Autobox (CPC200-CCPA) root filesystem

[lvalen91]

rootfs_2025.02.25.1521.zip
flash_dump_2025.02.25.1521.bin.zip

Flashed dump of my CPC200-CCPA adapter and the extracted and decrypted / deobfuscation of the roots. My adapter had the latest available update installed. 2025.02.25.1521

[lvalen91]

[igoro00]

Hey, did you manage to do anything to the CCPA yet? eg. SSH?

[lvalen91]

root telnet or exploiting the upload.cgi in the webGUI can be used to run commands.

[lvalen91]

On linux

1. Connect to adapter AP and use the password 12345678
2. Download Dropbear
3. Run the script
4. Migh need to use nc 192.168.43.1 23 to connect and then use passwd to reset root password
5. ssh root@192.168.43.1

Download the dropbear binary Custom_Firmware/Scripts/Dropbear
exploit_with_ssh.sh

Keep script and dropbear binary in same folder.

[lvalen91]

Do not update firmware on the adapter. Firmware version 2025.10.15.1127 was just released. I am checking what files it replaces.

[lvalen91]

2025.10.15.1127 patches exploit. Creates a more secure enviroment. Preventing moving outside the tmp/ directory which allowed enabling SSH/Telnet.

[lvalen91]

The Firmware does the following.

It removes.

1. Undoes /etc/init.d/rcS edits <<< #'d dropbear and removes telnet.
2. Removes /etc/mirror.bgd /usr/sbin/adb and carlife. /usr/lib/ libssl.so.1.0.0, libcrypto.so.1.0.0, libcrypto.so, libssl.so << Old OpenSSL
3. 'remove_unnecessary_file.sh' /usr/sbin/dropbear and /usr/sbin/dropbearkey. Old WLAN kernel driver

What it adds NEW

1. /usr/sbin/boxHUDServer << HeadsUpDisplay Support?
2. /usr/sbin/boxUIServer << new web GUI?)
3. /usr/sbin/adbd << Android Debug Bridge daemon?
4. /usr/sbin/am << Activity Manager utility
5. /etc/DTMF-14809414327.pcm << DTMF audio file
6. /etc/rgbLight.conf << RGB light configuration
7. /etc/udhcpd.conf << DHCP server config
8. /etc/udhcpd_hicar_ap.conf << HiCar AP DHCP config
9. /etc/wpa_supplicant.conf << WiFi client config
10. /etc/siri.png
11. /etc/car_logo/ << More logos
12. /etc/iccoa/ccd.data << ICCOA certificate data, car connectivity certification

What it replaces (new versions)

1. ARMAndroidAuto
2. ARMHiCar
3. ARMadb-driver
4. ARMandroid_Mirror
5. ARMiPhoneIAP2
6. AppleCarPlay
7. AutomaticTest
8. boxNetworkService
9. colorLightDaemon
10. bluetoothDaemon
11. upload.cgi << Appears to Patch Exploit Uses temp files + hardcoded /tmp/ destination instead of
    user-supplied paths
12. server.cgi
13. libcrypto.so.1.1
14. libssl.so.1.1
15. libmanagement.so

A15W_Update_2025.10.15.1127_DECRYPTED.tar.gz
finish.sh
once.sh
remove_unnecessary_file.sh

[Zubastic]

Well, interesting. Thanks for research.