search

lixmk / Concierge

Concierge Toolkit: Physical Access Control Identification and Exploitation
MIT License
115 stars 27 forks source link

Tweaks for older V1000 boards #2

Closed aaronsilber closed 7 years ago

aaronsilber commented 7 years ago

Experimentation with an older V1000 has shown mixed results. The board I was using had the version string "V1000" instead of "V2-V1000" so presumably it is an older version. It is super slow so the default 1 second timeout for command injection was not working, and this PR raises it to 5 seconds.

Additionally I refactored references to rspn for board type detection just to clean things up. Since there were a few instances where "V1000" boards may/may not work with the same payloads as "V2-V1000" I added it to some of the conditionals.

It appears that command injection is closer to working on boards like this, with these modifications. I don't have enough hardware hooked up to test exfil, lock, unlock, or implant (no readers currently) however the board does send a GET request to rhost as intended, so that's progress.

Tested hardware:

[+] Device Type: V1000
[+] Hostname: V1000_Floyd
[+] Internal IP: 10.98.75.77
[+] MAC Address: 00:06:8E:00:XX:XX
[+] Firmware Version: 2.2.7.49
[+] Build Date: 08/16/2010
lixmk commented 7 years ago

Awesome! Thanks for adding this version, and the boardtype global.