A super dodgy script to control panasonic projectors using the NTCONTROL protocol.

panasonic-ntcontrol.py

#!/usr/bin/python3
from pwn import *
import hashlib

def sendCommand(ip, command, port=1024):
	conn = remote(ip,port)

	helo = conn.recvuntil(b'\x0d').rstrip(b"\r\n")

	print("\r\r")
	print("Received {"+str(helo)+"}")

	helo = helo.decode().split(" ")

	proto = helo[0]
	prot = helo[1]
	nonce = helo[2]

	print("\rNonce= {"+str(nonce)+"}")

	m = hashlib.md5()
  
  # i'm using hard-coded default credentials. change these if you need (user:password).
	export = ("admin1:panasonic:"+nonce).encode("utf-8")
	m.update(export)
	dig = m.hexdigest()
	siz = m.digest_size

	print("Received nonce {} and digested to {} ({})".format(export,dig,siz))

	toSend = str(dig)+"00"+str(command)+'\x0d'

	conn.send(toSend)
	print("Sent "+str(toSend))

	status = str(conn.recvuntil(b'\x0d')[:-1])

	print("Status response: {}".format(status))

	if command in status:
		print("\rSUCCESS\r")
	else:
		print("some kind of error (see above)")


	conn.close()

# Turn projector on
sendCommand("192.168.1.10", "PON")
# Turn projector off
# sendCommand("192.168.1.10", "POF")