Hacking process of LaMetric time

[tyalie]

Hey there. Was there any further progress in hacking the LaMetric Time? I found the root password especially interesting, so that one can access the SSH port.

I could only find this post on reddit, where somebody successfully accessed the SSH by open it up and changing it manually:
https://www.reddit.com/r/LaMetric/comments/3sq55r/hacking_progress/

Have you heard of further progress in this regard?

Thanks a lot

• George

[chorankates]

@Gansgar sorry for the slow reply, didn't see the notification.. i continued running the GCP instance for almost 2 weeks and didn't crack it - i will update the README.md with that information.

i was unaware of that post (or subreddit), but after failing to crack the hash attempted something similar - though i was never able to mount the card..

can't recall the reason now, but i'll take another look this weekend as the device itself is still sitting on my desk - and it's smug aura mocks me.

[tyalie]

Hey there,

thanks for the reply. Any updates?

George

[magcode]

Getting root access to the device is actually not so difficult. I reset the root password and removed a firewall rule which seemed to block port 22. Now I have full access to the device.

The challenge is to make it possible without opening the device (and loosing warranty by doing so).

[BeHive]

Hello

After gaining access to the device, are you able to change the WiFi settings to make it connect to a wpa enterprise network?

Also, could you provide some info on that firewall rule you removed?

Cheers

[magcode]

wpa enterprise

No idea. I don't have such a network

some info on that firewall rule

I removed /etc/init.d/S50block_ssh
The device runs a knockd.
In theory you should be able to enable the SSH port using knock <lam ip> 7623 6732 8675 6623 1732 8675.
However that did not work for me.

[MasterScrat]

Any news on this? Anyone was able to break the password?

[k4a]

HI to all!

Successfully rebuild firmware with changed password & removed ssh firewall (without opening device).
I think it's possible to get ssh access without any firmware modification, by knoking & use ssh_rsa_key after it to access device. Will try it.

[magcode]

Well. You can build a custom firmware. Yes. But you don't have their private key to sign it. Without that signature the device won't install the firmware. Correct me if I'm wrong.

[k4a]

I have their private key ))
So device install fixed firmware without any warnings.

[magcode]

OMG.
!!!HERO!!!

[tyalie]

That's amazing 😎

[k4a]

https://mega.nz/#!NMBBjCLQ!NwB_0xuGzsU857LX0pyRiTY8mwzuVkI7l7egCLPfq8E
root password lametric, ssh firewall deleted

[Zignixx]

@k4a can you maybe create a cfw for 2.0.24? Would be nice! :)

[k4a]

HI 2 all
version 2.0.24
https://mega.nz/#!0MwyAabB!3M0JRbIWBqj1X1jmqL5NlUdI9M7TOr8QDvVCs6XgOZo
root password same

[Zignixx]

HI 2 all
version 2.0.24
https://mega.nz/#!0MwyAabB!3M0JRbIWBqj1X1jmqL5NlUdI9M7TOr8QDvVCs6XgOZo
root password same

Thanks!
What i need to do if i already have 2.0.24 (original) installed on my Lametric? Can i just overwrite this firmware?