00:00:00.167-->00:00:04.167 >>Okay uh so this presentation is called All Your Things Are Belonging To Us. Um, we are the 00:00:04.167-->00:00:09.750 Exploitee.rs, uh the link at the bottom would’ve been where you’d find our slides right now, but 00:00:09.750-->00:00:15.792 it’s not um so yeah, after this presentation, hopefully you’ll find your slides there um, DC25 00:00:15.792-->00:00:20.792 dot exploitee dot rs. Um, so yeah, next slide. Oo, does it work? Okay let’s find out, is 00:00:22.875-->00:00:27.875 this going to be my day? No, nope, okay cool good. Okay, so [chuckles] I heard you like 00:00:31.083-->00:00:36.083 slides, so we put slides in your slides [laughter] oh man okay, so,uh, my names Zenofex I’m the 00:00:39.625-->00:00:44.208 founder of Exploitee.rs uh I’m a senior research scientist at Cylance and I’m founder of 00:00:44.208-->00:00:51.042 Pastecry.pt. Um, in the back, that you can’t see, uh he’s standing up waving his hands, he 00:00:51.042-->00:00:56.875 is CJ, he works at Draper, he does hardware and software exploitation of things. Um, 00:00:56.875-->00:01:02.708 right over here we have 0x00string, null string, um he is a hacker, recreational bug 00:01:02.708-->00:01:07.958 user, senior research engineer. And then right over here we have Maximus, he is a recent graduate 00:01:07.958-->00:01:13.500 of University of Central Florida and he is a master of a soldering iron and of all things 00:01:13.500-->00:01:17.250 reflow. Um, just a little disclaimer, this presentation and thoughts are ours, and ours 00:01:17.250-->00:01:24.083 alone and they have no relationship to our employers. Next slide, ding, okay cool, 00:01:24.083-->00:01:29.167 that’s going to get annoying I bet, uh [chuckles] so uh the other members, we’re like uh 00:01:29.167-->00:01:33.917 twelve deep group um, that’s why we have four on stage that was the most we could get [laughs]. 00:01:33.917-->00:01:40.458 So we have MBM, he’s the co founder of openWRT, um his twitter handle is at mbmwashere 00:01:40.458-->00:01:47.375 or wash ere, um we have gynophage, he goes by gyno underscore lbd, lbs, he is the 00:01:47.375-->00:01:52.375 Def Con CTF organizer, we have at non stick who is a boring corp sec dude, we have saurik, 00:01:54.667-->00:02:00.500 he’s the creator of Cydia, we have TDweng, he’s our master software developer, and we have 00:02:00.500-->00:02:06.292 Cody Walker who believes that the web platform is the best platform, um expected to hear 00:02:06.292-->00:02:11.292 some laughs, uh okay so and then we have Ian who praises our all mighty internet overlords, ding. 00:02:16.167-->00:02:21.167 So uh, a little about us, um I guess I’m the minority there, uh [laughter] we’re the A team, uh 00:02:24.167-->00:02:29.167 next, ding, okay cool, so we are the Exploitee.rs, we are formerly known as GTVhacker but, 00:02:32.167-->00:02:38.875 we were started, we started to start hacking the Google TV and then Google decided we don’t 00:02:38.875-->00:02:43.958 need the Google TV anymore and our name meant nothing, so we switched to Exploitee.rs, um 00:02:43.958-->00:02:50.417 we’ve presented at Blackhat, Def Con, Bsides, um some of the content that you’ll see today um 00:02:50.417-->00:02:55.958 you could get more out of if you watch our Blackhat presentation, uh the material isn’t the same 00:02:55.958-->00:03:00.083 at all but we talk about EEMC hacking a little bit in this presentation and we did a whole 00:03:00.083-->00:03:06.167 white paper for Blackhat on EEMC uh interfacing, so, um what else, we released root methods 00:03:06.167-->00:03:10.333 for multiple generations of Google TV devices and other embedded systems, um we did 00:03:10.333-->00:03:14.083 televisions, blu ray players, refrigerators, um if you check out our wiki we’ve got a whole 00:03:14.083-->00:03:19.083 bunch of uh stuff that we’ve hacked and data based. Um, we also pushed for DMCA exemptions 00:03:21.083-->00:03:26.708 in uh jailbreaking smart devices, pushed and one, we uh got an exemption for uh 00:03:26.708-->00:03:32.125 jailbreaking set top boxes um that was really kind of a cool accomplishment for us. And we 00:03:32.125-->00:03:36.208 also maintain a network of sites documenting uh just a bunch of vulnerabilities and their 00:03:36.208-->00:03:39.958 immunity and group driven. So, if you’re looking for a safe place to put your research, 00:03:39.958-->00:03:44.875 we’re happy to host it and give you credit for it, so um you can visit our wiki or what not for 00:03:44.875-->00:03:49.875 exploitee dot rs ding. Okay, so um types of vulnerability and exploits, that you’re gonna hear 00:03:52.000-->00:03:57.875 about today, and maybe not hear about depending on if the slides work, um, we have UART bugs, uh 00:03:57.875-->00:04:02.917 these are pretty simple, it’s a development interface, its universal asynchronous receive 00:04:02.917-->00:04:09.583 transmit, um it’s normally just a 4 pin grouping, maybe 3 pins, maybe even 2, sounds easy to 00:04:09.583-->00:04:14.792 find, um, and it’s pretty much you can consider it a serial port, and some devices will just 00:04:14.792-->00:04:21.125 straight drop you into a root shell on UART so, you’ll see a few of those, I promise not to 00:04:21.125-->00:04:24.625 over do it, we got a whole lot of remote stuff, um. Then we have JTAG, joint test access, um 00:04:24.625-->00:04:28.167 action group, um we don’t have a whole lot of these in our presentation but it is good to 00:04:28.167-->00:04:33.750 know about if you are new to hardware hacking, it’s another debug interface and it allows 00:04:33.750-->00:04:40.167 full CPU access, um it’s often hard to find, you can get something a J, JTAGulator, um 00:04:40.167-->00:04:45.167 you can also get a JTAG enums a sketch for r dueno and be able to map out pinouts pretty 00:04:47.750-->00:04:51.917 easily. We do a pull and program on some of these which is just we pull the flash most of the 00:04:51.917-->00:04:56.833 time it's an EEMC, um that’s to either read, write and chip in dead bug mode which means to 00:04:56.833-->00:05:01.667 flip it onto back and uh interface directly with the chip, or even just pull it off 00:05:01.667-->00:05:06.708 and get an in circuit pinout so that we can uh, um publish something online and make it a 00:05:06.708-->00:05:11.333 little easier for you guys to replicate the work. Um, local file disclosure, that's 00:05:11.333-->00:05:16.667 essentially when we’re just, uh we find a bug that discloses some information that uh you 00:05:16.667-->00:05:23.042 know you shouldn’t have, maybe a, a wifi ps uh, wifi key or a you know just some personal 00:05:23.042-->00:05:28.333 information and whatnot. And then RCE, remote code execution, uh payload execution without 00:05:28.333-->00:05:33.333 physical access. Ding. Okay, so plan of attack, um generally what we do is we go after the 00:05:36.958-->00:05:42.917 hardware attack first, we had one device that we, we uh were attacking, and it got heavily 00:05:42.917-->00:05:47.917 hardened on its first update, um that the device received as soon as it came out and from that 00:05:50.125-->00:05:54.250 point on we decided that going after UART and JTAG was something that we needed to do 00:05:54.250-->00:06:00.167 before we even got the device online just so that we can test the manufacturer firmware, and 00:06:00.167-->00:06:05.000 so if you’re trying to establish a process, I highly recommend you always look for UART first, 00:06:05.000-->00:06:10.667 um in all this you’re always looking for a firmware, you wanna get um, you wanna get a 00:06:10.667-->00:06:16.958 firmware so you can find better bugs, remote bugs, um you know, the not the physical access 00:06:16.958-->00:06:21.958 wire, ten wired bugs, um. We also reversed mobile and desktop apps, a lot of times you’ll find 00:06:24.000-->00:06:29.958 firmware update code, that will just leave you to um firmwares that you can throw in binwalk, 00:06:29.958-->00:06:35.375 um and be able to do a better analysis of the device, it’s way better when you have uh a 00:06:35.375-->00:06:39.333 firmware dump. We also sometimes man in the middle network traffic. Again, we’re just 00:06:39.333-->00:06:44.333 trying to get that firmware update um and then dump flash if we don’t get a firmware update, 00:06:44.333-->00:06:50.417 we don’t have anything, we need code to work off of, doing a blo, back bloc, back, black box 00:06:50.417-->00:06:55.417 approach isn’t always optimal. So, our goal is always to find more bugs and to find better 00:06:58.375-->00:07:03.958 bugs. Ding. Let the games begin, here’s the good stuff I’m gonna hand this off to qua where he 00:07:03.958-->00:07:08.958 can get us started. >> Ok, next slide. So this is the Tenvis T8810 its an IP camera it have 00:07:17.292-->00:07:25.667 um pan, tilt, and zoom function. It’s wireless, and two way audio. Next slide. Uh, oh 00:07:25.667-->00:07:41.333 [laughter] ohhh [applause]. Okay so, uh when, when you open the wire there is a UART port, you 00:07:41.333-->00:07:48.292 can uh wire up to your UART adaptor, and uh it will uh show a linux login prompt. We don’t 00:07:48.292-->00:07:56.083 have the login uh for this device so that’s not gonna work. Uh but this one have a U-boot 3 00:07:56.083-->00:08:01.833 second timeout so you can interrupt the uh U-boot and drop you straight to a U-boot shell. 