Research by GodSec (0x1622, 0x3024 & 0x4r53).

This all started when I went to the BITS Hyderabad campus for my summer term and saw a new vendor operating the vending machines. I then told Manav (0x4r53) and Prem (0x3024) about it, and we thought it would be banger if we could find some critical vulnerabilities in the machine.

||(spoiler) What started out as a pretty standard web application pentest ended up giving us interactive root shells on the physical Raspberry Pi hardware inside their machines across the country (300+ machines in total).||

I will start from the start

The first thing we did was map out all the subdomains associated with go-grab.in. We discovered the domain simply by visiting the company’s website. At that point, we had no idea that the vending machine was operated through this infrastructure, and we had almost no expectation of finding anything particularly interesting. In the beginning, all we had was the main domain: https://go-grab.in/.

Further using tools like subfinder and assetfinder we were able to identify a total of 7 subdomains:

https://taskdashboard.go-grab.in
https://www.go-grab.in
https://dashboard.go-grab.in
https://api.go-grab.in
https://go-grab.in
https://support.go-grab.in
https://webmail.go-grab.in

There was nothing very special on most of the subdomains except the first one, https://taskdashboard.go-grab.in. The rest of the subdomains were either dead or were not very interesting.

The hint for credentials on Taskdashboard

We started by mapping out their external footprint. During subdomain enumeration we found taskdashboard.go-grab.in; it was a Next.js app used by their internal operations team.

While going through the minified JavaScript bundle for the frontend, we noticed how they were handling role-based access control (RBAC):

1
// Admin check is client-side only:
2
let s = o === 'role_012' || o === 'role_010' // full admin
3
let c = o === 'role_007' // limited access

So basically role_012 and role_010 had full access.

Since the check was happening entirely on the client side, anyone could just edit their localStorage, set their role to role_012, which is super admin, and unlock the whole admin UI. The catch was that we still needed a valid token to actually pull data from the backend.

During this whole process, I was doing OSINT as well and found a few valid employee email addresses. We built a targeted wordlist and ran a password spray against the login endpoint. (NOTE: We were very careful of not DOSing and had wordlist of just 15 usernames/passwords)

1
...
2
const getAuthToken = async () => {
3
  const token_api = "https://gg-nodejs.onrender.com/api/user-login/v2";
4
  const user = {
5
    id: "sudhanshujha2717@gmail.com",
6
    password: "Sudhanshu"
7
  };
8
  const res = await fetch(token_api, {
9
    method: "POST",
10
    headers: { "Content-Type": "application/json" },
11
    body: JSON.stringify({ user }),
12
  });
13
  const data = await res.json();
14
  return data.data.token;
15
};

BOOM!

The craziest part comes here: it did not take long to get a hit on an employee account with a weak password, Sudhanshu1. If I remember correctly, it just took us 6-7 :) attempts.

SUCCESS! Password: Sudhanshu1
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoic3VkaGFuc2h1amhhMjcxN0BnbWFpbC5jb20iLCJyb2xlSWQiOiJyb2xlXzAxMiIsImlhdCI6MTc4MDQwNjE0MiwiZXhwIjoxNzgxMDEwOTQyfQ.9WU4pXZjfYCVeZaokeeMnqtg74rCpZ1IAn05qwcNZDg
Data: {
  "success": true,
  "message": "Login successful",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoic3VkaGFuc2h1amhhMjcxN0BnbWFpbC5jb20iLCJyb2xlSWQiOiJyb2xlXzAxMiIsImlhdCI6MTc4MDQwNjE0MiwiZXhwIjoxNzgxMDEwOTQyfQ.9WU4pXZjfYCVeZaokeeMnqtg74rCpZ1IAn05qwcNZDg",
  "user": "sudhanshujha2717@gmail.com"
}

Now we had access to their login dashboard, from which we could view all the important details.

Now that we had a valid JWT token, we started looking at the authenticated endpoints. By analyzing the JavaScript files again, we found a couple of very interesting endpoints that we wanted to test.

We hit /api/teams, expecting it to return the profile details for our specific team. Again the fun part: instead of a specific team, it dumped the entire employee database.

