An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

Overview

TMOHS1 Root Utility

License: GPL v3

Description

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

Features

  • Root shell via telnet
  • Temporarily or pesistently enable ADB
  • Disable OMA-DM update bootstrap
  • On-device root FTP server to browse the filesystem
  • Mood lighting

What it doesn't (yet?) feature

  • SIM unlock :(
  • SSH server installation
  • Other USB modes (though if you edit utils.py you can easily implement this)

Setup

Ensure you have Python >= 3.6 and pip installed then run:

pip -r requirements.txt

Or install the required libraries manually.

Usage

Connect to your hotspot's network via USB tethering (recommended) or WiFi, then run:

python ./rootScript.py

Notes

  • Only tested on Linux so far, but it should work on other platforms, let me know your results.
  • Script assumes your hotspot's IP is 192.168.0.1
  • Script assumes you have set a custom weblogin password, i.e. you have changed it from the default AdminXXXX
  • For the sake of your own experimentation, the script leaves an unauthenticated root FTP server running on the device but only once you enable it. When you are done browsing the filesystem, be sure to manually close it by running killall tcpsvd on the TMOHS1 as root, or simply reboot the device.
Comments
  • Hotspot rejecting request. Double check the password

    Hotspot rejecting request. Double check the password

    Software Version: TMOHS1_0.04.18 Hardware Version: 89527_1_11 Python 3.10.1

    Just got this, took out the sim and connected to my arch linux box. Change the admin password to something else and tried the python script. Keep getting: Error: The hotspot rejected our request. Double check the password and try again.

    Enter your weblogin password: Sending the authentication request. . .

    /usr/lib/python3.10/pycache/netrc.cpython-310.pyc matches /usr/lib/python3.10/netrc.py

    code object from '/usr/lib/python3.10/pycache/netrc.cpython-310.pyc'

    /usr/lib/python3.10/pycache/shlex.cpython-310.pyc matches /usr/lib/python3.10/shlex.py

    code object from '/usr/lib/python3.10/pycache/shlex.cpython-310.pyc'

    import 'shlex' # <_frozen_importlib_external.SourceFileLoader object at 0x7f9b4c76fd00> import 'netrc' # <_frozen_importlib_external.SourceFileLoader object at 0x7f9b4c76faf0> Error: The hotspot rejected our request. Double check the password and try again.

    opened by poltergiest 10
  • Change IMEI

    Change IMEI

    Awesome utility Works great on TMOHS1 All data is routed through "non tethering" data Is it possible to change the IMEI? I did the same on prior T9s which allowed tmobile to recognize them as phones which completed the effect to go with "non tethering" data (by changing the TLS data).

    Mood lighting doesnt keep after reboot for some reason

    thanks Rico

    opened by IamRico00 4
  • ModuleNotFoundError: No module named 'cryptography'

    ModuleNotFoundError: No module named 'cryptography'

    I am trying to run this from terminal on a macbook pro non m1.

    I am getting this error when running the "python ./rootScript.py"

    username@usernam-Pro TMOHS1-Root-Utility-main % python ./rootScript.py Traceback (most recent call last): File "/Users/usernam/Desktop/TMOHS1-Root-Utility-main/./rootScript.py", line 15, in from cryptography.hazmat.primitives.ciphers import algorithms, modes, Cipher ModuleNotFoundError: No module named 'cryptography' username@username-MacBook-Pro TMOHS1-Root-Utility-main %