00:08:01.833-->00:08:08.708 From there you can uh set the UBAR, uh the boot argument uh to include a bid I mean like init 00:08:08.708-->00:08:20.375 uh slash bin slash sh so it will drop uh you to a root shell when device booted. Next slide. Uh 00:08:20.375-->00:08:26.083 so, while looking at this device uh we found an interesting bug. So, uh if you include a karat 00:08:26.083-->00:08:39.042 return or a new line in the SSID, uh the device will crash and uh even if you rebooted it 00:08:39.042-->00:08:43.167 it will continue to crash. Uh, the only way to recover from it is uh you use a UART and uh 00:08:43.167-->00:08:53.125 clear out the SSID. Next slide. So, okay, so Samsung security DVR. This a 4 channel security 00:08:53.125-->00:09:01.417 DVR. Uh it's based on a HiSilicon chipset, its run linux and it have a 500 gigabyte SS uh 00:09:01.417-->00:09:12.375 HHD, HDD. Uh next slide. Um, so, when you open the file up there’s a 4 pin port, uh, that's 00:09:12.375-->00:09:21.292 a UART port. Uh, you can interrupt to the U-boot shell and then you can uh add to the 00:09:21.292-->00:09:25.833 boot argument. Uh init then console, then that will get you to a rootshell. Well then you 00:09:25.833-->00:09:31.833 can use that to explore the file system. Next. So, while uh looking through the file system 00:09:31.833-->00:09:41.667 we found a startup script, uh it looked for a uh a uh diag uh one six seventy three uh file on the 00:09:41.667-->00:09:49.167 USB file right. So if you put a uh uh script to spawn a telnet shelf and that will get you 00:09:49.167-->00:09:59.917 root. Next. Uh so we did a picture of the diag uh, uh, underscore sixteen seventy 00:09:59.917-->00:10:09.042 three, we found we a, a Samsung uh PDF uh is useful at changing your math and video type. Uh, so 00:10:09.042-->00:10:15.167 you put the diag uh underscore one six seventy three in there and uh with the conflict file 00:10:15.167-->00:10:21.125 and you plug into the DVR and power it on. Uh then uh the script for the battery will run 00:10:21.125-->00:10:27.500 and set your mac address and video type then this will tell you to reboot the DVR. Uh next. 00:10:27.500-->00:10:38.042 So, this one is a Samsung printer, its have a uh 600 uh megahertz cortex uh with a 00:10:38.042-->00:10:44.000 hundred uh twenty eight megabyte of ram its run via the uh via the VXworks real-time operating 00:10:44.000-->00:10:51.958 system. Uh, next slide. So, first thing we did is uh use a renal and we dump the name flash 00:10:51.958-->00:11:00.458 so we keep a backup so incase of anything go wrong we can set the recall for it. Next. Uh, so we 00:11:00.458-->00:11:07.333 was messing with the uh firmware image and we found a section of it so a section not the firmware 00:11:07.333-->00:11:14.333 image that allow us to that you can modify. So we modify a small piece of code in there to uh 00:11:14.333-->00:11:22.833 make the toner cauti uh at the toner level to always read 100 percent. Next. Okay so, 00:11:22.833-->00:11:31.750 Chromecast, uh, Gen 1, uh we already root this device back in uh two thousand 13, and um also 00:11:31.750-->00:11:40.292 help the second time. Uh, this one is run a marvell eighty eight DE thirty oh five chipset 00:11:40.292-->00:11:47.125 uh next. So the, with the chromecast release it’s uh came with a vulnerable bootloader 00:11:47.125-->00:11:56.792 this uh vulnerable bootloader allow you to uh run any unsigned image so is this one is patched 00:11:56.792-->00:12:05.167 in firmware version twelve uh eighty four zero and uh after that uh, uh failoverflow re 00:12:05.167-->00:12:13.333 released a uh USB boot uh exploit, uh this one also got patched. Um so on the we got 00:12:13.333-->00:12:18.792 around this uh using a uh NAND programmer, we use a NAND programmer, we download the you 00:12:18.792-->00:12:29.083 downgrade the bootloader to the uh vulnerable version uh we use a uh STM32F4 Discovery board uh 00:12:29.083-->00:12:35.542 because it’s cheap and it's also have a NAND controller viewing and this device have a security 00:12:35.542-->00:12:45.708 boot enabled. Next. So, to downgrade the NAND, to downgrade the bootloader you wire up the 00:12:45.708-->00:12:51.583 NAND flash through the STM discovery board uh then calculate the ECC then uh you 00:12:51.583-->00:12:58.167 erase and write the new uh bootloader to the device. So, after this you can uh use the 00:12:58.167-->00:13:03.000 uh, uh our original exploit we release uh in two thousand thirteen to get root on the 00:13:03.000-->00:13:12.000 Chromecast. Next. Okay, the Zmodo smart doorbell, it’s a wifi connected doorbell, it’s 00:13:12.000-->00:13:20.000 used to stream video, uh two way audio and motion detect. We purchased this at a Fry’s two 00:13:20.000-->00:13:30.250 day ago [laughter]. Next. Uh so when you opened it up and you look on the back of the board, 00:13:30.250-->00:13:38.375 there’s a two pin uhhhhhh port so you can wire up you’re UART adaptor, and drop you straight 00:13:38.375-->00:13:51.125 to the root shell, so there is no step three [laughter] [applause]. Next. Uh, well, okay 00:13:51.125-->00:13:57.208 so we look at through the auto binary in this device and we found a uh buffer overflow, so 00:13:57.208-->00:14:03.542 when you feed it a query string of a long query string the device will crash and uh the PC 00:14:03.542-->00:14:17.125 uh you can control the PC uh cal value. Next. Uh okay Zenofex, we will continue. >>Alright 00:14:17.125-->00:14:25.625 everyone, we’re going to make it a little more personal, this feels a lot better, okay cool so 00:14:25.625-->00:14:30.250 ding let’s move forward. Okay, so the Western Digital My Cloud, this is a device that is pretty 00:14:30.250-->00:14:35.792 personal to me because I originally bought it to use and not to hack, but uh I can’t put 00:14:35.792-->00:14:40.042 anything on my network and feel comfortable without without giving it uh,uh about it without 00:14:40.042-->00:14:44.625 giving a good audit. So, the Western Digital My Cloud is a network attached storage device, 00:14:44.625-->00:14:50.208 there's a bunch of different models, um there's a pro series, um all the models you see there 00:14:50.208-->00:14:55.208 are vulnerable, every seri, uh every device in the My Cloud uh series is gonna be vulnerable to 00:14:55.208-->00:15:02.375 the uh bugs you’re gonna see um and I’ve already hacked this one once before. So, uh let’s go to 00:15:02.375-->00:15:09.917 the next slide. So, a little bit about the hardware, um its an Intel Pentium N 3, thirty seven 00:15:09.917-->00:15:15.458 ten quad core 1.6 gigahertz processor, it’s got 4 gigabytes of RAM and 4 bays. Um we’re 00:15:15.458-->00:15:20.083 talking about this specific model, the PR 41, which is the one I purchased and uh use at 00:15:20.083-->00:15:27.292 home. So, the My Cloud series of devices, we released about eighty three RCEs uh, uh earlier 00:15:27.292-->00:15:37.333 this year and just dropped it on Western Digital, so uh we haha we dropped 14 pre auth bugs, 13 00:15:37.333-->00:15:43.792 of them were Remote Code Execution, um 1 was an arbitrary file upload pre auth um and the 00:15:43.792-->00:15:50.167 beautiful thing about this device is that the uh web directory it's not squashfs it's 00:15:50.167-->00:15:55.208 not packed system, it’s ext3, you can modify it and just keep going. So, PHP shells, get you 00:15:55.208-->00:16:02.750 an instant root, so um then we had 70 post auth RCEs. The thing about the uh post auths were 00:16:02.750-->00:16:09.375 that they fixed all the pre auth vulnerabilities um one month after disclosure, a little more 00:16:09.375-->00:16:14.708 than a month for all the devices but uh they didn’t fix any of the post auth, post auth 00:16:14.708-->00:16:19.375 vulnerabilities um I don’t, I don’t know