UP | HOME

Port Scanning Marantz NR1510

I have a Marantz NR1510, it's OK, it' has some of the worst software ever running it. It really feels like the HiFi ecosystem is more than a decade behind TV's. Even the TV's before they were smart had better UX. I have wanted a way to select a Bluetooth transmitter, but i can't find anything via it's serial interface, or in the web interface.

From the portscan, it's clear they're using the Boost CPP library. It looks like they're running some version of Linux in these devices. 

$ nmap -p0- -v -A -T4 marantz.home
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-20 12:13 CEST
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 12:13
Completed NSE at 12:13, 0.00s elapsed
Initiating NSE at 12:13
Completed NSE at 12:13, 0.00s elapsed
Initiating NSE at 12:13
Completed NSE at 12:13, 0.00s elapsed
Initiating Ping Scan at 12:13
Scanning marantz.home (192.168.1.12) [2 ports]
Completed Ping Scan at 12:13, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:13
Completed Parallel DNS resolution of 1 host. at 12:13, 0.00s elapsed
Initiating Connect Scan at 12:13
Scanning marantz.home (192.168.1.12) [65536 ports]
Discovered open port 111/tcp on 192.168.1.12
Discovered open port 80/tcp on 192.168.1.12
Discovered open port 8080/tcp on 192.168.1.12
Discovered open port 23/tcp on 192.168.1.12
Discovered open port 1255/tcp on 192.168.1.12
Discovered open port 10555/tcp on 192.168.1.12
Discovered open port 33365/tcp on 192.168.1.12
Discovered open port 53335/tcp on 192.168.1.12
Discovered open port 8015/tcp on 192.168.1.12
Discovered open port 10080/tcp on 192.168.1.12
Discovered open port 40280/tcp on 192.168.1.12
Discovered open port 60006/tcp on 192.168.1.12
Discovered open port 10443/tcp on 192.168.1.12
Discovered open port 49200/tcp on 192.168.1.12
Completed Connect Scan at 12:14, 15.08s elapsed (65536 total ports)
Initiating Service scan at 12:14
Scanning 14 services on marantz.home (192.168.1.12)
Completed Service scan at 12:14, 30.25s elapsed (14 services on 1 host)
NSE: Script scanning 192.168.1.12.
Initiating NSE at 12:14
Completed NSE at 12:14, 16.09s elapsed
Initiating NSE at 12:14
Completed NSE at 12:15, 1.42s elapsed
Initiating NSE at 12:15
Completed NSE at 12:15, 0.00s elapsed
Nmap scan report for marantz.home (192.168.1.12)
Host is up (0.0026s latency).
Not shown: 65522 closed tcp ports (conn-refused)
PORT      STATE SERVICE         VERSION
23/tcp    open  telnet?
| fingerprint-strings:
|   GenericLines, NULL, tn3270:
|     PWON
|     MV475
|     MVMAX 70
|     MUOFF
|     SISAT/CBL
|_    SVOFF
80/tcp    open  tcpwrapped
111/tcp   open  rpcbind         2 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|_  100000  2            111/udp   rpcbind
1255/tcp  open  de-cache-query?
8015/tcp  open  wsman           Openwsman
8080/tcp  open  http            TomTom httpd
| http-methods:
|_  Supported Methods: GET HEAD POST
|_http-title: Site doesn't have a title (text/plain).
10080/tcp open  amanda?
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 404 Not Found
|     Server: Boost.Beast/277
|     Content-Type: text/html
|     Content-Length: 66
|     resource '/nice%20ports%2C/Tri%6Eity.txt%2ebak' was not found.
|   HTTPOptions:
|     HTTP/1.0 400 Bad Request
|     Server: Boost.Beast/277
|     Content-Type: text/html
|     Content-Length: 19
|_    Unknown HTTP-method
10443/tcp open  ssl/cirrossp?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Sound United/organizationName=Sound United, LLC/stateOrProvinceName=Kanagawa/countryName=JP
