UART Root Shell on Linux Router - Hacking the Totolink WiFi Router

Поділитися
Вставка
  • Опубліковано 19 січ 2025

КОМЕНТАРІ • 67

  • @mattbrwn
    @mattbrwn  3 місяці тому +34

    Been a while since posting a video so thanks for viewing!
    Was busy last month competing in a HackerOne Live Hacking Event with Amazon and AWS! Excited to get back to YT. 😎

    • @leadscollector
      @leadscollector 3 місяці тому

      Do you have a video about the base setup of the machine you use for this in general.

    • @norwegiansmores811
      @norwegiansmores811 3 місяці тому

      you know whats kinda funny? you sort of look like a very young jim carry

    • @slybandit8117
      @slybandit8117 2 місяці тому

      Is there a way to get that command line access without that UART to USB cable? For example, could you use a Pi Pico, connected via USB to your PC and connect the UART cables to that instead?

  • @gametec_live
    @gametec_live 3 місяці тому +40

    How nice of them to label and even populate the UART interface lol

    • @svampebob007
      @svampebob007 3 місяці тому

      Never worked on any big project but I'm always blown away by how easy people make it for themselves in production.
      have I lost encrypted drives due to me forgetting the password yes, because I was supposed to remember it, have I made it harder for me to figure out a program after turning off all debugging information, yes, because only two three people were supposed to test it.
      have I heard the line "omg the password is too hard";
      =company(yearofthelordQ[1-4])
      my passwords at work are usually =nameofcompany(24Q4).... or: equal name of the company the year I made the password and the quater that we are in.
      why on earth would sara from CS ask the customer "pleas connect to the uart port and press F" now remount the partition and you should be all clear :)"
      Mark from engineering should only need to press F on his testbench have the bench type the password and press R for reset or F for "I'm a big fuckup" or Factoryreset
      I don't get why they would dump all that information in human readable characters in a production model... it's nice for rights to repair, but they could also just advertise it to the customer if that was the point: press the F button and you should be all good.

  • @RetroDelete
    @RetroDelete 3 місяці тому +18

    Awesome, just what I was looking forward to!
    Coincidentally I just opened my old ASUS RT-AC57U V3 router and the UART is even labeled!
    Strangely enough the router has a dropbear SSH server that you can turn on in advanced settings, but the entire rootfs seemed to be mounted as a tmpfs.
    I'll post some comments here after I get a little bit more time to investigate the router later today.

    • @309electronics5
      @309electronics5 3 місяці тому +3

      It can be that the rootfs is a squashfs read only image

  • @OhadLutzky
    @OhadLutzky 3 місяці тому +27

    Man, "google the password hash" is such a forehead-knock moment, absolutely beautiful!

    • @robf5737
      @robf5737 3 місяці тому

      The timing on it couldn't have been better for me too! Ended up downloading firmware and extracting the shadow file for a device I'm working with at the moment. Found the hash on a Chinese forum. Actually allows me to use the device for what I need rather than throwing raspis in the middle just because they decided to lock down the actual Linux part of the device they are marketing as running on "Linux"

  • @tarunvignesh2122
    @tarunvignesh2122 3 місяці тому +1

    Its amazing to see ur projects u have opened me up to an whole new domain

  • @mjmeans7983
    @mjmeans7983 3 місяці тому +25

    LOL. You didn't remove the label. You cut it. Warranty not voided!

    • @mattbrwn
      @mattbrwn  3 місяці тому +5

      Lol good point.

  • @ripplerxeon
    @ripplerxeon 3 місяці тому +1

    Finally , i was waiting for the upload.

  • @Mr._Mythical
    @Mr._Mythical 3 місяці тому +2

    Your videos are what got me into technically-cumputers-but-almost-not-really type things like routers. I have 1 router, but im not gonna mess with it until the new year as im waiting to see if the company wants it back as i just upgraded my internet

    • @Anatomize01
      @Anatomize01 3 місяці тому

      Don't mess with routers the ISP gives you, not technically yours.