what the thought process was behind that but uh 00:16:19.375-->00:16:27.208 um, that is just what we observed. Next. So, we’re gonna talk about the first bug that we 00:16:27.208-->00:16:32.792 have here, um it’s the Western Digital My Cloud arbitrary file Upload. Um, we had released one 00:16:32.792-->00:16:38.792 of a sim, similar bug to them, um, full disclosure a few months back, and this is just another 00:16:38.792-->00:16:44.750 one, when we had 83 bugs, it’s kind of hard to uh like dive super deep cause you just keep 00:16:44.750-->00:16:49.458 finding more and more bugs. It took me a month just to write up the des uh analysis because it 00:16:49.458-->00:16:53.875 was you know 84 different vulnerabilities and I wanted to make sure that I, I was pretty 00:16:53.875-->00:16:58.708 thorough. So, in this particular one you’ll see, it’s php code, you’ll see uh request um global 00:16:58.708-->00:17:07.542 variable with uh name and password and redirect uri online it’s 29, 30, 31. Essentially 00:17:07.542-->00:17:12.958 with request it means it could be a cookie it could be a get it could be a post. Um, so what 00:17:12.958-->00:17:18.167 this particular code does the snip it thing that you notice is that it makes a request to this 00:17:18.167-->00:17:25.125 my dealing slash my dealing dot cgi uh cgi script and tries to compare the response to see if 00:17:25.125-->00:17:32.500 it has uh the auth status um string. And If it does and it notices that you are not 00:17:32.500-->00:17:38.458 authenticated it’s gonna spit you out. But the thing is this file doesn’t exist, so it 4 oh 00:17:38.458-->00:17:46.417 4’s, it never matches, and this authentication code does nothing. Um, so, yeah it, it's 00:17:46.417-->00:17:51.583 great it’s at the top of the arbitrary file upload if this worked, theoretically maybe it 00:17:51.583-->00:17:55.292 would be some kind of authentication, I don’t know where the my dealing portion 00:17:55.292-->00:18:02.042 comes in. Um, next slide. So, here’s where the actual file upload comes in. Um, you can see 00:18:02.042-->00:18:07.708 that there’s a request folder, so we can specify what folder the file gets uploaded into. 00:18:07.708-->00:18:13.000 Then it’s a multipart file upload in php and so that global uh variable files gets filled in 00:18:13.000-->00:18:18.125 with the filename of whatever file you upload. So between specifying the filename and 00:18:18.125-->00:18:22.958 specifying the folder, you can write to anywhere on the file system with any arbitrary name, 00:18:22.958-->00:18:29.042 with any arbitrary payload, um preauth. And so, if you see at the bottom, I have the POC, we 00:18:29.042-->00:18:35.375 essentially just uh, echo into temp slash PHP shell hit curl with a multipart file upload 00:18:35.375-->00:18:42.917 with the PHP shell, and then you have a PHP shell you can root the device with. Um, so you want 00:18:42.917-->00:18:53.167 PHP shells? Because that’s how you get PHP shells. Okay, next slide. So, we have this, we 00:18:53.167-->00:18:57.708 found this other bug and this bug is an authentication bypass and how it works is there’s this 00:18:57.708-->00:19:03.125 uh wto binary and this binary what it, what it really is meant for is it databases the users IP 00:19:03.125-->00:19:09.083 and the session timeout and and they call this binary to reset the the timeout and the IP and 00:19:09.083-->00:19:15.000 uh or set it or delete it or whatever is happening, logout/login um and then they 00:19:15.000-->00:19:21.458 also use an isAdmin cookie or a username cookie. Cookies are client supplied. So, there’s no 00:19:21.458-->00:19:26.375 real authentication in that portion the isADmin cookie if it equals 1 you’re an administrator 00:19:26.375-->00:19:30.625 they check the IP, they check that you’re logged in but, or that there’s an admin account 00:19:30.625-->00:19:37.292 logged in from your IP in the timeout but, then they also check the isAdmin cookie which 00:19:37.292-->00:19:41.583 is completely user supplied. They also check the username cookie uh, it could just be 00:19:41.583-->00:19:46.792 admin, it could be an actual username um and they use exec calls to essentially call this 00:19:46.792-->00:19:53.792 binary to reset everything and the CGI binaries do the exact same thing with this wto binary. 00:19:53.792-->00:20:03.250 On the left you can see uh arguments for it. Uh, next slide. So what we do here is um 00:20:03.250-->00:20:06.125 this is the network manager cgi and this is where the vulnerability really comes into 00:20:06.125-->00:20:12.833 place, um so there process is, they check if command, if the command get variable is equal to 00:20:12.833-->00:20:19.208 get CGI get IPV6. Then they check if the flag get variable is equal to 1. Uh, if those are 00:20:19.208-->00:20:26.208 the case they reset the WTO timeout and the IP for the admin user whatev- whoever is making 00:20:26.208-->00:20:31.292 that request. This is all prior to actually kicking the user out if they’re not authenticated, 00:20:31.292-->00:20:38.167 so, you just make this request and you are logged in um your WTO timeout resets, your IP 00:20:38.167-->00:20:46.500 resets um you get a 404 error but yet still resets the WTO information so uh, next slide. 00:20:46.500-->00:20:53.542 So, uh what we did is we took that authentication bypass, we took one of any or actually any 00:20:53.542-->00:20:58.875 of the 70 post auth RCEs that we talked about earlier and we team them together and you get uh 00:20:58.875-->00:21:06.292 root code execution. Um, so yeah they didn’t fix the RCEs and it made it just that much easier 00:21:06.292-->00:21:11.167 for us to team an authentication bypass with one of the uh post auth uh RCEs for a pre auth RCEs 00:21:11.167-->00:21:15.583 for a pre auth RCE, you can see at the bottom, we make the first request that resets the timeout 00:21:15.583-->00:21:20.375 and IP address and the second request actually executes the payload, in this case it’d be ID 00:21:20.375-->00:21:25.042 um and just as a heads up, I don’t think we mentioned this earlier, but the idea here is at 00:21:25.042-->00:21:31.958 the end of this talk, uh show a loop, or not a loop but a uh, a run through of all the demos uh 00:21:31.958-->00:21:35.542 all together, um we got a special guest coming, we’ve got some stuff to give out, we’re 00:21:35.542-->00:21:41.458 gonna have a lot of fun so, I recommend you stay till the end. Next slide. K and then we have 00:21:41.458-->00:21:47.042 this Vudu Spark. Vudu Spark is a media streaming stick it was only available from Walmart and 00:21:47.042-->00:21:53.500 Walmart dot com and uh it really only provides Vudu streaming service. Next slide. This 00:21:53.500-->00:21:58.958 particular one, when you get it you uh it’s a 20 dollar stick, it’s really cheap. It has a 00:21:58.958-->00:22:04.500 header for UART already, so you can just jam a wire in there, you can connect to the pads 00:22:04.500-->00:22:10.250 right underneath uh for the footprint of that header um and the top pin is ground, the 00:22:10.250-->00:22:16.250 second pin is tx and the next pin is rx um, fifty seven six hundred eight n one start it up, 00:22:16.250-->00:22:25.250 instant root shell, like Qua said earlier, there is no step three. Um, next, okay and so 00:22:25.250-->00:22:32.167 then we have the Amazon Tap, uh this was Amazon’s attempt at making an Alexa device that uh 00:22:32.167-->00:22:38.333 was portable. So the idea is you take this bluetooth speaker around, you tether it to your 00:22:38.333-->00:22:42.458 phone and you have Alexa on the go. Um, it’s always online, always listening, it has about 9 00:22:42.458-->00:22:49.042 hour battery and it actually has secure boot, unlike the echo or the dot. Next slide. Within this 00:22:49.042-->00:22:58.042 device is a freescale MX6, um the secure boot implementation is implemented within U-boot, um 00:22:58.042-->00:23:03.000 it's a popular open source boot loader. Um it boots from an eMMC flash so if all else fails we 00:23:03.000-->00:23:07.125 really could just pulled the flash, but there’s a way easier way, um it’s full of glue, I 00:23:07.125-->00:23:13.042 assume just to uh uh make sure it doesn’t rattle um it’s really pote, put together well for 00:23:13.042-->00:23:18.417 that. Um and we have a full teardown and I think Ifixit also has a full teardown, so just to 00:23:18.417-->00:23:24.708 give you a good picture of the board. Um, next slide. So, here’s how this one works, uh 00:23:24.708-->00:23:31.042 there’s a UART U-boot output with no shell. There’s