    I have run pip install -r requirements.txt and do not get any errors. I see the following: Requirement already satisfied: cryptography==38.0.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 1)) (38.0.1) Requirement already satisfied: requests==2.26.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 2)) (2.26.0) Requirement already satisfied: pandas==1.5.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 3)) (1.5.1) Requirement already satisfied: paramiko==2.11.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 4)) (2.11.0) Requirement already satisfied: pip==22.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 5)) (22.3) Requirement already satisfied: molecule==4.0.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 6)) (4.0.3) Requirement already satisfied: sh==1.14.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 7)) (1.14.3) Requirement already satisfied: pycryptodome==3.15.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from -r requirements.txt (line 8)) (3.15.0) Requirement already satisfied: cffi>=1.12 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from cryptography==38.0.1->-r requirements.txt (line 1)) (1.15.1) Requirement already satisfied: urllib3<1.27,>=1.21.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from requests==2.26.0->-r requirements.txt (line 2)) (1.26.12) Requirement already satisfied: certifi>=2017.4.17 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from requests==2.26.0->-r requirements.txt (line 2)) (2022.9.24) Requirement already satisfied: charset-normalizer~=2.0.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from requests==2.26.0->-r requirements.txt (line 2)) (2.0.12) Requirement already satisfied: idna<4,>=2.5 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from requests==2.26.0->-r requirements.txt (line 2)) (3.4) Requirement already satisfied: python-dateutil>=2.8.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from pandas==1.5.1->-r requirements.txt (line 3)) (2.8.2) Requirement already satisfied: pytz>=2020.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from pandas==1.5.1->-r requirements.txt (line 3)) (2022.5) Requirement already satisfied: numpy>=1.21.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from pandas==1.5.1->-r requirements.txt (line 3)) (1.23.4) Requirement already satisfied: bcrypt>=3.1.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from paramiko==2.11.0->-r requirements.txt (line 4)) (4.0.1) Requirement already satisfied: pynacl>=1.0.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from paramiko==2.11.0->-r requirements.txt (line 4)) (1.5.0) Requirement already satisfied: six in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from paramiko==2.11.0->-r requirements.txt (line 4)) (1.16.0) Requirement already satisfied: ansible-compat>=2.2.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (2.2.1) Requirement already satisfied: click<9,>=8.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (8.0.3) Requirement already satisfied: click-help-colors>=0.9 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (0.9.1) Requirement already satisfied: cookiecutter>=1.7.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (2.1.1) Requirement already satisfied: enrich>=1.2.7 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (1.2.7) Requirement already satisfied: jsonschema>=4.9.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (4.16.0) Requirement already satisfied: Jinja2>=2.11.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (3.1.2) Requirement already satisfied: packaging in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (21.3) Requirement already satisfied: pluggy<2.0,>=0.7.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (1.0.0) Requirement already satisfied: PyYAML>=5.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (6.0) Requirement already satisfied: rich>=9.5.1 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from molecule==4.0.3->-r requirements.txt (line 6)) (12.6.0) Requirement already satisfied: subprocess-tee>=0.3.5 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from ansible-compat>=2.2.0->molecule==4.0.3->-r requirements.txt (line 6)) (0.3.5) Requirement already satisfied: pycparser in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from cffi>=1.12->cryptography==38.0.1->-r requirements.txt (line 1)) (2.21) Requirement already satisfied: binaryornot>=0.4.4 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (0.4.4) Requirement already satisfied: jinja2-time>=0.2.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (0.2.0) Requirement already satisfied: python-slugify>=4.0.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (6.1.2) Requirement already satisfied: MarkupSafe>=2.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from Jinja2>=2.11.3->molecule==4.0.3->-r requirements.txt (line 6)) (2.1.1) Requirement already satisfied: attrs>=17.4.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from jsonschema>=4.9.1->molecule==4.0.3->-r requirements.txt (line 6)) (22.1.0) Requirement already satisfied: pyrsistent!=0.17.0,!=0.17.1,!=0.17.2,>=0.14.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from jsonschema>=4.9.1->molecule==4.0.3->-r requirements.txt (line 6)) (0.18.1) Requirement already satisfied: commonmark<0.10.0,>=0.9.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from rich>=9.5.1->molecule==4.0.3->-r requirements.txt (line 6)) (0.9.1) Requirement already satisfied: pygments<3.0.0,>=2.6.0 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from rich>=9.5.1->molecule==4.0.3->-r requirements.txt (line 6)) (2.13.0) Requirement already satisfied: pyparsing!=3.0.5,>=2.0.2 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from packaging->molecule==4.0.3->-r requirements.txt (line 6)) (3.0.9) Requirement already satisfied: chardet>=3.0.2 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from binaryornot>=0.4.4->cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (5.0.0) Requirement already satisfied: arrow in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from jinja2-time>=0.2.0->cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (1.2.3) Requirement already satisfied: text-unidecode>=1.3 in /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages (from python-slugify>=4.0.0->cookiecutter>=1.7.3->molecule==4.0.3->-r requirements.txt (line 6)) (1.3)

    opened by raiubreaksthings 2
  • Some parts of this utility require Python >= 3.10

    Some parts of this utility require Python >= 3.10

    I think mainly this new match syntax: https://github.com/natthawk/TMOHS1-Root-Utility/blob/main/utils.py#L201

    $ python ./rootScript.py 
    Traceback (most recent call last):
      File "./rootScript.py", line 22, in <module>
        from utils import TelnetConnection,chooseAction,chPwdFlag
      File "./utils.py", line 201
        match choice:
              ^
    SyntaxError: invalid syntax
    
    $ python --version
    Python 3.8.10
    

    Would recommend either updating the README to specify the requirement for Python >= 3.10, or using something that works with older Python version (Ubuntu 20.04 still doesn't have Python 3.10 in the main repos).

    EIther way, thank you for the work put into this! Other than this it worked well for me.

    opened by abraha2d 2
  • Add Utility to Mask Hotspot data as

    Add Utility to Mask Hotspot data as "on-device" data

    I've added an option to add some iptables/ip6tables rules that would mask what would normally be counted as hotspot data in the T-mobile dashboard as "on-device" data, that would allow a user on an unlimited plan to have unlimited high-speed data on the hotspot and its connected devices, instead of 5GB/40GB or whatever a plan offers at high-speed which would then be throttled to 3G.

    This would not bypass any sort of network-management or video throttling that may be apart of a customer's plan's terms. Also if a customer is on a straight-up limited data plan, this would not work either.

    There's a good read-up here explaining what TTL rules do.

