Caster - Amazon Devs
Enumerating Amazon Devices
Last updated
Enumerating Amazon Devices
Last updated
This part of the manipulation chapter is dedicated to showing you what you can do with Amazon devices in Caster. This also shows you some of the basic details.
Note: Currently, the amazon manipulation module holds only one single command, but we will explain how you can get this data for this module and then explain how it works.
amazon-devdesc - A Cool thing about Amazon devices is that they use a UPnP server to query for device information, live information, stream information, and more. Well, the issue with this is that Caster just at the time of development did not want to include the UDP and SSDP sniffing modules that it used. For context, those modules were specific for Amazon devices and would search for anything on the port 6000And would also try to find any UPnP service URLs. Well, it was also found later that in order to query some services such as the Apple AirPlay RTSP server you need to use the device's UUID and with Amazon, this is just the case.
This command will do the same thing as all other commands, query or request resources from APIs but instead requires the UUID of the device you are targeting. So, here is how you can find that UUID on a standard Amazon FireStick-TV.
Step1: Open up wireshark
The first thing we need to do if our device is active is pop open wireshark, yeah, your best friend! when you are there, you can use Caster's module to find the IP address of an Amazon device. You need the IP of the device to make sure we are filtering for information.
So when we do that and filter the proper address, we may see some UDP packets like so.
Click through some of the UDP packets until you come across one that looks like the following.
We can see that this packet has some UDP data in it and it seems as if they are response headers from a request that went to the UPnP server. So, how do we properly format that? You could just go to wireshark, right click on the data field, select as data and then go from there- but if you want to use SkyLine for fun, then you an do the following.
1: Copy the data so we have a brick of the UDP data.
2: Set it into a variable on a notepad or something
Dont forget the damn semicolon.
3: Run SkyLine --Repl
4: Enter mode("pwn") as shown below.
5: Throw your variable into the REPL
6: Call HexDecode and encapsulate it inside of a println the statement finally throwing your variable in it, like so - println(HexDecode(x)) and then watch it decode.
And now, we have gotten the UUID and the full URL. Going back to Caster, we can plug our UUID into the option and have the information parsed properly.