a Kernel, uh Kernel debug output also no 00:23:31.042-->00:23:39.417 shell, and then there's a TM30 slash TM26 which is the tx rx for UART but again we don’t have 00:23:39.417-->00:23:44.708 a shell, what do we do? Um, well there’s this trick with U-boot that if you ground the flash at 00:23:44.708-->00:23:50.750 the exact right moment, it’s the the det zero pin one flash uh if you ground the flash at the 00:23:50.750-->00:23:55.333 exact right moment, a lot of times you get dropped into a U-boot shell and from U-boot you 00:23:55.333-->00:23:59.292 can do what we call kernel hijacking which is where you uh replace one of the command line 00:23:59.292-->00:24:06.333 arguments with uh kernel arguments with uh init equals slash bin slash sh and instead 00:24:06.333-->00:24:11.792 of the normal init scripts that happen when the device boots up, it runs init slash sh and you 00:24:11.792-->00:24:18.458 normally just drop into a root shell over UART. Um, so in this case, next slide, if you uh 00:24:18.458-->00:24:23.375 lower the resistor to ground at tp27 you can see how I did it in the right of the picture, and 00:24:23.375-->00:24:28.292 you ground it during boot after U-boot starts printing out output it drops to a U-boot 00:24:28.292-->00:24:34.167 shell. Um, and so then it’s pretty trivial, um we can’t read the environmental variables just 00:24:34.167-->00:24:39.667 because I-I think it’s some modified version of uh U-boot without printiv which is uh what 00:24:39.667-->00:24:43.625 we normally use to view all of the environment variables. Um but we can still write to memory 00:24:43.625-->00:24:51.625 and execute code, so um, next slide. Alright, so now I’m going to pass it over to [inaudible] 00:24:51.625-->00:25:10.375 alright [inaudible]. Come on up CJ. >>Hey Def Con I’m null string, how’s everybody doing? 00:25:10.375-->00:25:21.708 [applause] cool. Alright, you guys wanna see some more bugs? Alright, so yeah long time 00:25:21.708-->00:25:26.833 human, first time speaker, good to be here. Glad to be in front of everyone talking about these 00:25:26.833-->00:25:35.542 bugs. Uh we have the QNAP NAS TS-131 uh 131 and 131 P, and probably a few other models too, 00:25:35.542-->00:25:40.125 uh most of the consumer models. Uh they’re network attached storage devices, they have a 00:25:40.125-->00:25:46.708 nice little unix operating system on board, uh you can download apps from an app store. 00:25:46.708-->00:25:53.083 Do things like uh music transcoding, and video transcoding uh like uh like 00:25:53.083-->00:26:00.458 little picture book thing if you want to directly access your NAS to go through like a slideshow. 00:26:00.458-->00:26:05.625 Uh a lot of stuff like that. It runs at 1.6 gigahertz ARM processor uh actually pretty 00:26:05.625-->00:26:13.417 nice little devices uh it’s good if you just need a, a NAS for your house. Next slide. So uh 00:26:13.417-->00:26:18.667 there’s a couple of interesting services on the NAS, uh one in particular and well, before, 00:26:18.667-->00:26:24.625 before that just specifically uh services that listen just on the network uh that don’t have any 00:26:24.625-->00:26:30.417 authentication to access, just things that are forded out to the network, available on as you 00:26:30.417-->00:26:37.542 can see uh all interfaces. So uh, one such service is the my transcode server which is a 00:26:37.542-->00:26:44.583 video transcoding service uh you can upload and specify video files to be transcoded from one 00:26:44.583-->00:26:49.083 format to another uh and there’s several different commands that you can issue to the service 00:26:49.083-->00:26:55.667 over the network without any authentication. Next slide. So, one such command that you can 00:26:55.667-->00:27:02.750 issue is a rm file command. And the commands are issued in such a way that uh basically you 00:27:02.750-->00:27:11.083 specify a command string which is a d word specifies which command is to be executed, and 00:27:11.083-->00:27:15.417 then the parameters for that command. So for the rm file, you specify the d word, say which 00:27:15.417-->00:27:21.083 command you want to execute. And the first argument and only argument is the file path of the 00:27:21.083-->00:27:28.625 file that you want to delete from the uh video transcoding server. And uh so you would give 00:27:28.625-->00:27:34.167 it a d word, execute the command, the path to the file and then a null byte terminator. 00:27:34.167-->00:27:43.083 So, uh once you issue that command, it is issued to a uh another function, that does 00:27:43.083-->00:27:49.375 filtering on the file path you provide. Uh, the filtering, as you can see in the bottom right 00:27:49.375-->00:27:55.208 of the slide, filters out things like spaces, bangs, dollar signs, anything you would think 00:27:55.208-->00:28:01.667 like would be good to execute a command with. However, they failed to filter out backslashes 00:28:01.667-->00:28:09.667 and vertical pipes in that function. So, uh by issuing a command that contains vertical 00:28:09.667-->00:28:14.500 pipes at the beginning and end after an initial slash to get past another check to make sure 00:28:14.500-->00:28:20.167 it’s a proper path, and a proper path apparently is any string that starts with a uh a slash. 00:28:20.167-->00:28:28.250 So uh you issue a command, uh to remove a file backsla or forward slash and then a pipe and then 00:28:28.250-->00:28:36.333 you can execute any command after the pipe. So uh next slide. So there’s uh you can see 00:28:36.333-->00:28:40.208 the format of the command, uh there. Uh the d word at the beginning, uh oh x oh 1 followed 00:28:40.208-->00:28:45.625 by 3 null bytes to execute the rm file command, a single slash and then wrapped in vertical 00:28:45.625-->00:28:49.958 pipes you can put any command you would like to be executed as root and a terminating null 00:28:49.958-->00:28:58.625 byte. So, you can see here at the bottom we have a POC to uh kerl a shell script and just 00:28:58.625-->00:29:03.292 pipe it right into bash and uh you can put anything you want in there, a bash reverse shell, 00:29:03.292-->00:29:09.750 another file download, load a kernel module cause it’ll let you do that, um whatever you’d 00:29:09.750-->00:29:17.000 like and just basically fire it off with that service and it will execute it as root. Next 00:29:17.000-->00:29:23.833 slide. Alright, next up we have the Belkin N300 WiFi range extender. It’s like aaaaa wall 00:29:23.833-->00:29:29.625 vampire range extender. You plug it into the wall, you login to its little open wifi network and 00:29:29.625-->00:29:34.375 configure it. You give it your wireless network credentials and it will extend the range of your 00:29:34.375-->00:29:38.542 wireless network. Uh I guess it's for places like uh if you’ve got like a big house or a 00:29:38.542-->00:29:42.375 house with bathrooms in weird places where you can’t get very good wifi coverage you plug it 00:29:42.375-->00:29:48.250 into your wall set it up on your network and it will extend the range of your network a little 00:29:48.250-->00:29:56.042 bit. So, uh starting off we just do a hardware root, just like tear the bezel off of it and 00:29:56.042-->00:30:00.292 look around for headers and pins, anything we can get to uh get to the debug console and see 00:30:00.292-->00:30:04.000 what it’s doing behind the scenes while we do stuff in the network interfaces. Uh it’ll 00:30:04.000-->00:30:10.000 drop to a root shell once you find the UART pins. Uh I think we have a picture on the next 00:30:10.000-->00:30:14.917 slide, or maybe not but it’ll be on the wiki either way if you want to go that way. But you can 00:30:14.917-->00:30:19.792 skip the entire hardware root process at this point. Uh after getting the hardware root, we 00:30:19.792-->00:30:26.500 went and pulled the firmware, looked around, uh looked through the web application files and uh 00:30:26.500-->00:30:30.875 setting hidden dot asp which is the uh the file you’re directed to when you want to go set up a 00:30:30.875-->00:30:37.125 wireless network that's not broadcasting its ssid. That particular script uh as executed 00:30:37.125-->00:30:42.417 by the CGI uh it doesn’t do any sanitization or checking against any of the form parameters that 00:30:42.417-->00:30:46.917 you provide. The only sanitization or checking that is done is on the client's side so 00:30:46.917-->00:30:51.792 you can just bypass it completely and uh just throw in any kind of command injection. 