Zenofex at 04:29, 8 March 2015

2015-03-08T04:29:27Z

← Older revision		Revision as of 04:29, 8 March 2015
Line 47:		Line 47:
	User: root		User: root
	Password: oemroot		Password: oemroot

			==Root Demo==
			{{#ev:youtube\|gu8zcCV4u4k}}

Zenofex: 1 revision: Moving from DC22 to main site.

2014-08-17T08:22:47Z

1 revision: Moving from DC22 to main site.

← Older revision	Revision as of 08:22, 17 August 2014
(No difference)

CJ: /* Exploitation */

2014-08-07T01:50:33Z

Exploitation

New page

__FORCETOC__
{{Disclaimer}}
[[File:Staples_Connect_Hub.jpg|200px|left|thumb]]
[[Category:Home Automation]]
This page will be dedicated to a general overview, descriptions, and information related to the Staples Connect Hub.

== Purchase ==
[http://www.staples.com/Staples-Connect-Hub-powered-by-Linksys/product_280287 Purchase the Staples Connect Hub]

== UART Pinout ==

<gallery>
File:StaplesConnectUART.png
</gallery>

== Exploitation ==

Utilizing a safeguard built into U-Boot, which is the bootloader running on the Staples Connect, we can modify the systems boot parameters, and execute our own code, or drop it to a root shell.

This works as during system bootup, the bootloader looks for environmental variables, stored on NAND flash. If it can not find these, it will execute defaults instead. The defaults feature a bootloader shell, which isn't disabled in the normal, saved environmental variables.

To ensure that the bootloader can not see the environmental variables at boot, timing is critical. By grounding out pin 29-30 while the system is booting (just at the right time), the box will boot, but fail to load the environmental variables, dropping us to a root shell. From here we can modify and resave the environmental variables, so that this process needs not be repeated.

*Boot system
*Count to 4
*Short pins 29-30 to ground
*Success: "Hit any key to stop autoboot"
*Fail: Hang / Crash / NAND not found.

It may take a few attempts to get this right, as timing is critical.

Run the commands below, boots to a root console.
<pre>
setenv bootargs "console=ttyS0,115200 init=/bin/sh mem=256M mtdparts=orion_nand:1M(uboot),32M(em-rfs),4M(em-kern),5M(pd-kern),-(pd-rfs) ubi.mtd=4,512 root=ubi0:rootfs rootfstype=ubifs rootflags=sync"
mw.b f1010140 0xFA; if nboot 0x600000 0 0x2500000; then mw.b f1010140 0xF5; bootm 0x600000; fi
</pre>

== SSH ==
Using the above to boot to a root console, edit /etc/rc.local, and add:
<pre>
dropbear -d 222
</pre>

Simply reboot, you can SSH on port 222 using the credentials below:

User: root
Password: oemroot

Staples Connect Hub​​ - Revision history

Zenofex at 04:29, 8 March 2015

Zenofex: 1 revision: Moving from DC22 to main site.

CJ: /* Exploitation */

Staples Connect Hub - Revision history