What's new
By:

How I häçked LPB pisowifi (orangepi/raspberry pi root access)

N

NzD4rkS3c

Year ago may nakita ako na post sa FB about sa LPB pisowifi na nahäçk with full system access (You do not have permission to view the full content of this post. Log in or register now.) kaya nagtanong din ako dito nun kung may nakapag RCE naba, I think sa upload feature lang ung vulnerability since webshell ung ginamit.. dun ako nagkaidea na possible pala mahäçk ung LPB.. pero di ko parin titry kasi wala namang LPB dito samin noon, wala din akong matinong rason para manghäçk ng pisowifi kasi wala naman akong mapapala dun tyaka wala din access sa files.. until this year na need ko na ng server running 24/7 for serving school web projects unang naisip ko talaga is maghäçk ng pisowifi kasi 24/7 nakarun instead na gumastos ng malaki.. tas nakita ko rin itong thread post nato: LPB pisowifi leak source code so dito ako nagkaidea pano ipenetrate ung LPB (for school purposes LOL XD) so ang ginawa ko nireverse engineer ung .img flash file ng LPB para makuha yung source code (open to public yang img nasa site lang nila).. at first i thought na encrypted talaga sya pero.. obfuscated lang pala so I've spent almost 5 weeks kaka decode at rewrite ng functionalities sa source code nila para lang maintindihan ung buong flow system.. in that 5 weeks ang masasabi ko lang halos 99.99% sobrang safe na nung LPB sa mga häçkers pagdating sa system access (di yung dashboard/web admin btw).. kaso nahanap ko ung 0.1% na flaw.. may isang files dun sa source code na diko nahanap kung pano ginagamit and so triny ko itest locally pano sya nagwowork, di nako magbabagsak ng maraming details pero it allows me to access the admin dashboard (under 5 seconds kung bibilangin mo) no matter how strong the password.. and so nagpatuloy ako maghanap ng vulnerabilities / flaws since ang end goal ko naman magka full access sa system para magkaroon ng 24/7 online web server.. pero this time sa admin dashboard source code na.. ito talaga ung time na titigil na sana ako kasi kahit saan ako magdecode, review, check.. wala talagang madadaanan kahit isa.. kaya ang ginawa ko.. instead na magfocus sa source code... nagfocus ako sa system configuration and dito ko nahanap ung sobrang liit na human error.. literally na sobrang liit ito ung naging way para mapenetrate ko ung LPB.. biroin mo tatlong character lang ung mali.. as in 3 letters kaya vinerify ko sya (left size image| first image) and so ginawan ko ng exploit (i named it trayosploit haha) para ma access ung system via SSH. FROM MAY 2025 I SUCCESSFULY GAIN ACCESS TO LPB soft (OUR PISOWIFI)

To all LPB owners: Wala kayong dapat ikabahala since wala pa naman akong ibang nahanap na gumagawa netong gingagawa ko dito or sa fb or online.. if ever may nahanap man ako na nagpost / nagkaroon ng issue sa LPB like nagcrash ung portal nagiba etc dahil nahanap din nila ung 3 letter bug.. ako mismo susuggest ng patches sa source code nila i have patches ready to publish pero di muna ngayon since need ko pa sya for school purposes. (gusto ko rin makatipid kami sa licences hehe, sorry lpb devs)

so ano ba benifits ng may full access sa vendo as builder or owner? well pwede mo syang gawing file server specially if may printing services kayo, sa pisowifi nalang iuupload ung files easy transfer na sa PC, webserver if gusto mo maghost ng webserver na accessable online 24/7, full system modification.. pwede mo icustomize lahat pati html files.. lagyan ng video background etc.. since you can modify anything... pwede mo din idisable na di na sya need ng licences gawing permanent ung vendo.. yan din ung dahilan kaya walang open source na pisowifi.. kasali narin ung excluding devices ng hindi nakikita sa admin dashboard (parang free wifi lang sa specific device)

This month I found an universal way to fully access any pisowifi for pisowifi builders (exept mikrotik based) pero not willing to publish baka habulin nako ng mga pisowifi developers LOL


payload.webp
LPBRCE.webp
 
Ayan na guys.. sa mga nagtatanong kung possible ba ihäçk ung LPB, yes.