00:30:51.792-->00:30:55.292 So just like throw some semi colons and a command you want executed into any of the 00:30:55.292-->00:30:59.875 parameters and it will get passed to the shell when it does the wpa supplicant commands to 00:30:59.875-->00:31:04.500 setup the wireless configuration. Doing that uh runs as root along with every 00:31:04.500-->00:31:11.917 single other service and process on the device uh eh eh it makes sense uh your not really 00:31:11.917-->00:31:15.583 expecting anyone to be getting on here, you don’t really need to set up like access control 00:31:15.583-->00:31:18.958 for different users if it's a device that you never expect anyone to get a shell on in the 00:31:18.958-->00:31:25.208 first place, so uh any command you execute through that will execute as root. Next slide. 00:31:25.208-->00:31:32.750 Here you can see uh there’s a couple caveats as far as actually getting uh exciting 00:31:32.750-->00:31:36.708 commands executed, uh the busybox binary that’s provided on the device is uh fairly 00:31:36.708-->00:31:42.000 limited uh it’s not really the standard busybox so the best uh commands that you can do to get 00:31:42.000-->00:31:48.958 a callback or any kind of network communication off of the device would be Wget or ping. So 00:31:48.958-->00:31:56.333 there’s no tel or no telnet, no netcat, no telnetd even. Uh so basically what you’d end up 00:31:56.333-->00:32:00.875 having to do if you wanted to get a shell back out over the network would be to, similar to 00:32:00.875-->00:32:06.375 the uh to the qnap payload from before you would Wget a payload on the device, or you could also 00:32:06.375-->00:32:10.667 tftp a payload onto the device and then use the command execution to execute the payload 00:32:10.667-->00:32:16.958 at the path you downloaded it to. Doing that will also run as root, and uh here at the bottom 00:32:16.958-->00:32:22.458 you can see we have a poc for that exact payload uh you can see wget then echo a, uh that’s 00:32:22.458-->00:32:31.750 about all it takes. Any one of these fields, these uh aaa, bbb, ccc,ddd, eee,fff, all of those, 00:32:31.750-->00:32:42.500 anywhere just uh put your payload anywhere you want and put these form fields and it 00:32:42.500-->00:32:45.500 will execute as root. Next slide. Alright, the Netgear WN3000RP WiFi extender. Super 00:32:45.500-->00:32:49.875 similar to the Belkin, uh same thing, you plug it in, configure it, it extends the range of your 00:32:49.875-->00:32:53.333 wireless network, so you can get around like bathrooms or if you have like a giant house and 00:32:53.333-->00:33:02.083 don’t have like 5 gigahertz wifi. Uh, so yeah, you plug it in, and uh it runs MIPS32 uh SOC 00:33:02.083-->00:33:06.625 and it’s got a openWRT KAMIKAZE instillation on it. Everything else is just uh sort of in a 00:33:06.625-->00:33:13.750 assist file. Next slide. So, UART, uh super easy to locate right underneath the uh net 00:33:13.750-->00:33:23.375 header uh, so from the right side it's vcc and then over on the left is ground and you just 00:33:23.375-->00:33:28.750 uh plug your UART adaptor into there and boot it up and be patient and it drops into a root 00:33:28.750-->00:33:33.917 shell you could execute telnet after it boots up and get a better shell over the network, 00:33:33.917-->00:33:43.417 and have full access to your wifi range extender. Next slide. And you can see, logging in over 00:33:43.417-->00:33:49.250 telnet uh they didn’t change the uh login banner so it’s just opened up WRT KAMIKAZE and the 00:33:49.250-->00:33:58.042 only user on the device is root once again. So, no access controls, uh just uh, just the 00:33:58.042-->00:34:05.000 root user. Next slide,yeah. Alright, uh the Linksys WRT1200AC. It’s a, it’s a really 00:34:05.000-->00:34:12.875 nice router, it’s uh fast, uh it’s got a 1.3 gigahertz dual-core ARM processor, 00:34:12.875-->00:34:19.458 wireless A through C and the firmware version for our bug is 1 point zero point 5 point 00:34:19.458-->00:34:28.292 177401, which as of the other day is the latest firmware released by Linksys. Next slide. 00:34:28.292-->00:34:32.208 So the bug here uh is post authentication. You log into the device with your administrator 00:34:32.208-->00:34:36.375 credentials and you go to the file sharing section, and the file sharing section is setup to 00:34:36.375-->00:34:41.500 allow you to do like uh DLNA so if you wanted to cast something to like a chromecast or another 00:34:41.500-->00:34:47.542 media streaming device or if you wanted to access your router for whatever reason over ftps from 00:34:47.542-->00:34:54.333 somewhere else. Or, uh if you want to use ftp locally or uh I think it also has smb within the 00:34:54.333-->00:35:02.000 internal network as well. So uh, you can specify a specific path uh within the file sharing path 00:35:02.000-->00:35:08.750 uh in the administrator section of the web interface for the router. However, the only uh 00:35:08.750-->00:35:17.542 only sanitization takes place on the client side in javascript. So, normally what it would do is 00:35:17.542-->00:35:23.000 when you would go and try do like a directory traversal or uh absolute path to something 00:35:23.000-->00:35:27.208 that’s outside of where it’s originally set up uh it would give you an error saying that 00:35:27.208-->00:35:32.458 it’s an invalid path and it would make you start over. However, if you just grab a 00:35:32.458-->00:35:38.083 valid command as a curl or a,a valid request as a curl command and then modify the variables 00:35:38.083-->00:35:43.875 there, uh there’s no verification or sanitization whatsoever on the server side. 00:35:43.875-->00:35:49.708 So you can basically provide any path you’d like. Next slide. So here you can see a curl command 00:35:49.708-->00:35:54.500 where I removed the credentials from my router. Uh and you would have to put your own credentials 00:35:54.500-->00:35:59.542 in there. Uh, but as you can see here towards the bottom on the left uh test user and password 00:35:59.542-->00:36:05.917 is admin, haha, uhh, yeah. And so you can uh, you can provide a direct traversal string and 00:36:05.917-->00:36:11.083 traverse all the way back to the root directory. Uh hop on over ftp and then just drop some 00:36:11.083-->00:36:16.750 scripts into init or uh rc dot d and have them execute as root when the device boots up again. 00:36:16.750-->00:36:22.000 So, basically drop whatever script you want, whether it's telnet or adding a user to the 00:36:22.000-->00:36:26.958 password file or whatever you’d like uh again executed as root when the device boots up. Or if 00:36:26.958-->00:36:31.250 you just want to pull files off of the device after you get the direct root first swap you can 00:36:31.250-->00:36:41.625 do that as well. Next slide. The uh LG BPM350 is a blu ray disc player, and it also has uh wifi 00:36:41.625-->00:36:48.792 and apps and streaming things like that, it’s one of the smart blu ray players. Uh it’s 00:36:48.792-->00:36:52.833 actually a, it’s a pretty nice device. It’s one of the few that I decide to keep after this, uh 00:36:52.833-->00:36:59.583 it’s a pretty nice media player, I-I recommend it, it’s pretty cheap too. So, uh it includes 00:36:59.583-->00:37:04.417 uh, like a little app store and a few pre-defined apps that you can uh, you can download right 00:37:04.417-->00:37:08.958 away and then other ones that you can download from the store, and one of the apps that it 00:37:08.958-->00:37:11.875 comes pre installed with is the pandora internet radio app. Uh, the interesting thing about the 00:37:11.875-->00:37:18.583 Pandora internet radio app, uh on this particular device, it’s one of the few apps that uh has 00:37:18.583-->00:37:23.000 sort of like an execution chain to actually start the app up. So, the first thing is a binary 00:37:23.000-->00:37:27.917 that gets executed, that calls a shell script on the local file system and that particular shell 00:37:27.917-->00:37:40.792 script will go through and uh and check for multiple file paths for the actual Pandora app 00:37:40.792-->00:37:48.958 to execute. It just so happens that that script will check for the file paths uh for paths that 00:37:48.958-->00:37:55.375 are mapped to USB devices instead of the local file system first so it tries uh like for 00:37:55.375-->00:38:01.208 instance like sda1 or sdb1 before it will go and try the uh mounted block for the flash file 00:38:01.208-->00:38:07.708 system. So, what you can do is you can basically just uh use the correct file name that it's 00:38:07.708-->00:38:12.083 looking for on the USB device put whatever