| Issuer: commonName=Sound United/organizationName=Sound United, LLC/stateOrProvinceName=Kanagawa/countryName=JP
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-03-12T04:46:34
| Not valid after:  2069-02-27T04:46:34
| MD5:   7347 b070 4d3b 957e 40b9 9a02 3145 e499
|_SHA-1: ed66 01bb 19cb 8b7c f429 9c1c 16c1 a430 ca0b 7206
| fingerprint-strings:
|   GetRequest:
|     HTTP/1.0 200 OK
|     Server: Boost.Beast/277
|     Content-Type: text/html
|     Content-Length: 1749
|     <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|     <html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
|     <head>
|     <meta http-equiv="Pragma" content="no-cache">
|     <meta http-equiv="Cache-Control" content="no-cache">
|     <title>Home</title>
|     <meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />
|     <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=0" />
|     <link rel="stylesheet" type="text/css" href="common.css" />
|     <script type="text/javascript" src="jquery.js"></script>
|     <script type="text/javascript" src="polyfill.min.js"></script>
|     <script type="text/javascript" src="GlobalsServerInterface.js"></script>
|   HTTPOptions:
|     HTTP/1.0 400 Bad Request
|     Server: Boost.Beast/277
|     Content-Type: text/html
|     Content-Length: 19
|_    Unknown HTTP-method
10555/tcp open  tcpwrapped
33365/tcp open  tcpwrapped
40280/tcp open  tcpwrapped
49200/tcp open  upnp
| fingerprint-strings:
|   DNSVersionBindReqTCP, RPCCheck, RTSPRequest, SIPOptions, kumo-server:
|     HTTP/0.0 400 Bad Request
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 50
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|     <html><body><h1>400 Bad Request</h1></body></html>
|   FourOhFourRequest, GetRequest:
|     HTTP/1.0 500 Internal Server Error
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 60
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|     <html><body><h1>500 Internal Server Error</h1></body></html>
|   HTTPOptions:
|     HTTP/0.0 501 Not Implemented
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 54
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|_    <html><body><h1>501 Not Implemented</h1></body></html>
53335/tcp open  tcpwrapped
60006/tcp open  upnp
| fingerprint-strings:
|   DNSVersionBindReqTCP, RPCCheck, RTSPRequest, SIPOptions, ibm-db2:
|     HTTP/0.0 400 Bad Request
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 50
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|     <html><body><h1>400 Bad Request</h1></body></html>
|   FourOhFourRequest, GetRequest:
|     HTTP/1.0 404 Not Found
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 48
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|     <html><body><h1>404 Not Found</h1></body></html>
|   HTTPOptions:
|     HTTP/0.0 501 Not Implemented
|     SERVER: LINUX UPnP/1.0 Denon-Heos/199476
|     CONTENT-LENGTH: 54
|     Accept-Ranges: bytes
|     CONTENT-TYPE: text/html
|_    <html><body><h1>501 Not Implemented</h1></body></html>
5 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port23-TCP:V=7.92%I=7%D=8/20%Time=6300B3FA%P=x86_64-pc-linux-gnu%r(NULL
SF:,2A,"PWON\rMV475\rMVMAX\x2070\rMUOFF\rSISAT/CBL\rSVOFF\r")%r(GenericLin
SF:es,2A,"PWON\rMV475\rMVMAX\x2070\rMUOFF\rSISAT/CBL\rSVOFF\r")%r(tn3270,2
SF:A,"PWON\rMV475\rMVMAX\x2070\rMUOFF\rSISAT/CBL\rSVOFF\r");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port10080-TCP:V=7.92%I=7%D=8/20%Time=6300B3FA%P=x86_64-pc-linux-gnu%r(H
SF:TTPOptions,75,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20Boost\.
SF:Beast/277\r\nContent-Type:\x20text/html\r\nContent-Length:\x2019\r\n\r\