This was a massive authorization flaw. The response included 284 employee records. Worse, it included every single employee’s password in plaintext. It also leaked Aadhaar and PAN numbers, bank account details, Google Cloud Storage links to photos, and their physical ID cards.

Since we had the plaintext passwords for everyone, we just pulled out the 14 super admin role_012 accounts and effectively had control over the platform at that point.

Inside the dashboard

Logging in as a super admin gave us access to everything. We could view live fleet monitoring, task management, and the DSI dashboard, which showed raw sales data, profit margins, and inventory stats.

There was a huge amount of data available in this dashboard. For example, we could see the live order count, the total number of transactions from the past 30 days, total profits, and waste products.

At this stage, we analyzed the application’s authentication flow. The image below shows how authentication was handled within the platform. Additionally, we identified that the application’s backend was hosted at https://gg-nodejs.onrender.com, which served as the primary API endpoint for the entire system.

The login functionality used the /api/user-login/v2 endpoint to authenticate users.

At this point we had enough data to report, but we still thought it was not that critical of a bug. Unless and until we got something crazier, we were not going to stop.

This part was the most challenging. At that stage, we had no clear direction for further pivoting from the application. We knew about the API server at https://api.go-grab.in/, but without knowledge of the available endpoints, targeting it effectively was difficult.

We attempted to discover endpoints through fuzzing, but those efforts did not yield any useful results. Without additional information about the API structure, further progress on this attack path seemed unlikely.

Though we confirmed that all the endpoints that were working for https://gg-nodejs.onrender.com were also working for https://api.go-grab.in/.

We spent roughly 4-6 hours exploring different attack paths, but none of them led anywhere significant. Then, almost by chance, We discovered what turned out to be a goldmine: a publicly accessible GitHub repository.

1
// require('./utils/newRelicAPIMonitoring.js')
2
// import 'newrelic';
3
// let newrelic = null;
4
// try {
5
//     newrelic = require('newrelic');
6
// } catch (e) {
7
//     console.warn('New Relic not loaded:', e.message);
8
// }
9

10
const cluster = require('cluster');
11
const os = require('os');
12
const express = require('express');
13
// const ping = require('ping');
14
const bodyParser = require('body-parser');
15
const timeout = require('connect-timeout');
16
require('dotenv').config();
17
const cors = require('cors');
18

19

20
const path = require('path');
21

22

23
const logger = require('./middlewares/logger'); // Logging middleware
24
const errorHandler = require('./middlewares/errorHandler'); // Error handling middleware
25
const authenticate = require('./middlewares/authenticate'); // Authentication middleware (optional placement)
26

27
// const paymentRoutes = require('./routes/paymentRoutes');
28
// const loginVerifyRoutes = require('./routes/loginVerifyRoutes');
29
// const downtimeRoutes = require('./routes/downtimeRoutes.js');
30
// const userLoginRoutes = require('./routes/userLoginRoutes');
31
// const onBoardingRoutes = require('./routes/onBoardingRoutes.js');
32
// const dashboardLoginRoute = require('./routes/dashboardLoginRoute.js');
33
// const ImageUploadRoute = require('./imageUpload/ImageUploadRoute.js');
34