payload you would like in that shell script, plug 00:38:12.083-->00:38:17.625 in the USB device and launch the Pandora app and it will execute your command as root. Next 00:38:17.625-->00:38:28.792 slide. Yeah, so uh, uh you can also set it up. It’s really easy to grab the command uh to 00:38:28.792-->00:38:33.625 actually execute Pandora normally off of the file system, so you just throw that into the 00:38:33.625-->00:38:38.083 end of your command execution after you get a shell set up, just a quick uh, it even has 00:38:38.083-->00:38:42.292 like the dev tcp and everything in prox so you can do a really simple bash reverse shell, get a 00:38:42.292-->00:38:47.625 shell onto the device and start Pandora so you can listen to music while you continue hacking 00:38:47.625-->00:38:52.500 [laughter]. So, uh yeah if you just wanna like you can grab that out of the slide, go pick 00:38:52.500-->00:38:55.333 one of these up at like Walmart or something for like 40 bucks and you can have a nice rooted 00:38:55.333-->00:38:59.750 uh DVD player uh take off all the region locking and everything and watch whatever 00:38:59.750-->00:39:10.875 you want on it. Next slide. The D-Link DCS 936-L Wi-Fi camera. It is a smart camera with a wide 00:39:10.875-->00:39:17.417 angle lens, a 720p HD display, built in night vision and sound detection and motion detection. 00:39:17.417-->00:39:22.833 It’s actually a pretty nice camera, um, not nice enough to keep, but it’s really nice, if 00:39:22.833-->00:39:28.083 you want one in your house, if you want that. Uh, the firmware version for the bugs we found 00:39:28.083-->00:39:35.375 was 1 point 02 point 01. Uh, last checked a couple days ago, still good, no updates yet. Next 00:39:35.375-->00:39:42.542 slide. So, one of the issues we ran into when working on this device was that the firmware 00:39:42.542-->00:39:49.667 updates are encrypted. Uh rsa I think it was twenty fourty eight bit encryption. Uh, so we were 00:39:49.667-->00:39:54.167 having trouble getting into the firmware to actually uh look at what the device was doing. Uh, 00:39:54.167-->00:39:59.792 we ended up finding some, some bugs in the web interface we were able to use to get access 00:39:59.792-->00:40:04.333 to the device and pull the firmware off that way and figure out how it actually uh decrypts 00:40:04.333-->00:40:14.250 the firmware update. So, what it does is uh it does a uh aes encrypted basically uh rsa key 00:40:14.250-->00:40:19.833 decrypts that it uses that key to decrypt a couple of different firmware blobs and then flashes 00:40:19.833-->00:40:24.208 or uh writes them onto the flash. You can see here it’s, it’s, it’s really just using 00:40:24.208-->00:40:31.458 system to openssl encryption and decryption. Uh, so, uh pretty easy to f, uh to find when your 00:40:31.458-->00:40:35.500 looking through the firmware to figure out how it’s working. So we got that one worked out 00:40:35.500-->00:40:38.875 pretty quick. Uh, we haven’t verified any of the other device models yet, but, uh based on 00:40:38.875-->00:40:46.083 what we’ve seen, it’s more, it’s more than likely that uh most of the encrypted firmware updates 00:40:46.083-->00:40:54.125 for the d-link devices are going to be using the same key, which is on the next slide. Yeah, that 00:40:54.125-->00:40:59.792 one. So uh yeah you run those two commands on the firmware file, you can just download it 00:40:59.792-->00:41:04.792 straight from d-link’s website, run these two commands, extract the firmware and uh dig around 00:41:04.792-->00:41:10.833 for a better bugs. That key, you can just copy that, you can skip those commands up there above, 00:41:10.833-->00:41:16.875 or the first one, uh and go ahead and just do the second one and use that key. Uh, you can 00:41:16.875-->00:41:20.208 write your own firmware encrypted with that key and it’ll upload it, uh install it 00:41:20.208-->00:41:26.458 that way, if you want to do a custom firmware as well. Next slide. And the bug that we use 00:41:26.458-->00:41:31.542 to actually pull the firmware encryption key off in the first place was this post 00:41:31.542-->00:41:37.833 authentication root command injection via arbitrary command injection due to improper 00:41:37.833-->00:41:42.625 sanitization. So uh, at, like at this point with this device, it seems like you could go to Best 00:41:42.625-->00:41:48.875 Buy or Walmart or Target or any of those stores and pick up like any given device that says smart 00:41:48.875-->00:41:54.042 on the box and just put a command injection in the SSID field and you’ll get a F*****g 00:41:54.042-->00:42:00.542 root shell [laughter]. So, yeah. That com uh that curl command right there, super quick, you 00:42:00.542-->00:42:05.083 just uh log on to the device, uh it leaves default credentials when you first get it and just 00:42:05.083-->00:42:11.583 shove whatever command you want to execute into the SSID field and it’ll execute it as root, 00:42:11.583-->00:42:20.708 only one user. So, uh yeah, if you wanna hack some cameras or media players, anything that 00:42:20.708-->00:42:25.542 says smart on the box, probably a good bet that the uh SSID field is going to be completely 00:42:25.542-->00:42:30.500 unsanitized, and then just shoved right into a wpa_supplicant command, just 00:42:30.500-->00:42:40.500 execute as root and next slide. And the Lutron LBDG2WH Caseta smart bridge it's uh one of the 00:42:40.500-->00:42:46.083 smart bridges for your house uh control your like smart power outlets, your smart blinds, your 00:42:46.083-->00:42:51.708 smart garage, smart cat, smart dog, all that stuff. Uh, you can control up to 50 devices, 00:42:51.708-->00:42:56.333 including smart cats and dogs, and lights, thermostats, dimmers, all that stuff. Next 00:42:56.333-->00:43:08.000 slide. So, uh once again, another UART interface, unlabeled, sitting on the board, 00:43:08.000-->00:43:12.625 you can see that there are three test pads there. Uh on the farthest left you’ve got ground 00:43:12.625-->00:43:21.458 and then tx and rx, uh just drop some rossen on there, and then tin the pads and then just put 00:43:21.458-->00:43:25.417 some magnet wire on it you can get right on. Uh digging around the file system, you can pull 00:43:25.417-->00:43:30.208 off the applications that are included on the file system, any kind of ssh keys, private keys, 00:43:30.208-->00:43:38.208 uh, keys for communication with the external servers and all of that. The cloud stuff, uh yeah. 00:43:38.208-->00:43:48.792 Just uh drops straight into a root shell, solder onto it and get on, it’s that easy. Next 00:43:48.792-->00:43:57.792 slide. And change places, this is CJ zero zero zero >>Howdy all, um I’m disappointed that I 00:43:57.792-->00:44:03.125 left my scotch up here, not back there because now I have a whole glass. But Amir if you could 00:44:03.125-->00:44:12.792 advance the slides please. OH that’s good. So, first off, uh Vizio smart TV. Specifically the 00:44:12.792-->00:44:21.167 P602UI. It’s a 4k smart TV. It has all the bells and whistles for you know a year ago or so. 00:44:21.167-->00:44:28.500 Kind of cheap, no HDR, four two zero chrome reversal 422 excuse me 422. Uh for those in the 00:44:28.500-->00:44:33.375 audience who know, it’s a big deal, if not it doesn’t matter. Um new TVs are better. Um full 00:44:33.375-->00:44:39.375 ray backlit SDK has different, a different SOC for the 4k bits. Uh sigma system on chip as I 00:44:39.375-->00:44:43.542 mentioned, which will be important later, uh and it’s also a Yahoo smart TV which 00:44:43.542-->00:44:54.000 apparently was a thing for a while, nobody uses it anymore but, it will be important. Amir 00:44:54.000-->00:44:56.375 if you could advance please. So, first attempt when I got the TV, of course I didn’t want to just 00:44:56.375-->00:44:59.875 pull it apart because my lovely wife would get kind of pissed off saying why’d you break the 00:44:59.875-->00:45:05.792 TV? So, bought a main board and I will whore our blackhat talk again. If you look at our 00:45:05.792-->00:45:11.000 blackhat talk we talked about extracting eMMC flash, reading data. Uh from there we’re able 00:45:11.000-->00:45:16.167 to read write, read and write eMMC, eMMC flash, that way we were able to as Amir talked 00:45:16.167-->00:45:22.208 about earlier, extract a lovely firmware, look through it, find all the little good bits and go 00:45:22.208-->00:45:27.667 from there. We also added a back door for debugging purposes cause it wasn’t, the kernel was 00:45:27.667-->00:45:33.667 signed, the file system was