SF:nUnknown\x20HTTP-method")%r(FourOhFourRequest,A2,"HTTP/1\.0\x20404\x20N
SF:ot\x20Found\r\nServer:\x20Boost\.Beast/277\r\nContent-Type:\x20text/htm
SF:l\r\nContent-Length:\x2066\r\n\r\nThe\x20resource\x20'/nice%20ports%2C/
SF:Tri%6Eity\.txt%2ebak'\x20was\x20not\x20found\.");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port10443-TCP:V=7.92%T=SSL%I=7%D=8/20%Time=6300B405%P=x86_64-pc-linux-g
SF:nu%r(GetRequest,730,"HTTP/1\.0\x20200\x20OK\r\nServer:\x20Boost\.Beast/
SF:277\r\nContent-Type:\x20text/html\r\nContent-Length:\x201749\r\n\r\n<!D
SF:OCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20XHTML\x201\.0\x20Transitio
SF:nal//EN\"\n\x20\x20\x20\x20\"http://www\.w3\.org/TR/xhtml1/DTD/xhtml1-t
SF:ransitional\.dtd\">\n<html\x20xmlns=\"http://www\.w3\.org/1999/xhtml\"\
SF:x20lang=\"en\"\x20dir=\"ltr\">\n\n\x20\x20\x20\x20<head>\n\x20\x20\x20\
SF:x20\x20\x20\x20\x20<meta\x20http-equiv=\"Pragma\"\x20content=\"no-cache
SF:\">\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20http-equiv=\"Cache-Contro
SF:l\"\x20content=\"no-cache\">\n\x20\x20\x20\x20\x20\x20\x20\x20<title>Ho
SF:me</title>\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20http-equiv=\"Conte
SF:nt-Type\"\x20content=\"text/html;charset=UTF-8\"\x20/>\n\x20\x20\x20\x2
SF:0\x20\x20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-w
SF:idth,\x20initial-scale=1,\x20user-scalable=0\"\x20/>\n\x20\x20\x20\x20\
SF:x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20type=\"text/css\"\x20href
SF:=\"common\.css\"\x20/>\n\x20\x20\x20\x20\x20\x20\x20\x20<script\x20type
SF:=\"text/javascript\"\x20src=\"jquery\.js\"></script>\n\x20\x20\x20\x20\
SF:x20\x20\x20\x20<script\x20type=\"text/javascript\"\x20src=\"polyfill\.m
SF:in\.js\"></script>\n\x20\x20\x20\x20\x20\x20\x20\x20<script\x20type=\"t
SF:ext/javascript\"\x20src=\"GlobalsServerInterface\.js\"></script>\n\x20\
SF:x20\x20\x20\x20\x20")%r(HTTPOptions,75,"HTTP/1\.0\x20400\x20Bad\x20Requ
SF:est\r\nServer:\x20Boost\.Beast/277\r\nContent-Type:\x20text/html\r\nCon
SF:tent-Length:\x2019\r\n\r\nUnknown\x20HTTP-method");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port49200-TCP:V=7.92%I=7%D=8/20%Time=6300B3FF%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,CF,"HTTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\nSERVER
SF::\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2060\r
SF:\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><b
SF:ody><h1>500\x20Internal\x20Server\x20Error</h1></body></html>")%r(HTTPO
SF:ptions,C3,"HTTP/0\.0\x20501\x20Not\x20Implemented\r\nSERVER:\x20LINUX\x
SF:20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2054\r\nAccept-Ran
SF:ges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>501\
SF:x20Not\x20Implemented</h1></body></html>")%r(RTSPRequest,BB,"HTTP/0\.0\
SF:x20400\x20Bad\x20Request\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos
SF:/199476\r\nCONTENT-LENGTH:\x2050\r\nAccept-Ranges:\x20bytes\r\nCONTENT-
SF:TYPE:\x20text/html\r\n\r\n<html><body><h1>400\x20Bad\x20Request</h1></b
SF:ody></html>")%r(RPCCheck,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSERV
SF:ER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2050
SF:\r\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html>
SF:<body><h1>400\x20Bad\x20Request</h1></body></html>")%r(DNSVersionBindRe
SF:qTCP,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSERVER:\x20LINUX\x20UPnP
SF:/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2050\r\nAccept-Ranges:\x
SF:20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>400\x20Bad
SF:\x20Request</h1></body></html>")%r(FourOhFourRequest,CF,"HTTP/1\.0\x205
