Free root ssh access for everyone!

Free root ssh access for everyone! - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Free root ssh access for everyone! (/Thread-Free-root-ssh-access-for-everyone)

Free root ssh access for everyone! - -nameless - 05-21-2016

Not quite certain if anyone's discussed this elsewhere online, so consider this a first time thing. :p

Spoiler:

Was just poking around in my file manager, saw this strange device connected to my network called "tmnanose" - it's running a samba service - no clue what it is. So I decide to go poking around it. Turns out the entire root can be viewed from the samba share. Ok, cool. Still don't know what it is.

Spoiler:

Decide to look in /home, just a folder called "root" (why it's in here, and not /root, no clue) with a directory called "logs" in it. Okay, seems like some small network connected device in my house. Possibly an ARM architecture.
What the hell is this?
I begin to look through files in /etc in hopes for some plaintext files revealing what the system is.
/etc/samba/smb.conf shows "server string = OpenViX %h network services"

Spoiler:

OpenViX... okay, we're getting somewhere.
I run a google search for OpenViX, and it's the system running my TV box in the living room.

Okay... now I know what it is... can I ssh to it?
I try to ssh to a random account... I got accepted!
Any valid user accounts? I look in passwd for accounts... nothing really accessible except from root user. I look in shadow... and there's no password. Literally... no password.

Spoiler:

(d0ngs is an account I made myself after getting into the box)

I login via ssh to a root shell and voila. Free root. It's only a mips box, so it's not capable of much, and has busybox installed.

Spoiler:

If you find any of these boxes running OpenViX on the internet or locally, you can log in as root.
/etc/init.d has some fun scripts in it. They all get executed on boot too. Smile

Just thought this was rather funny.

Didn't really try anything else, but the box also has a HTTP webpanel.

RE: Free root ssh access for everyone! - Sophisticated - 05-21-2016

only thing i care about; what os are you on that ui looks fit as fuck

RE: Free root ssh access for everyone! - -nameless - 05-21-2016

(05-21-2016, 04:49 PM)Sophisticated Wrote: only thing i care about; what os are you on that ui looks fit as fuck

It's just GNOME 3 with the Paper GTK+ theme.
I'm on Arch, however.

RE: Free root ssh access for everyone! - meow - 05-21-2016

https://www.shodan.io/search?query=OpenViX

Busybox botnet?

RE: Free root ssh access for everyone! - -nameless - 05-21-2016

(05-21-2016, 05:18 PM)meow Wrote: https://www.shodan.io/search?query=OpenViX

Busybox botnet?

Hey, you're not supposed to tell people... Stressed