    • @Mr._Mythical
      @Mr._Mythical 3 місяці тому

      @@Anatomize01 the company litteraly told me if i don't get a box within 3 months it's mine

  • @johnkutney4251
    @johnkutney4251 3 місяці тому +1

    Love your work and high quality videos on a nesh topic is amazing thank you 🎉

  • @hexdef6423
    @hexdef6423 3 місяці тому +6

    7:06 had to pause the video right before the partition table it claims it's a raspi

  • @lokoking1543
    @lokoking1543 3 місяці тому

    Good to see u back !

  • @manjsc
    @manjsc 3 місяці тому

    nice, really fun content to watch! keep up the good work!

  • @bin_chicken80
    @bin_chicken80 3 місяці тому

    Cool Matt. Thanks. Look forward to the next episode.

  • @petehinch3871
    @petehinch3871 3 місяці тому

    Another great video. Looking forward to the next one

  • @vgrutters
    @vgrutters 3 місяці тому +1

    Very useful video. Keep it up!

  • @arghyl
    @arghyl 3 місяці тому +2

    We know is a great day when there's a new drop by Matt Brown.

  • @Mordecrox
    @Mordecrox 3 місяці тому +3

    Finally some use for those suspicious thingies trying to pass as TP-Link

    • @user-lg4le8xr4s
      @user-lg4le8xr4s 3 місяці тому +3

      To be fair I'm suspicious of any TP-Link product to begin with.

  • @gl0sek
    @gl0sek 3 місяці тому +1

    0:44 what a rebel!

  • @jordantheman25
    @jordantheman25 3 місяці тому

    great video, subbed

  • @OsmanFarid-e9m
    @OsmanFarid-e9m 3 місяці тому +1

    Awesome Video.

  • @illililililillli
    @illililililillli 3 місяці тому +5

    The irony is I'm actively doing a uart install while watching this

  • @309electronics5
    @309electronics5 3 місяці тому

    Hah i am watching this while messing with a Tv settopbox via uart and compiling openwrt for my router i am also working on, but the router is laying on the side of my desk while my settopbox is near my keyboard. Its also partly due to your videos that i got inspired to go hardware hacking and uncovering the world of embedded Linux. Its also cause i just like messing arround with devices and stuff! And sometimes uncovering vulnerabilities and easter eggs/hidden elements

  • @MrSuperSnuiter
    @MrSuperSnuiter 3 місяці тому

    Hi Matt please make a video on ways of obtaining Tuya local keys. Eg (Tuya light bulb) by capturing network traffic with Wireshark etc.
    Awesome channel and excellent video Thanks

  • @vladimir0rus
    @vladimir0rus 3 місяці тому

    TIO is a great cross-platform serial console tool with modern features and auto rate selection.

  • @dmknght8946
    @dmknght8946 3 місяці тому +5

    Oh totolink is the most insecure router I must say. Its cgi-bin is a vendor's software written in C and has full of os command injection, stack-based buffer overflow. They made a mitigation function to detect OS command injection but it's very to bypass it (I discovered this one and got a CVE)
    p/s: I bricked my TOTOLInk testing a blind OS command injection (which writes a value into system) LoL. Reset button helped nothing lmao.

  • @brownpaperbagyea
    @brownpaperbagyea 3 місяці тому +1

    MATTS THE 🐐 NO 🧢

  • @dingokidneys
    @dingokidneys 3 місяці тому +3

    Almost too easy. But then, as you say, why do a load of hard work when someone else has already done it for you. Something to always remember before diving in headlong.

  • @slybandit8117
    @slybandit8117 2 місяці тому

    @mattbrwn is there a way to get that command line access without that UART to USB cable? For example, could you use a Pi Pico, connected via USB to your PC and connect the UART cables to that instead?

  • @scrypto
    @scrypto 3 місяці тому +2

    Крутяк, новое видео!