also signed but there was an envy RAM partition that was not signed, 00:45:33.667-->00:45:38.208 which we, which is used for persistence so you could just drop a by- a payload there and 00:45:38.208-->00:45:43.667 win, but that’s not the fun stuff. Amear if you could advance. So, there’s a user 00:45:43.667-->00:45:48.833 manual feature. The user manual feature after you after you got the firmware digging through it 00:45:48.833-->00:45:52.375 is actually an HTML page that's launched by a hidden opera web browser. Not accessible, but 00:45:52.375-->00:45:56.292 it’s there, it’s used for like Netflix and Amazon, and a bunch of different apps that are 00:45:56.292-->00:46:00.167 relatively useless. Um, the user manual also has an update procedure. So, I was like hey, 00:46:00.167-->00:46:05.125 this looks interesting. Digging through it, it pulls a tar file down from an https server, there 00:46:05.125-->00:46:10.083 is certificate pending, um and that does a gpg check so there’s a signature check, not really a 00:46:10.083-->00:46:14.167 great avenue, but I’m like how does it download? There’s javascript command called sigma 00:46:14.167-->00:46:20.792 dot exec and it lend- runs a wget command. And I’m like hmmmm okay. So, using that command you 00:46:20.792-->00:46:28.083 can run any, any command you want on that TV as root, and it will execute depending on where 00:46:28.083-->00:46:32.625 it is, you could potentially even do a man in the middle which we’ll talk about if we 00:46:32.625-->00:46:39.833 could advance to the next slide please. So, if we make a custom app, um what we can do is some 00:46:39.833-->00:46:46.375 fun trickery. The Yahoo smart TV development kit is still online and a thing, you make a tiny app 00:46:46.375-->00:46:52.375 and the app is an html file and xml file, nothing fancy and some javascript, there’s a sample 00:46:52.375-->00:46:57.875 that I pulled and just made some changes. So you take the sample, you push it to there server, and 00:46:57.875-->00:47:03.708 then from the TV you can download it and it pretty much when you run it, it accesses a 00:47:03.708-->00:47:08.625 custom library called lip sigma something or other dot so, from that lip sigma it parses things, 00:47:08.625-->00:47:14.125 there use to be a white list of Amazon, Netflix, local host, file, stuff like that, now 00:47:14.125-->00:47:20.083 that’s pretty much gone. But, it, my thought is, if we make a custom app, point it at a file 00:47:20.083-->00:47:24.542 descriptor, can we actually run javascript code as root? If we can advance to the next slide 00:47:24.542-->00:47:29.750 please. So, if we use that lovely URL command, were reference, were installing an 00:47:29.750-->00:47:35.000 app, uh with an xml file and referencing an html file inside of it to launch. So, it’s kinda 00:47:35.000-->00:47:40.917 like going to a homepage on a web browser, but with a lovely built in app, with our lovely 00:47:40.917-->00:47:45.042 logo so that’s actually in the development store right now. Um, that pretty much points at an 00:47:45.042-->00:47:51.042 HTML file that uses the same sigma dot exec command to launch a telnet daemon on port 1337, 00:47:51.042-->00:47:56.417 and then, root shell, nice and easy one app click and there you go. So, if we could advance to 00:47:56.417-->00:48:00.500 the next slide please, we’ve got some more devices and I’ve gotta get through them kind of quick. 00:48:00.500-->00:48:05.042 So, obviously I’m not James Bond, I can’t even run, but say I want to spy on somebody. 00:48:05.042-->00:48:11.167 There’s this AOBO smart cam on ebay, I’m sorry well ebay, Amazon, your pick. Um, 20 bucks, 00:48:11.167-->00:48:17.292 it’s supposed to be great. If we could advance. So, when you turn it on, it’s got a little battery 00:48:17.292-->00:48:20.875 built in, it creates its own access point, broadcasting in the clear, so you know, no 00:48:20.875-->00:48:28.667 counter intelligence service of Target would ever, ever find this. Um, the AP also doesn’t 00:48:28.667-->00:48:33.708 need a password. So, you just directly connect to it. Not great. Nmapping it shows open 00:48:33.708-->00:48:38.708 ftp and telnet, at this point I’m like, this is dumb. Uh, if you could advance please. So, 00:48:38.708-->00:48:43.542 I’m hoping at least there’s a username and password audit. Username yes, password no. Login 00:48:43.542-->00:48:46.833 with the username root [laughter] you’ve got, you’ve got the camera [applause]. So, 00:48:46.833-->00:48:57.208 if you could advance please, instead of James Bond it’s more like Spies Like Us because they 00:48:57.208-->00:49:03.292 don’t know what the h**l they’re doing. So, next up is the Cujo. It’s a home security firewall 00:49:03.292-->00:49:07.583 designed to protect pretty much everything on your network from hackers against internet of 00:49:07.583-->00:49:13.333 things and viruses and all the big evil scary things. It’s 250 bucks and it’s 3 pieces of 00:49:13.333-->00:49:19.208 plastic covered in all globs of glue. If you could advance please. Literally had to break 00:49:19.208-->00:49:23.750 the plastic to get the main board out, ripping, ripping, ripping. I guess this might be 00:49:23.750-->00:49:29.000 tamper evident to stop quote on quote hackers or I have no fricken clue. If you could 00:49:29.000-->00:49:33.625 advance please. The main board, also covered in glue, across a bunch of nice little interesting 00:49:33.625-->00:49:40.958 pads, in the kitchen with an ove glove and a paint uh, uh a wallpaper um heat gun, you can 00:49:40.958-->00:49:44.750 actually pull that glue right off. So, it doesn’t really do anything and if you could 00:49:44.750-->00:49:49.875 advance please. We’ve got access to UART on those pads, same type of thing as the Amazon echo if 00:49:49.875-->00:49:53.792 you ground up the eMMC data line which is really tiny you can’t see but the slides will be 00:49:53.792-->00:49:58.375 online, there’s a full res pictures, you can then get, you, you can then get U-boot 00:49:58.375-->00:50:04.542 bootloader shell access and read and write memory to your hearts content. We’re working on 00:50:04.542-->00:50:09.417 building that further, get the file system out, this was my last weekend. Uh, could you 00:50:09.417-->00:50:14.917 advance please? Uh, VeraEdge smart home controller. Home automation hub you know, lights, 00:50:14.917-->00:50:20.917 doors, thermostat, all that jazz. Please advance. Um, there’s a local file disclosure 00:50:20.917-->00:50:24.833 bug with the store file and get file dot sh, pretty much you call store file dot sh and then 00:50:24.833-->00:50:33.000 get file dot sh. Store file dot sh creates a file, a folder, my b- excuse me, creates a folder 00:50:33.000-->00:50:39.042 in the right spot and then get file will let you pull something using directory traversal as you 00:50:39.042-->00:50:44.500 can see it that second curl and we’re specifically targeting etc cmh cmh dot conf. Go to advance 00:50:44.500-->00:50:50.542 please. So, from there we just got, it’s a simple bash script, nothing crazy, we pull get file, 00:50:50.542-->00:50:57.333 we use get file dot sh to pull etc cmh cmh dot conf. We pull down a thing with the SSID and 00:50:57.333-->00:51:07.792 password, which is also printed on the box. So you know, there uh, better that it’s on the box, 00:51:07.792-->00:51:11.833 but whatever. Um, fun fact,that password is also the same password for ssh root login. So, 00:51:11.833-->00:51:16.125 you can grab the password nice and easily by just running this all pre auth. Which, this hasn’t 00:51:16.125-->00:51:20.833 been released before as of the rest of them, nor have the rest of them. If you could advance 00:51:20.833-->00:51:24.833 please. And the last chew, and I’m going to be quick about this cause we have a special guest 00:51:24.833-->00:51:29.083 coming up, it's a smart speaker, WiFi, you know Pandora, IHeartradio, Spotify, has an 00:51:29.083-->00:51:34.750 android app. If you could advance please. Uh, we reversed the android app, and I say 00:51:34.750-->00:51:39.042 reversed because you know simple tools, it’s java. Uh, found the update procedure, cleared the 00:51:39.042-->00:51:43.917 update server, got the firmware back as Amear was talking about earlier, from that firmware, we 00:51:43.917-->00:51:48.292 identified a potential vulnerability in rootApp, uh the iwpriv was just passing 00:51:48.292-->00:51:53.292 commands, was being executed with percent s which is for string, this being passed right 00:51:53.292-->00:51:57.125 to system, great thing to check