35

36
// const productRoutes = require('./routes/productRoutes');
37
// const categoryRoutes = require('./routes/categoryRoutes');
38
// const todoTasksRoutes = require('./routes/todoTasksRoutes.js');
39
// const todoTasksCommentsRoutes = require('./routes/todoTasksCommentsRoutes.js');
40
// const orderRoutes = require('./routes/orderRoutes');
41
// const ratingsRoutes = require('./routes/ratingsRoutes');
42
// const machineDetailsRoutes = require('./routes/machineDetailsRoutes');
43
// const rfidUsersRoutes = require('./routes/rfidUsersRoutes.js');
44
// const rfidTransactionRoutes = require('./routes/rfidTransactionRoutes.js');
45
// const rfidRechargeLogsRoutes = require('./routes/rfidRechargeLogsRoutes.js');
46
// const machinePaymentRoutes = require('./routes/machinePaymentRoutes');
47
// const transactionDetailsRoutes = require('./routes/transactionDetailsRoutes');
48
// const coilRecommendationRoutes = require('./routes/coilRecommendationRoutes.js');
49
// const coilRoutes = require('./routes/coilRoutes');
50
const teamRoutes = require('./routes/teamRoutes');
51
// const refillHistoryRoutes = require('./routes/refillHistoryRoutes');
52
// const warehouseRoutes = require('./routes/warehouseRoutes');
53
// const gstRegisteredAddressesRoutes = require('./routes/gstRegisteredAddressesRoutes.js');
54
// const stockFlavourTransferRoutes = require('./routes/stockFlavourTransferRoutes.js');
55
// const brandRoutes = require('./routes/brandRoutes');
56
// const lastIdRoutes = require('./routes/lastIdRoutes');
57
// const warehouseSlotRoutes = require('./routes/warehouseSlotRoutes');
58
// const stockExchangeRoutes = require('./routes/stockExchangeRoutes.js');
59
// const bagSlotRoutes = require('./routes/bagSlotRoutes');
60
// const vendItemRoutes = require('./routes/vendItemRoutes');
61
// const organizationRoutes = require('./routes/organizationRoutes');
62
// const scrapSaleRoutes = require('./routes/scrapSaleRoutes.js');
63
// const clusterRoutes = require('./routes/clusterRoutes');
64
// const distributorRoutes = require('./routes/distributorRoutes');
65
// const purchaseProductRoutes = require('./routes/purchaseProductRoutes');
66
// const transactionRoute = require('./routes/transactionRoutes');
67
const roleRoutes = require('./routes/roleRoutes');
68
// const inventoryOrderingRoutes = require('./routes/inventoryOrderingRoutes.js');
69
// const productRecommendationRoutes = require('./routes/productRecommendationRoutes.js');
70
// const pickLogRoute = require('./routes/pickLogRoute');
71
// const returnLogRoute = require('./routes/returnLogRoutes');
72
// const productMismatchRoutes = require('./routes/productMismatchRoutes');
73
// const stockUpdateLogRoutes = require('./routes/stockUpdateLogRoutes');
74
// const purchaseOrderRoutes = require('./routes/purchaseOrderRoutes.js');
75
// const draftPurchaseOrderRoutes = require('./routes/draftPurchaseOrderRoutes.js');
76
// const inventoryDiscrepancyRoutes = require('./routes/inventoryDiscrepancyReportRoutes.js');
77
// const auditQuestions = require('./routes/auditQuetionsRoutes.js');
78
// const purchaseOrderProductRoutes = require('./routes/purchaseOrderProductRoutes');
79
// const responseFromPaytmRoutes = require('./routes/responseFromPaytmRoutes');
80
const expoPushTokenRoutes = require('./routes/expoPushTokenRoutes.js');
81
const notificationsRoutes = require('./routes/notificationsRoutes.js');
82
const salaryRoutes = require('./routes/salaryRoutes.js');
83
const notificationRecipientsRoutes = require('./routes/notificationRecipientsRoutes.js');
84

85
// const ebillRoutes = require('./routes/ebillRoutes.js');
86

87
// const SpecialMachineRoutes = require('./specialMachineApis/routes/index');
88
const SpecialUserRoutes = require('./specialUserApis/routes/index');
89
const notificationRoute = require('./notification/notificationRoute.js');
90
const authorize = require('./middlewares/authorize');
91