  • @ukaszs5021
    @ukaszs5021 2 місяці тому

    I am wondering, how discovered bugs by you are compared to routersploit capabilities? Are they could be found by routersploit package?

  • @mr.iot-tech278
    @mr.iot-tech278 3 місяці тому +2

    Nice video :)

  • @TommasoScardi-k3z
    @TommasoScardi-k3z 3 місяці тому

    If you want an advice, the Huawei b818-263 would be a tough challenge, even more if the firmware is branded and you try to unlock to use it with other cell network isp

  • @marcossouza5757
    @marcossouza5757 3 місяці тому

    I have a board that has four pins, CLK, DIO, GND AND POWER, which protocol should I use?

  • @Pi_Cue
    @Pi_Cue 3 місяці тому

    I enjoy your videos. Any chance you'd do a video on Qualcomm modem hacking inside mobile devices? Maybe not even physical, I'm just trying to understand how some things work and you're good at explaining things. The sim unlock flow is very interesting to me, i think i understand it but maybe I don't. I captured my network unlock https flow (oneplus device) which gave me some ideas of how it works but info on the depths of this topic is highly guarded it seems

  • @realhumanbeingyesyesveryreal
    @realhumanbeingyesyesveryreal 3 місяці тому

    Casual vacations to Southeast Asia ❤❤❤

  • @Gamlin
    @Gamlin 3 місяці тому +1

    What terminal software is he using, looks clean

    • @mattbrwn
      @mattbrwn  3 місяці тому +5

      i3wm + i3 gaps config + xfce4-terminal

    • @Gamlin
      @Gamlin 3 місяці тому

      @@mattbrwn Appreciate the info, thanks!

  • @RejectedManiac
    @RejectedManiac 3 місяці тому

    What if you have a shell that says is "root" with U-BOOT and it's running android. How do we find the equivalent of /etc/shadow?

  • @kermitinmountain6371
    @kermitinmountain6371 3 місяці тому

    I couldn't find picocom like you used on terminal, I have Parrot and Kali linux, so, how do I download the picocom? Thank you.

  • @SimonCas
    @SimonCas 2 місяці тому

    How would I determine the BAUD rate if I didn’t know?

    • @mattbrwn
      @mattbrwn  2 місяці тому

      Guess common rates! Or use a logic analyzer

  • @S.I.F.A.R
    @S.I.F.A.R 3 місяці тому

    last time I'm wandering around and founf this ZLTX28Pro find the uart use a very high baudrate hit enter seems like the circuit for rx on board seems disconnected didn't have any knowledge about circuit naybe someone can help me give an idea

  • @ngzro
    @ngzro 3 місяці тому +1

    cs2012 (Counter Strike Global Offensive apear in 2012) 😂

  • @StarsManny
    @StarsManny 3 місяці тому +1

    6:17 "Catution"......"Waitting"

  • @EilonwyWanderer
    @EilonwyWanderer 3 місяці тому

    Not just OpenWRT, but an ancient build -- not shocking, considering everything else, but still! Barrier Breaker on a contemporary device? Yikes.

  • @mihailbobeica694
    @mihailbobeica694 3 місяці тому +3

    for the algorithm

  • @7_of_9
    @7_of_9 3 місяці тому

    That router is very similar to the Netgear X10 router

  • @ikemkrueger
    @ikemkrueger 3 місяці тому

    I wonder if you can hack into a 4G WiFi Dongle. I know there is an Android on it.

  • @PPRstudio
    @PPRstudio 3 місяці тому +2

    According to NBTC and KingIT distributor Sticker , this must be from Thailand.

  • @aziztcf
    @aziztcf 3 місяці тому

    Hold the readline()!

  • @daddy-w6o5
    @daddy-w6o5 3 місяці тому +1

    Great video buddy!
    Can you make a detailed tutorial about Openwrt firmware? I know my request is out of context but it would be helpful for me since I like your explaining style

    • @lethal_larry
      @lethal_larry 3 місяці тому

      just google openWRT documentation then....read?