PogoPlug Mobile - Revision history

Resno: Text replacement - "gtvcom-20" to "exploiteers-20"

2016-02-07T01:22:40Z

Text replacement - "gtvcom-20" to "exploiteers-20"

← Older revision		Revision as of 01:22, 7 February 2016
Line 7:		Line 7:
	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[http://www.amazon.com/gp/product/B00DOAF8D2/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00DOAF8D2&linkCode=as2&tag=~~gtvcom~~-20&linkId=SFROHTJMB7OSDV6H Purchase the PogoPlug Mobile at Amazon]		[http://www.amazon.com/gp/product/B00DOAF8D2/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00DOAF8D2&linkCode=as2&tag=exploiteers-20&linkId=SFROHTJMB7OSDV6H Purchase the PogoPlug Mobile at Amazon]

	== Disassembly ==		== Disassembly ==

Zenofex at 10:36, 17 August 2014

2014-08-17T10:36:56Z

← Older revision		Revision as of 10:36, 17 August 2014
Line 57:		Line 57:

	'''Password:''' ceadmin		'''Password:''' ceadmin

			== Demo ==
			{{#ev:youtube\|tgczbhGKD3A}}

Zenofex: 1 revision: Moving from DC22 to main site.

2014-08-17T08:22:57Z

1 revision: Moving from DC22 to main site.

← Older revision		Revision as of 08:22, 17 August 2014
(No difference)

Zenofex: /* Default Root Credentials */

2014-08-05T21:05:49Z

Default Root Credentials

New page

__FORCETOC__
{{Disclaimer}}
[[File:Pogoplug-mobile.jpg|200px|left|thumb]]
[[Category:Network Attached Storage]]
This page will be dedicated to a general overview, descriptions, and information related to the PogoPlug Mobile.

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[http://www.amazon.com/gp/product/B00DOAF8D2/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B00DOAF8D2&linkCode=as2&tag=gtvcom-20&linkId=SFROHTJMB7OSDV6H Purchase the PogoPlug Mobile at Amazon]

== Disassembly ==
<gallery>
File: PogoPlug_Mobile_000.jpg
File: PogoPlug_Mobile_001.jpg
File: PogoPlug_Mobile_002.jpg
File: PogoPlug_Mobile_003.jpg
File: PogoPlug_Mobile_004.jpg
File: PogoPlug_Mobile_005.jpg
File: PogoPlug_Mobile_006.jpg
</gallery>

== UART ==
The pin-out for UART can be found on the image below.
<gallery>
File:PogoPlug_Mobile_UART.jpg
</gallery>

== GPL ==
You can find GPL code for the [http://pogoplug.com/opensource#V4 PogoPlug Mobile Here]

== Gaining Root ==
The PogoPlug has an open bootloader and its kernel drops to a root shell making this a very open device. On top of that a user is also able to enable a SSHD server if they visit [http://my.pogoplug.com My.PogoPlug.com] and enable it. Enabling SSHD not only sets dropbear to start on boot but also forces the user to change the root password. This however is only offered if a user opts to setup SSHD.

This leaves a lot of users with a default root password, but seemingly without any services running that could use it.

Lucky for us a diagnostic page runs on every pogoplug and can be accessed at:

<pre>https://IP-OF-POGOPLUG-MOBILE/sqdiag/</pre>

This diagnostic pages uses the root credentials as its login/password.

After accessing this diagnostic page you will need to access the hidden command execution portion. This can be access by visiting the following URL:

<pre>https://root:ceadmin@IP-OF-POGOPLUG-MOBILE/sqdiag/HBPlug?action=command</pre>

After visiting the above URL you should now have an input field that you can enter in any command which will execute with root privileges.

'''Accessing from CURL'''
The below command will test a PogoPlug for the default login and command execution script. For a quick test substitute COMMANDHERE with reboot.

POC: <pre>curl -k "https://root:ceadmin@IP-OF-POGOPLUG-MOBILE/sqdiag/HBPlug?action=command&command=COMMANDHERE"</pre>

== Default Root Credentials ==
Below are the default root credentials for the PogoPlug, these are only changed if a user enables SSHD through the PogoPlug cloud interface.

'''Username:''' root

'''Password:''' ceadmin