symbols, optional header size 32856
8767 /dev/stdin: GeoSwath RDF
8769 /dev/stdin: Targa image data - Color 22678 x 14464 x 1 +50305 +848 - 4-bit alpha - top - right - reserved "B??3@|?q`"
8780 /dev/stdin: little endian ispell hash file (?), and 312 string characters
8831 /dev/stdin: QDOS object 'y)??r????D??-E#<??M?xs??G?'
8868 /dev/stdin: PGP Secret Sub-key -
8895 /dev/stdin: SysEx File -
8900 /dev/stdin: COM executable for DOS
8916 /dev/stdin: PGP Secret Sub-key -
8918 /dev/stdin: DOS executable (COM, 0x8C-variant)
8931 /dev/stdin: PGP Secret Sub-key -
8932 /dev/stdin: iAPX 286 executable large model (COFF) not stripped
8988 /dev/stdin: basic-16 executable not stripped
8999 /dev/stdin: PGP symmetric key encrypted data -
9109 /dev/stdin: DOS executable (COM, 0x8C-variant)
9186 /dev/stdin: PGP Secret Key -
9215 /dev/stdin: DOS executable (COM, 0x8C-variant)
9245 /dev/stdin: SysEx File - Eventide
9248 /dev/stdin: lif file
9275 /dev/stdin: PGP Secret Sub-key -
9292 /dev/stdin: PGP Secret Sub-key -
9296 /dev/stdin: MPEG-4 LOAS
9356 /dev/stdin: DOS executable (COM)
9366 /dev/stdin: DOS executable (COM, 0x8C-variant)
9373 /dev/stdin: SysEx File -
9480 /dev/stdin: DOS executable (COM, 0x8C-variant)
9496 /dev/stdin: DOS executable (COM, 0x8C-variant)
9547 /dev/stdin: DOS executable (COM)
9552 /dev/stdin: DOS executable (COM, 0x8C-variant)
9555 /dev/stdin: PGP Secret Key -
9589 /dev/stdin: PGP Secret Key -
9607 /dev/stdin: COM executable for DOS
9696 /dev/stdin: PGP Secret Key -
9742 /dev/stdin: ID tags data version 3710
9763 /dev/stdin: Dyalog APL component file 64-bit level 1 journaled checksummed version 204.112
9787 /dev/stdin: Targa image data 24628 x 8654 x 15 +49152 +15116 - 3-bit alpha - top - interleave "??ƀ6?????).??
                                                                                                                 ,?7?=??}&ɍ??O?
                                                                                                                               ?&??''''?)@?P?A??'??^??l??(??gxm??K?j?&x?M??$?@Lt ??D"
2
  • Unfortunately, there are no CAN related devices connected to it, neither is a CAN application running on the same.
    – gst
    Feb 3 at 13:33
  • can you share the exact command/tool that you used to extract the information.
    – gst
    Feb 4 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.