Notices by morb (morb@mastodon.social)

@ryanc wow what a horror show

usb-c powered compact florescent bulb

@ryanc here's hoping you don't find any other fouled AC wiring mysteries

can check

can check

can check

can check

@ryanc how many people did it take

@ryanc you're it

@ryanc (no tagbacks)

@ryanc cactus

@ryanc 🌵🌵🌵

@ryanc cactus

@ryanc for doing such or for the odor that's emitted

@xabean @tychotithonus have you tried shell injection in any of the provisioning file fields yet

@xabean @tychotithonus running jtr against it and rockyou2024 right now for yucks

@xabean @tychotithonus fwiw the Intelbras TIP 200 series shares the same shadow entries; dead end finding any working creds attributed though

https://github.com/Ls4ss/CVE-2020-13886/blob/master/README.md

@xabean @tychotithonus

extracted latest fw for TIP200 (60.61.75.22) and...

[Yealink Busybox Ver 1.0.0.1]
BusyBox v1.10.3 (2013-08-06 13:53:41 CST) multi-call binary
Copyright (C) 1998-2007 Erik Andersen, Rob Landley, Denys Vlasenko

>_<

@xabean don't have one on hand; just the latest firmware I could find for a rebranded Yealink that had the same shadow file -- will dig for that tho

PasswdCopy.sh looks like it uses an unsafe subshell fwiw

@ryanc