for, not escape, not anything, and that can actually be 00:51:57.125-->00:52:02.792 accessed pre authenticated through httpapi. If you could advance please. Uh, here’s the 00:52:02.792-->00:52:08.875 curl, you see usr bin, telnetd, usr sbin telnetd, which is a thing going. Now we have root on 00:52:08.875-->00:52:12.917 the device, again pre auth, this is on the internet it gets pumped. Could you advance 00:52:12.917-->00:52:18.250 please? So, that had me thinking, this was another Fry’s trip, uh Cobblestone Wifi audio 00:52:18.250-->00:52:23.042 receiver, pretty much the same thing but without a speaker and considerably cheaper. Thank you 00:52:23.042-->00:52:31.000 sir. Uh could we advance please. Um again, Thursday went to Fry’s Las Vegas, super great for last 00:52:31.000-->00:52:35.417 minute things, although we spent like 3 hours there because too much time in Fry’s. Needed to 00:52:35.417-->00:52:39.542 confirm a hypothesis, the thing did have a telnet server with the username admin password ad 00:52:39.542-->00:52:44.625 admin, that’s not the important part if you could advance please. Same exact exploit 00:52:44.625-->00:52:48.792 worked, different manufacturer, so that confirmed the hypothesis. If you could advance 00:52:48.792-->00:52:56.625 please. Uh, same bug, different manufacturer as I said, part of a turnkey wifi solution called 00:52:56.625-->00:53:04.125 LinkPlay, uh that’s the link to all the after we reverse the app reversed, all of the firmware’s 00:53:04.125-->00:53:09.875 in there uh 96 unique models, 7 hardware revisions many appear to be affected by this remote 00:53:09.875-->00:53:17.833 code execution, there are 35 products listed on the LinkPlay wiimu page alone. If you could 00:53:17.833-->00:53:20.375 advance. Which encompass all of these, we haven’t bought them, we’re assuming most of them are 00:53:20.375-->00:53:25.292 vulnerable, not really sure. But now I’m going to hand it back to Amear if you could advance the 00:53:25.292-->00:53:46.792 slide please because we have some freebies [applause][laughter] >>alright 00:53:46.792-->00:53:50.792 everyone so yeah we have some freebies and were not, so here’s the thing, we got a ton of them, 00:53:50.792-->00:53:55.125 um I’m going to explain to you what they are real quickly, we’re going to give them out 00:53:55.125-->00:54:05.208 while we are showing our roots um and so that’s the plan um yeah, we got a special guest, um 00:54:05.208-->00:54:11.125 what I want to do is let’s get everyone to start changing dual core so we can get him to come 00:54:11.125-->00:54:18.833 up here, do a little rap and really make our exploit show. So, uh, I got some free stuff, I 00:54:18.833-->00:54:24.500 got some free dual core CD’s,I got some free boards, first of all, the boards, before we start 00:54:24.500-->00:54:30.375 chanting, we have eMMC boards, what they do is, they allow you to communicate with eMMC flash, 00:54:30.375-->00:54:34.625 with as little as 5 pins through a standard SD card reader/writer. We have a white 00:54:34.625-->00:54:41.042 paper for it you can go look up, um from blackhat this year we’ll have you know probably roughly 00:54:41.042-->00:54:44.708 2-->000 of these, we have some Exploitee.rs stickers and the CD’s, we’ll just be walking 00:54:44.708-->00:54:50.000 around handing them out um try to give Dual Core some attention, I know you want 00:54:50.000-->00:54:55.208 freebies, but he’s awesome and he’s agreed to come out and do some stuff for us so let’s go 00:54:55.208-->00:54:58.917 ahead and chanting Dual Core, let’s get this guy going up here, come on [applause] come 00:54:58.917-->00:55:10.125 on, Dual Core, Dual Core, come on, Dual Core, come on, come on, Dual Core, Dual Core, Dual Core, 00:55:10.125-->00:55:17.792 Dual Core, come on buddy, Dual Core, Dual Core, Dual Core, yeah boy [applause] The nicest guy 00:55:17.792-->00:55:24.292 ever, nicest guy ever, come here buddy give me a hug. Dual Core, Dual Core. >>Make some noise for 00:55:24.292-->00:55:37.458 Exploitee.rs [applause]. They truly hack all the things. My name is nt80 I’m the rapper and 00:55:37.458-->00:55:41.917 Dual Core, I’d like to play a song called all the things. We’re gonna rap, drink all the 00:55:41.917-->00:55:55.042 booze and hack all the things. Row 64 connecting to NASA. Pump it up, you can make it go to 11, 00:55:55.042-->00:56:02.250 here we go. Yo, even out settle scores quick, our disaster recovery requires even more disc 00:56:02.250-->00:56:07.542 put your bytes up prove it or you forfeit got my C64 and we blew it into orbit N bytes with 00:56:07.542-->00:56:13.042 8 straight perfect [indiscernible] in motion make 8 great circuits incase you heard 00:56:13.042-->00:56:18.167 it's a name fake service, optimize our run time to escape verdicts, got an image in a 00:56:18.167-->00:56:22.375 scope flow and then they can’t sign pass the code sanitize command lines landmine. So 00:56:22.375-->00:56:28.792 before they’ll see me after running I start virtual plus velociraptor don’t prove we’re 00:56:28.792-->00:56:33.500 human unless we really have to my team builds schemes and destroy recaptcha hate what they 00:56:33.500-->00:56:38.292 see, finish this chapter by the way we’re not any geeks we hacked into NASA we drink all 00:56:38.292-->00:56:47.208 the booze, drink all the booze, drink all the booze got this vodka and this redbull they 00:56:47.208-->00:56:55.542 still give me wings so we drink all the booze, drink all the booze, drink all the booze, zero 00:56:55.542-->00:57:00.833 through three we’re in every single ring, yo I’m just waiting till my blackberry dies cause 00:57:00.833-->00:57:05.167 I’ll replace it with a raspberry pi, don’t compare to this try it made everything they said dull, 00:57:05.167-->00:57:09.583 neutralize any threat to red skull to dev no they killed virus writers that we mention 00:57:09.583-->00:57:15.500 but instead they ascended to the vx heavens and reincarnate as live wires still inside 00:57:15.500-->00:57:21.875 hindsight design device drivers, which school will we hit next? They didn’t want to form that so 00:57:21.875-->00:57:26.542 we gotta print app, next step there’s a chin check free styles and I spin best they didn’t 00:57:26.542-->00:57:32.833 decrypt yet crush internet MCs and rhyme battles get your wifi deck that’ll hack by pineapple I 00:57:32.833-->00:57:40.500 don’t think you’ll like my snapple cause I popped it with Vodka and a cyanide capsule. 00:57:40.500-->00:57:49.833 Make some noise for Exploitee.rs [applause] Here we go, we drink all the booze, drink all the 00:57:49.833-->00:57:58.625 booze, drink all the booze, got this vodka and this redbull they still give me wings so we drink 00:57:58.625-->00:58:07.333 all the booze, drink all the booze, drink all the booze, you know there’s gonna be security 00:58:07.333-->00:58:12.375 right? First we drink all the booze then hack all the things, then backdoor the firmware on 00:58:12.375-->00:58:16.875 anything you bring, regardless of the hardware service or recoded, connected to the 00:58:16.875-->00:58:21.208 internet someone’s gonna own it. This is for the pirates that clap and love the sound, 00:58:21.208-->00:58:25.833 attacking from the clouds and were back and underground there's some asking from us how 00:58:25.833-->00:58:30.750 tour notes around the globe track and hunt you down hacked on a schedule add it to your 00:58:30.750-->00:58:36.042 calendar devices online, here comes another challenger safe infiltrated, so undercover, this 00:58:36.042-->00:58:40.250 is for my comrades whose there with their debuggers that trace every buffer examine any code 00:58:40.250-->00:58:47.250 flow haven’t been to sleep, pop another nodoze think I need a planet sized urn cause some men 00:58:47.250-->00:58:56.417 just wanna watch the world burn, your turn here we go, we drink all the booze, drink all the 00:58:56.417-->00:59:03.792 booze, drink all the booze, got this vodka and this redbull they still give me wings so we drink 00:59:03.792-->00:59:13.667 all the booze, drink all the booze, drink all the booze, zero through three were in every 00:59:13.667-->00:59:18.667 single ring I mean these servers have more firewalls than the devil's bedroom. Hack all the 00:59:18.667-->00:59:25.917 things. Everybody hit up Exploitee.rs exploit ee dot rs download the whitepapers get the 00:59:25.917-->00:59:35.083 code get odays get shells my names int80 I’m the rapper and dual core I love you guys have 00:59:35.083-->00:00:00.000 an awfum- awesome Def Con yeah well good luck man [applause].