    Great work on the project btw!

    opened by parker-stephens 1
  • Building custom binaries

    Building custom binaries

    I have managed to create some custom binaries (including dropbear for SSH) that execute on the device. I started with Buildroot (https://git.busybox.net/buildroot) then checked out an old version (tag 2016.02), and been manually updating the packages I want from the current master git.

    So far I have gotten the following to work:

    • htop (3.1.2)
    • tmux (3.1c)
    • nano (version 2.5.1)
    • dropbear (v2020.81)
    • openssl (update from 1.0.2h to 1.1.1.n)
    • openvpn (v2.5.6, did not test connection yet)

    If you are interested my buildroot setup is here: https://github.com/zefie/buildroot/tree/TMOHS1

    opened by zefie 9
Owner
null
CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

EntySec 118 Dec 24, 2022
Consolidating and extending hosts files from several well-curated sources. You can optionally pick extensions to block pornography, social media, and other categories.

Take Note! With the exception of issues and PRs regarding changes to hosts/data/StevenBlack/hosts, all other issues regarding the content of the produ

Steven Black 22.1k Jan 2, 2023
A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator crede

Matt 1 Apr 18, 2022
Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

Mitiga 13 Jan 4, 2022
A small script to export all AWAF policies from a BIG-IP device

This script leverages BIG-IP iControl REST API to export ALL AWAF policies in the system and saves them locally. The policies can be exported in the following formats: xml, plc and json.

null 3 Feb 3, 2022
CVE-2021-40346 integer overflow enables http smuggling

CVE-2021-40346-POC CVE-2021-40346 integer overflow enables http smuggling Reference: https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021

donky16 34 Nov 15, 2022
A GitHub action for organizations that enables advanced security code scanning on all new repos

Advanced-Security-Enforcer What this repository does This code is for an active GitHub Action written in Python to check (on a schedule) for new repos

Zack Koppert 30 May 17, 2022
This tool ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes.

This tool gives developers, researchers and companies the ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes. secure development, if currently supported, possible backdoors (malicious embedded code), typosquatting analysis, the history of versions and reported vulnerabilities (CVEs) of the package.

Telefónica 66 Nov 8, 2022
A python package with tools to read and postprocess the output of the channel DNS-solver (davecats/channel), as well as its associated postprocessing tools.

Python tools for davecats/channel A python package with tools to read and postprocess the output of the channel dns solver, as well as its associated

Andrea Andreolli 1 Dec 13, 2021
M.E.A.T. - Mobile Evidence Acquisition Toolkit

M.E.A.T. - Mobile Evidence Acquisition Toolkit Meet M.E.A.T! From Jack Farley - BlackStone Discovery This toolkit aims to help forensicators perform d

null 1 Nov 11, 2021
Orthrus is a macOS agent that uses Apple's MDM to backdoor a device using a malicious profile.

Orthrus is a macOS agent that uses Apple's MDM to backdoor a device using a malicious profile. It effectively runs its own MDM server and allows the operator to interface with it using Mythic.

Mythic Agents 37 Dec 6, 2022
This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device

f5-waf-enforce-sigs-CVE-2021-44228 This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device Overview This script enforce

Ismael Gonçalves 5 Mar 31, 2022
Profil3r is an OSINT tool that allows you to find potential profiles of a person on social networks, as well as their email addresses 🕵️

Profil3r is an OSINT tool that allows you to find potential profiles of a person on social networks, as well as their email addresses. This program also alerts you to the presence of a data leak for the found emails.

null 1.1k Aug 24, 2021
IDAPatternSearch adds a capability of finding functions according to bit-patterns into the well-known IDA Pro disassembler based on Ghidra’s function patterns format.

IDA Pattern Search by Argus Cyber Security Ltd. The IDA Pattern Search plugin adds a capability of finding functions according to bit-patterns into th

David Lazar 48 Dec 29, 2022
Malware Configuration And Payload Extraction

CAPEv2 (Python3) has now been released CAPEv2 With the imminent end-of-life for Python 2 (January 1 2020), CAPEv1 will be phased out. Please upgrade t

Context Information Security 701 Dec 27, 2022
Malware Configuration And Payload Extraction

CAPE: Malware Configuration And Payload Extraction CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of mal

Kevin O'Reilly 1k Dec 30, 2022
A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

Malware Configuration Extractor A Malware Configuration Extraction Tool and Modules for MalDuck This project is FREE as in FREE ?? , use it commercial

c3rb3ru5 103 Dec 18, 2022
Cobalt Strike Beacon configuration extractor and parser.

Cobalt Strike Configuration Extractor and Parser Overview Pure Python library and set of scripts to extract and parse configurations (configs) from Co

Stroz Friedberg 102 Dec 18, 2022
Detection tool of malware(s) by checksum (useful for forensic)

?? malware_checker.py Detection tool of malware(s) by checksum (useful for forensic) ?? Dependencies installation $ pip3 install -r requirements.txt

Fayred 1 Jan 30, 2022