9d736f5bf0
There is a shell injection vulnerability after all, so we can just
launch a remote shell, tplink-style. Except there's no telnetd on this
device so we need to use netcat.
This was found in the goahead binary on the device using Ghidra. The
decompiled code for this endpoint looks like this:
```c
void FUN_0003c614(int param_1)
{
int iVar1;
undefined4 uVar2;
int local_160;
undefined1 auStack_15c [64];
char acStack_11c [256];
int local_1c;
local_1c = __stack_chk_guard;
if (param_1 == 0) {
error("input parameter is NULL!");
uVar2 = 0x66;
goto LAB_0003c808;
}
iVar1 = websGetJsonItemValue(param_1,"password",10,auStack_15c,0x40);
if (iVar1 != 0) {
iVar1 = get_log_level_something();
if (1 < iVar1) {
some_logging_func(2,"modifying root password(%s)...",auStack_15c);
}
iVar1 = sprintf(acStack_11c,"echo root:\"%s\"|chpasswd",auStack_15c);
acStack_11c[iVar1] = '\0';
system(acStack_11c);
}
```
Usage is `./installer orbic-network`, as an alternative to `./installer
orbic`. It should work on Windows without any kind of drivers.
This installer also works on the Moxee device.
1.7 KiB
Supported devices
Be sure to check your location's supported frequencies against a device page before obtaining a device.
1. Recommended devices
These devices have been extensively tested by the core developers and are widely used. Use one of these devices if you can.
| Device | Recommended region |
|---|---|
| Orbic RC400L | Americas |
| TP-Link M7350 | Africa, Europe, Middle East |
The TP-Link M7350 also works in the Americas but is usually more expensive.
Derivative work of this file by Maximillian Dörrbecker licensed CC BY-SA 2.5
2. Functional devices
Rayhunter is confirmed to work on these devices.
| Device | Recommended region |
|---|---|
| Wingtech CT2MHS01 | Americas |
| Tmobile TMOHS1 | Americas |
| TP-Link M7310 | Africa, Europe, Middle East |
| PinePhone and PinePhone Pro | Global |
| FY UZ801 | Asia, Europe |
| Moxee hotspot | Americas |
Adding new devices
Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but the community has been working hard at adding support for other devices. Theoretically, if a device runs a Qualcomm modem and exposes a /dev/diag interface, Rayhunter may work on it.
If you have a device in mind which you'd like Rayhunter to support, please open a discussion on our Github!