92
const attendanceRoute = require('./routes/attendanceRoutes.js')
93
const odometerRoute = require('./routes/odometerRoutes.js')
94
const attendanceOverrideRoute = require('./routes/attendanceOverrideRoutes.js')
95
// const discountOfferRoutes = require('./routes/discountOfferRoutes.js')
96
const distanceOverrideRoutes = require('./routes/distanceOverrideRoutes.js')
97
const shiftRoute = require('./routes/shiftRoutes.js')
98
const breakRoute = require('./routes/breakRoutes.js')
99
const leaveRoute = require('./routes/leaveRoutes.js')
100
const expenseRoute = require('./routes/expenseRoutes.js')
101
const incentiveRoutes = require('./routes/incentiveRoutes');
102
const fineRoutes = require('./routes/fine.routes');
103
const leaveEncashedRoutes = require('./routes/leaveEncashedRoutes');
104
// const authUserOrMachine = require('./middlewares/authUserOrMachine.js');
105
const companyAssetRoutes = require('./routes/companyAssetsRoutes');
106
// const scrapRoutes = require('./routes/scrapRequestRoutes')
107
// const assetTransferRoutes = require('./routes/assetTransfer')
108
// const compensatoryRoutes = require('./routes/compensatoryLeaveRoutes')
109
// const maintenanceQuestionsRoutes = require('./routes/maintenanceQuestionsRoutes')
110
// const maintenanceLogsRoutes = require('./routes/maintenanceLogsRoutes')
111
// const maintenanceSlotsRoutes = require('./routes/maintenanceSlotsRoutes')
112
const releasenoteRoute = require('./routes/releaseNote')
113
const baseSalaryChangeRoute = require('./routes/baseSalaryChangeRoutes')
114
const compoffChangeRoute = require('./routes/compoffChangeRoutes')
115
const meetingRoutes = require('./routes/meetingRoutes')
116
// const hardwareRoutes = require('./routes/hardwareRoutes')
117
// const temperatureRoutes = require('./routes/temperatureRoutes')
118
// const distributorRequestRoutes = require('./routes/distributorRequestRoutes')
119

120
// async function queryWithMetrics(text, params, req) {
121
//     const start = Date.now();
122
//     const clientIp = req ? (req.headers['x-forwarded-for'] || req.socket.remoteAddress) : 'Unknown';
123

124
//     try {
125
//         const res = await pool.query(text, params);
126
//         const duration = Date.now() - start;
127
//         newrelic.recordMetric('Custom/DBQuery', duration);
128
//         newrelic.recordCustomEvent('DatabaseQuery', {
129
//             query: text,
130
//             executionTime: duration,
131
//             clientIp: clientIp
132
//         });
133
//         return res;
134
//     } catch (error) {
135
//         newrelic.noticeError(error);
136
//         throw error;
137
//     }
138
// }
139

140

141
const numCPUs = os.cpus().length;
142

143
if (cluster.isMaster) {
144
    console.log(`Master process ${process.pid} is running`);
145
    require('newrelic');
146

147
    // Fork workers
148
    for (let i = 0; i < numCPUs; i++) {
149
        cluster.fork();
150
    }
151

152
    // Listen for worker exit
153

154
    cluster.on('exit', async (worker, code, signal) => {
155
        // const publicIp = await getPublicIP();
156
        console.log(`Worker ${worker.process.pid} exited. Restarting...`);
157

158
        // newrelic.recordCustomEvent('WorkerExit', {
159
        //     workerId: worker.process.pid,
160
        //     exitCode: code,
161
        //     signal: signal,
162
        //     // serverIp: publicIp
163
        // });
164
        cluster.fork();
165
    });
166

