iLiad Huge exploit found in 2.7 - Page 3

design256 · 10-20-2006, 09:16 AM

Quote:

Originally Posted by arivero

It is somehow risky in the sense that if you change the connection and it really gets to contact iDS, it could update the system if you are not fast enough to remove the internet cable nor swicht your wifi router off.

Wow, I can see Iliad owners running down the street to escape their iliad connecting to ids through WiFi

k2r · 10-20-2006, 10:16 AM

I'm not quite sure why we would have to change the root-password to log in to the device.
If I remember correctly dropbear client supports public key authentication, you just have to convert the id into a dropbear specific format.

Antartica · 10-20-2006, 10:26 AM

Quote:

Originally Posted by design256

Do it quickly! I bet that this and Xserver will be patched on IDS today.

Updated! :-)

design256 · 10-20-2006, 12:35 PM

Quote:

Originally Posted by k2r

I'm not quite sure why we would have to change the root-password to log in to the device.
If I remember correctly dropbear client supports public key authentication, you just have to convert the id into a dropbear specific format.

WOOHOO!! I'm in!!!

tsh compiled statically out of the box with the Zaurus cross compiler and runs without any problems at all. I've attached the arm tshd and linux tsh binary.

Usual bricking caveats apply..

CommanderROR · 10-20-2006, 12:45 PM

Congrats!

arivero · 10-20-2006, 12:49 PM

Quote:

Originally Posted by design256

WOOHOO!! I'm in!!!

tsh compiled statically out of the box with the Zaurus cross compiler and runs without any problems at all. I've attached the arm tshd and linux tsh binary.

Usual bricking caveats apply..

Design, could you also attach the shell script and/or the command you use to launch it? Or are you still opening the network using your "http proxy failure" trick?

design256 · 10-20-2006, 01:04 PM

Quote:

Originally Posted by arivero

Design, could you also attach the shell script and/or the command you use to launch it? Or are you still opening the network using your "http proxy failure" trick?

I'm using the http proxy trick for now - I haven't worked out how to turn the network on from a script yet, but should do soon. I just make it sleep for 2 minutes then run tshd.

BTW, the linux-side tsh I uploaded doesn't work statically compiled because of missing gethostbyname. Here is a dynamically compiled one on FC3, and the source. It is easy to compile. You need to set the password in tsh.h to 'abc'.

arivero · 10-20-2006, 01:09 PM

Quote:

Originally Posted by design256

I'm using the http proxy trick for now - I haven't worked out how to turn the network on from a script yet

Ah, you simply call wired.sh or wireless.sh with the right parameters; sort of "/usr/bin/wired.sh start" or similar call, we used it back in the 2.4 version three months ago.

Check them in /usr/bin. There is even an "usage" help. But in any case, how does the "proxy trick" works? Do I need actually to take the work of setting a proxy?

Quote:

BTW, the linux-side tsh (...)

guess most people will use a apt-get anyway.

design256 · 10-20-2006, 01:12 PM

Quote:

Originally Posted by arivero

Ah, you simply call wired.sh or wireless.sh with the right parameters; sort of "/usr/bin/wired.sh start" or similar call, we used it back in the 2.4 version three months ago.

Check them in /usr/bin. There is even an "usage" help. But in any case, how does the "proxy trick" works? Do I need actually to take the work of setting a proxy?

guess most people will use a apt-get anyway.

Try just pointing it at a nonexistent proxy. If the network light stays on and you get a popup error box on connect then you're there.

design256 · 10-20-2006, 03:14 PM

Quote:

Originally Posted by design256

Try just pointing it at a nonexistent proxy. If the network light stays on and you get a popup error box on connect then you're there.

ok wired.sh works a treat, so no need for the proxy hack any more.
Change /mnt/card if you're not using a mmc card...

/mnt/card/a.sh contains:

#!/bin/sh
sleep 120
/usr/bin/wired.sh start
sleep 5
/tmp/tshd

---------------

/mnt/card/b.sh contains:

#!/bin/sh

/bin/cp /mnt/card/tshd /tmp
/bin/cp /mnt/card/a.sh /tmp
/bin/chmod 755 /tmp/tshd
/bin/chmod 755 /tmp/a.sh
/tmp/a.sh &

-------

Then run /mnt/card/b.sh from network profiles, quit, then wait
a couple of minutes. When the light comes on:

tsh ILIAD_IP /bin/sh from your linux box.

...and you'll be in.

I'm working on a packaged version to replace download manager. Will post in CommanerROR's sticky topic when done.

Once again, big thanks for finding this excellent hole. Would love to be a fly on the wall at Irex when they were so keen to keep developers out...

Antartica · 10-20-2006, 03:21 PM

Quote:

Originally Posted by Antartica

Updated! :-)

It seems that they plugged the hole. I've not been able to reproduce the backqoute-hack :-(((

They've been fast.

UPDATE: It was my fault

, they have not patched it, it still works

. sorry if I scared someone.

design256 · 10-20-2006, 03:33 PM

Quote:

Originally Posted by Antartica

It seems that they plugged the hole. I've not been able to reproduce the backqoute-hack :-(((

They've been fast.

eeek. that was quick

guess we'll have to keep working on an IDS-based exploit. I wonder if they also closed off the Xserver?

tribble · 10-20-2006, 03:44 PM

I dont think that there are different versions of 2.7 out there.

scotty1024 · 10-20-2006, 04:13 PM

Quote:

Originally Posted by tribble

I dont think that there are different versions of 2.7 out there.

Maybe he's a beta tester.

Take Caeser's Beta, Take Caeser's Security Patches.

TadW · 10-20-2006, 04:46 PM

As far as I can tell 2.7 is unchanged since its initial release.

10-20-2006, 10:16 AM	#32
k2r Zealot Posts: 124 Karma: 177 Join Date: Jul 2006 Location: Bochum, Germany Device: MP2K, iLiad	Public Key Authentication I'm not quite sure why we would have to change the root-password to log in to the device. If I remember correctly dropbear client supports public key authentication, you just have to convert the id into a dropbear specific format.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
A Huge Thank You	BurBunny	Amazon Kindle	4	02-27-2009 01:36 PM
Adobe Reader 9 new exploit in the wild	doctorow	News	2	02-20-2009 03:38 PM
Cybook not found in linux, found in win XP	fjf	Bookeen	15	01-18-2008 06:57 PM
Adobe Acrobat subject to remote exploit	Alexander Turcic	News	3	09-16-2006 05:29 AM
Serious exploit in Greasemonkey 0.4	Alexander Turcic	Lounge	2	07-19-2005 04:59 AM

10-20-2006, 12:45 PM	#35
CommanderROR eink fanatic Posts: 2,022 Karma: 4924 Join Date: Mar 2006 Location: Germany Device: STAReBOOK, iRex Iliad, Sony 505, Kindle 2	Congrats!

10-20-2006, 03:44 PM	#43
tribble iLiad Maniac Posts: 1,382 Karma: 2369 Join Date: Apr 2006 Location: Germany Device: Bookeen Opus (i love that thing) and iPad (what an irony)	I dont think that there are different versions of 2.7 out there.

10-20-2006, 04:46 PM	#45
TadW Uebermensch Posts: 2,583 Karma: 1094606 Join Date: Jul 2003 Location: Italy Device: Kindle	As far as I can tell 2.7 is unchanged since its initial release.

Advert

Advert