Free root ssh access for everyone! 05-21-2016, 04:44 PM
#1
Not quite certain if anyone's discussed this elsewhere online, so consider this a first time thing. :p
![[Image: wktzhnc.png]](http://b.1339.cf/wktzhnc.png)
Was just poking around in my file manager, saw this strange device connected to my network called "tmnanose" - it's running a samba service - no clue what it is. So I decide to go poking around it. Turns out the entire root can be viewed from the samba share. Ok, cool. Still don't know what it is.
![[Image: esknsge.png]](http://b.1339.cf/esknsge.png)
Decide to look in /home, just a folder called "root" (why it's in here, and not /root, no clue) with a directory called "logs" in it. Okay, seems like some small network connected device in my house. Possibly an ARM architecture.
What the hell is this?
I begin to look through files in /etc in hopes for some plaintext files revealing what the system is.
/etc/samba/smb.conf shows "server string = OpenViX %h network services"
![[Image: dtxcntl.png]](http://b.1339.cf/dtxcntl.png)
OpenViX... okay, we're getting somewhere.
I run a google search for OpenViX, and it's the system running my TV box in the living room.
Okay... now I know what it is... can I ssh to it?
I try to ssh to a random account... I got accepted!
Any valid user accounts? I look in passwd for accounts... nothing really accessible except from root user. I look in shadow... and there's no password. Literally... no password.
![[Image: byssphy.png]](http://b.1339.cf/byssphy.png)
(d0ngs is an account I made myself after getting into the box)
I login via ssh to a root shell and voila. Free root. It's only a mips box, so it's not capable of much, and has busybox installed.
![[Image: vocmmkx.png]](http://b.1339.cf/vocmmkx.png)
If you find any of these boxes running OpenViX on the internet or locally, you can log in as root.
/etc/init.d has some fun scripts in it. They all get executed on boot too.
Just thought this was rather funny.
Didn't really try anything else, but the box also has a HTTP webpanel.
Spoiler:
Was just poking around in my file manager, saw this strange device connected to my network called "tmnanose" - it's running a samba service - no clue what it is. So I decide to go poking around it. Turns out the entire root can be viewed from the samba share. Ok, cool. Still don't know what it is.
Spoiler:
Decide to look in /home, just a folder called "root" (why it's in here, and not /root, no clue) with a directory called "logs" in it. Okay, seems like some small network connected device in my house. Possibly an ARM architecture.
What the hell is this?
I begin to look through files in /etc in hopes for some plaintext files revealing what the system is.
/etc/samba/smb.conf shows "server string = OpenViX %h network services"
Spoiler:
OpenViX... okay, we're getting somewhere.
I run a google search for OpenViX, and it's the system running my TV box in the living room.
Okay... now I know what it is... can I ssh to it?
I try to ssh to a random account... I got accepted!
Any valid user accounts? I look in passwd for accounts... nothing really accessible except from root user. I look in shadow... and there's no password. Literally... no password.
Spoiler:
(d0ngs is an account I made myself after getting into the box)
I login via ssh to a root shell and voila. Free root. It's only a mips box, so it's not capable of much, and has busybox installed.
Spoiler:
If you find any of these boxes running OpenViX on the internet or locally, you can log in as root.
/etc/init.d has some fun scripts in it. They all get executed on boot too.
Just thought this was rather funny.
Didn't really try anything else, but the box also has a HTTP webpanel.
nameless@Jabber.se
for hire, programming/sysadmin
for hire, programming/sysadmin
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