167
    // require('./cronJobs/alertTriggerCron.js')
168

169
    // require('./cronJobs/cronForMaps.js'); // Adjust the path as necessary
170
    // require('./cronJobs/cronForRefilingHours.js');
171
    // require('./cronJobs/poSummaryCron.js')
172
    // require('./cronJobs/cronForEmailBills.js');
173
    // require('./cronJobs/cronToEmailBillSumarriesToZOHOUsers.js');
174
    // require('./cronJobs/cronForSalaryCalcsEveryMonth.js')
175
    // const attendanceCron = require('./cronJobs/attendanceCronJob.js');
176
    // attendanceCron.scheduleCronJob();
177
    // require('./cronJobs/cronForProductScores.js')
178
    // require('./cronJobs/orderingModel.js'); // Adjust the path as necessary
179
    // require('./cronJobs/cronJobForAvailabilityStatus'); // Adjust the path as necessary
180
    // require('./cronJobs/cronForWarehouseInventoryToNR.js'); // Adjust the path as necessary
181
    // require('./cronJobs/cronForAvgSalesClusterAndProduct.js'); // Adjust the path as necessary
182
    // require('./cronJobs/cronForPOautoCancellation.js'); // Adjust the path as necessary
183
    // require('./cronJobs/cronForUsersPointsCalculation.js'); // Adjust the path as necessary
184
    // require('./cronJobs/autoEncash.js');
185
    // require('./new Relic/attendance_newRelic.js');
186
    // require('./new Relic/clusterWiseAttendance.js');
187
    // require('./new Relic/lastAttendance.js')
188
    // require('./cronJobs/refillCountResetCron.js');
189
    // require('./new Relic/todayAttendance.js')
190
    // require('./cronJobs/toSendBillsAdjustmentToNr.js')
191
    // // over ride request summary cron job
192
    // require('./new Relic/override_requests.js')
193
    // require('./new Relic/workingHours/avg_availability.js');
194
} else {
195

196
    const app = express();
197
    const port = process.env.PORT || 4000;
198

199

200

201
    const MAX_CONCURRENT_REQUESTS = 150;
202
    let currentRequests = 0;
203
    const requestQueue = [];
204

205
    // Middleware to manage concurrent requests
206
    const concurrencyLimiter = (req, res, next) => {
207
        if (currentRequests < MAX_CONCURRENT_REQUESTS) {
208
            currentRequests++;
209
            res.on('finish', () => {
210
                currentRequests--;
211
                if (requestQueue.length > 0) {
212
                    const nextReq = requestQueue.shift();
213
                    nextReq();
214
                }
215
            });
216
            next();
217
        } else {
218
            console.log(`Queueing request to ${req.method} ${req.originalUrl}`);
219
            requestQueue.push(() => {
220
                concurrencyLimiter(req, res, next);
221
            });
222
        }
223
    };
224

225
    // Apply the middleware globally
226
    // app.use(concurrencyLimiter);
227

228
    // setInterval(() => {
229
    //     console.log(`Current active requests: ${currentRequests}`);
230
    //     console.log(`Requests in queue: ${requestQueue.length}`);
231
    // }, 5000); // Log every 5 seconds
232

233

234
    app.use(timeout('50s'));
235

236

237
    // for emergency use only
238
    // app.use((req, res, next) => {
239
    //     // If load is too high, short-circuit with success
240
    //     if (process.env.ALWAYS_SUCCESS === "true") {
241
    //         return res.status(200).json({ success: true });
242
    //     }
243
    //     next();
244
    // });
245

246

247
    // Middleware to handle timeouts
248
    app.use((req, res, next) => {
249
        if (req.timedout) {
250
            console.log(`Request to ${req.method} ${req.originalUrl} timed out`);
251
            activeSockets.delete(req.socket); // Clean up socket
252
            if (!res.headersSent) {
253
                res.status(503).end('Request timed out');
254
            }
255
        } else {
256
            next();
257
        }
258
    });
259

260
    app.use((err, req, res, next) => {
261
        console.error(`Error during request to ${req.method} ${req.originalUrl}:`, err);
262
        activeSockets.delete(req.socket); // Clean up socket on error
263
        if (!res.headersSent) {
264
            res.status(500).json({ error: 'Internal Server Error' });
265
        }
266
    });
267

268
    app.use(cors());
269
    // app.use(cors({
270
    //     origin: "*",
271
    //     methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
272
    //     allowedHeaders: ["Content-Type", "Authorization"]
273
    // }));
274

275
    app.use(bodyParser.json());
276
    app.use(logger); // Apply logger to every request
277
    // const newrelic = require('newrelic');
278
    const activeSockets = new Map(); // Map to track active sockets by endpoint
279

280
    // Middleware to track incoming requests and associated sockets
281
    app.use((req, res, next) => {
282
        const startTime = Date.now();
283
        const socket = req.socket;
284
        const endpoint = `${req.method} ${req.originalUrl}`;
285

286
        if (!activeSockets.has(socket)) {
287
            activeSockets.set(socket, endpoint);
288
        }
289