SF:00\x20Internal\x20Server\x20Error\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20D
SF:enon-Heos/199476\r\nCONTENT-LENGTH:\x2060\r\nAccept-Ranges:\x20bytes\r\
SF:nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>500\x20Internal\x20S
SF:erver\x20Error</h1></body></html>")%r(SIPOptions,BB,"HTTP/0\.0\x20400\x
SF:20Bad\x20Request\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\
SF:r\nCONTENT-LENGTH:\x2050\r\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x2
SF:0text/html\r\n\r\n<html><body><h1>400\x20Bad\x20Request</h1></body></ht
SF:ml>")%r(kumo-server,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSERVER:\x
SF:20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2050\r\nA
SF:ccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body
SF:><h1>400\x20Bad\x20Request</h1></body></html>");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port60006-TCP:V=7.92%I=7%D=8/20%Time=6300B3FA%P=x86_64-pc-linux-gnu%r(i
SF:bm-db2,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSERVER:\x20LINUX\x20UP
SF:nP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2050\r\nAccept-Ranges:
SF:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>400\x20B
SF:ad\x20Request</h1></body></html>")%r(GetRequest,B7,"HTTP/1\.0\x20404\x2
SF:0Not\x20Found\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\n
SF:CONTENT-LENGTH:\x2048\r\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20te
SF:xt/html\r\n\r\n<html><body><h1>404\x20Not\x20Found</h1></body></html>")
SF:%r(HTTPOptions,C3,"HTTP/0\.0\x20501\x20Not\x20Implemented\r\nSERVER:\x2
SF:0LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2054\r\nAc
SF:cept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body>
SF:<h1>501\x20Not\x20Implemented</h1></body></html>")%r(RTSPRequest,BB,"HT
SF:TP/0\.0\x20400\x20Bad\x20Request\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20De
SF:non-Heos/199476\r\nCONTENT-LENGTH:\x2050\r\nAccept-Ranges:\x20bytes\r\n
SF:CONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>400\x20Bad\x20Request
SF:</h1></body></html>")%r(RPCCheck,BB,"HTTP/0\.0\x20400\x20Bad\x20Request
SF:\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGT
SF:H:\x2050\r\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r
SF:\n<html><body><h1>400\x20Bad\x20Request</h1></body></html>")%r(DNSVersi
SF:onBindReqTCP,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSERVER:\x20LINUX
SF:\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x2050\r\nAccept-R
SF:anges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<html><body><h1>40
SF:0\x20Bad\x20Request</h1></body></html>")%r(FourOhFourRequest,B7,"HTTP/1
SF:\.0\x20404\x20Not\x20Found\r\nSERVER:\x20LINUX\x20UPnP/1\.0\x20Denon-He
SF:os/199476\r\nCONTENT-LENGTH:\x2048\r\nAccept-Ranges:\x20bytes\r\nCONTEN
SF:T-TYPE:\x20text/html\r\n\r\n<html><body><h1>404\x20Not\x20Found</h1></b
SF:ody></html>")%r(SIPOptions,BB,"HTTP/0\.0\x20400\x20Bad\x20Request\r\nSE
SF:RVER:\x20LINUX\x20UPnP/1\.0\x20Denon-Heos/199476\r\nCONTENT-LENGTH:\x20
SF:50\r\nAccept-Ranges:\x20bytes\r\nCONTENT-TYPE:\x20text/html\r\n\r\n<htm
SF:l><body><h1>400\x20Bad\x20Request</h1></body></html>");

NSE: Script Post-scanning.
Initiating NSE at 12:15
Completed NSE at 12:15, 0.00s elapsed
Initiating NSE at 12:15
Completed NSE at 12:15, 0.00s elapsed
Initiating NSE at 12:15
Completed NSE at 12:15, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.43 seconds

Copyright © 2019-2023 Russell Sim (rsl@simopolis.xyz).

Author: Russell Sim (Mastodon | SourceHut | Github) Date: 2022-08-20 Sat 00:00 Emacs 29.0.91 (Org mode 9.6.5)