mirror of
https://github.com/EFForg/rayhunter.git
synced 2026-04-26 07:29:59 -07:00
9d736f5bf0
There is a shell injection vulnerability after all, so we can just
launch a remote shell, tplink-style. Except there's no telnetd on this
device so we need to use netcat.
This was found in the goahead binary on the device using Ghidra. The
decompiled code for this endpoint looks like this:
```c
void FUN_0003c614(int param_1)
{
int iVar1;
undefined4 uVar2;
int local_160;
undefined1 auStack_15c [64];
char acStack_11c [256];
int local_1c;
local_1c = __stack_chk_guard;
if (param_1 == 0) {
error("input parameter is NULL!");
uVar2 = 0x66;
goto LAB_0003c808;
}
iVar1 = websGetJsonItemValue(param_1,"password",10,auStack_15c,0x40);
if (iVar1 != 0) {
iVar1 = get_log_level_something();
if (1 < iVar1) {
some_logging_func(2,"modifying root password(%s)...",auStack_15c);
}
iVar1 = sprintf(acStack_11c,"echo root:\"%s\"|chpasswd",auStack_15c);
acStack_11c[iVar1] = '\0';
system(acStack_11c);
}
```
Usage is `./installer orbic-network`, as an alternative to `./installer
orbic`. It should work on Windows without any kind of drivers.
This installer also works on the Moxee device.
34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
# Supported devices
|
|
|
|
Be sure to check your location's [supported frequencies](https://www.frequencycheck.com/) against a device page before obtaining a device.
|
|
|
|
## 1. Recommended devices
|
|
These devices have been extensively tested by the core developers and are widely used. **Use one of these devices if you can.**
|
|
|
|
| Device | Recommended region |
|
|
| ------ | ------ |
|
|
| [Orbic RC400L](./orbic.md) | Americas |
|
|
| [TP-Link M7350](./tplink-m7350.md) | Africa, Europe, Middle East |
|
|
|
|
The TP-Link M7350 also works in the Americas but is usually more expensive.
|
|
|
|
|
|
_Derivative work of [this file](https://commons.wikimedia.org/wiki/File:International_Telecommunication_Union_regions_with_dividing_lines.svg) by [Maximillian Dörrbecker](https://de.wikipedia.org/wiki/User:Chumwa) licensed [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5)_
|
|
|
|
## 2. Functional devices
|
|
Rayhunter is confirmed to work on these devices.
|
|
|
|
| Device | Recommended region |
|
|
| ------ | ------ |
|
|
| [Wingtech CT2MHS01](./wingtech-ct2mhs01.md) | Americas |
|
|
| [Tmobile TMOHS1](./tmobile-tmohs1.md) | Americas |
|
|
| [TP-Link M7310](./tplink-m7310.md) | Africa, Europe, Middle East |
|
|
| [PinePhone and PinePhone Pro](./pinephone.md) | Global |
|
|
| [FY UZ801](./uz801.md) | Asia, Europe |
|
|
| [Moxee hotspot](./moxee.md) | Americas |
|
|
|
|
## Adding new devices
|
|
Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but the community has been working hard at adding support for other devices. Theoretically, if a device runs a Qualcomm modem and exposes a `/dev/diag` interface, Rayhunter may work on it.
|
|
|
|
If you have a device in mind which you'd like Rayhunter to support, please [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)!
|