Willing ako ipublish ung nakikita admin dashboard password in 5 seconds as recovery tool.. pero baka bababuyin nyo lang eh. malulugi lang kaming mga vendo.


No worried never ako magpupublish ng exploits source code. hanapin nyo ung bug kung gusto nyo.
 
Yeah, im my case:

Inside the "forgot password" page sa admin, the logic behind it is already vulnerable to fail open. May isang backend file dun na may butas, pero syempre sikreto ko na dito yan (although nakapublish na findings ko sa internet).
This can be executed kung: down ang lpb server or ung internet ng owner from ISP at saka sa pamamagitan ng ARP spoofing kung direct connected sa router. Basta ung way na hindi makakapag-communicate sa server ng You do not have permission to view the full content of this post. Log in or register now..

Kapag na-met ang condition na ito, sa pamamagitan ng exploit script ay mahaharvest na ung password ng admin.
explfor.webp
 
And then isang linggong lumipas nahanap ko na ung backend flaws sa dashboard at possible 3 letter bug na sinasabi dito, at saka ung buggest mistake sa version 15.5 (ung tinutukoy ko ung may terminal) na .img(less likely others owned it) in which we can obtain the admin password without bruteforce or exploits. Pag nakita ninyo ung may dinagdag sa loob ng LPB directory, jackpot yun, kung ikaw may ari ng may version na yan, malas ka. Goodluck!
 
coltonsilva74 said:
Yeah, im my case:

Inside the "forgot password" page sa admin, the logic behind it is already vulnerable to fail open. May isang backend file dun na may butas, pero syempre sikreto ko na dito yan (although nakapublish na findings ko sa internet).
This can be executed kung: down ang lpb server or ung internet ng owner from ISP at saka sa pamamagitan ng ARP spoofing kung direct connected sa router. Basta ung way na hindi makakapag-communicate sa server ng You do not have permission to view the full content of this post. Log in or register now..

Kapag na-met ang condition na ito, sa pamamagitan ng exploit script ay mahaharvest na ung password ng admin.View attachment 3990664
Click to expand...

keep it up! 3 letters/characters is ung way of execution existed yan sa all version kasi yan ung isa sa main component ng lpb, possible sya maachive without modification sa .imgs, even walang terminal / x11 ung vendo pwede mu sya maenable if you have RCE gawa ka lang ng payload..

here example payload flow:
ssh disabled? -> enable + key based login -> root has password? -> generate private key -> store public key on server -> login without password
 
Well initially nagtry ako sa RCE entrypoint ng LPB without touching dashboard pero di umubra sa akin, kaya nag rely ako sa pagharvest ng admin password by two different methods saka lang ako makaka-upload ng modified admin page na may 3xpl01t command na naire-encrypt para i-change password ung root pang ssh.

Pero unlike si LPB, si PisoFi ung pinakamadaling gawan ng RCE since nakikita naman ung tokens sa browser kaya marami akong 3xpl01t script like portal defacer, voucher generator pang 1 year, pang add time at disconnect, pang alis ng Block MAC logic para di makablock ung owner, saka pang alis ng license verification checks. Very existed ung vuln sa standard image na newer version below kaya walang silbi ung admin password jan.
1000002495.webp
 

Similar threads

About this Thread

  • 16
    Replies
  • 2K
    Views
  • 11
    Participants
Last reply from:
PHC_Oraayt

New Topics

Trending Topics

Online now

Members online
1,151
Guests online
1,034
Total visitors
2,185

Forum statistics

Threads
2,277,961
Posts
28,980,072
Members
1,228,185
Latest member
mastersawabad
Back
Top