290
        req.on('aborted', () => {
291
            console.log(`Request to ${endpoint} was aborted by the client`);
292
            activeSockets.delete(socket); // Clean up socket
293
        });
294

295
        req.on('timeout', () => {
296
            console.log(`Request to ${endpoint} timed out after 30s`);
297
            activeSockets.delete(socket);
298
            console.log(`Socket deleted for ${endpoint}`);
299
            if (!res.headersSent && !res.finished) {
300
                res.status(503).end();
301
            }
302
        });
303

304
        res.on('finish', () => {
305
            const duration = Date.now() - startTime;
306
            // console.log(`Request to ${endpoint} finished in ${duration}ms`);
307
            activeSockets.delete(socket); // Remove the socket after response is sent
308
        });
309

310
        res.on('close', () => {
311
            console.log(`Response closed for ${endpoint}`);
312
            activeSockets.delete(socket); // Ensure socket cleanup
313
        });
314

315
        next();
316
    });
317

318
    // api monitoring middleware
319
    app.use((req, res, next) => {
320
        const start = Date.now();
321
        const endpoint = `${req.method} ${req.originalUrl}`;
322
        const clientIp = req.headers['x-forwarded-for'] || req.socket.remoteAddress;
323

324

325
        // req.on('aborted', () => {
326
        //     console.log(`Request to ${endpoint} was aborted`);
327
        // });
328

329
        // req.on('timeout', () => {
330
        //     console.log(`Request to ${endpoint} timed out`);
331
        //     if (!res.headersSent && !res.finished) {
332
        //         res.status(503).end('Request timed out');
333
        //     }
334
        // });
335

336
        // res.on('finish', () => {
337
        //     const duration = Date.now() - start;
338
        //     newrelic.recordMetric(`Custom/API/${endpoint}`, duration);
339
        //     newrelic.recordCustomEvent('APIRequest', {
340
        //         endpoint: endpoint,
341
        //         responseTime: duration,
342
        //         clientIp: clientIp,
343
        //         statusCode: res.statusCode,
344
        //     });
345
        //     console.log(`Request from ${clientIp} to ${endpoint} finished in ${duration}ms`);
346
        // });
347

348
        next();
349
    });
350

351

352

353
    // setInterval(() => {
354
    //     const cpuUsage = os.loadavg()[0]; // 1-minute CPU load
355
    //     const memoryUsage = process.memoryUsage().rss / 1024 / 1024; // MB
356

357
    //     newrelic.recordCustomEvent('CPUUsageEvent', {
358
    //         cpu: parseFloat(cpuUsage.toFixed(2)),
359
    //         memory: parseFloat(memoryUsage.toFixed(2))
360
    //     });
361

362
    //     console.log(`CPU: ${cpuUsage}, Memory: ${memoryUsage}MB`);
363
    // }, 60000);
364

365

366
    // Example: Applying authentication middleware to secure routes
367
    // app.use('/api/secure', authenticate, secureRoute);
368

369
    // Public route
370
    // app.get('/health', (req, res) => {
371
    //     res.send('Vending Machine API is running');
372
    //     // res.send(`Hello from Vending Machine Worker ${process.pid}`);
373
    // });
374

375
    // app.post('/test', (req, res) => {
376
    //     setTimeout(() => {
377
    //         res.status(200).send('OK');
378
    //     }, 2000); // 2 seconds delay
379
    // });
380

381
    // app.use('/webhook', notificationRoute)
382
    // app.use('/api/categories', authorize, categoryRoutes);
383
    // app.use('/api/todotasks', authorize, todoTasksRoutes);
384
    // app.use('/api/todotask_comments', authorize, todoTasksCommentsRoutes);
385
    // app.use('/api/machine_payment', authorize, machinePaymentRoutes);
386
    // app.use('/api/transactionDetails', authorize, transactionDetailsRoutes);
387
    // app.use("/api/coil-recommendations", authorize, coilRecommendationRoutes);
388

389
    app.use('/api/teams', teamRoutes);
390
    // app.use('/api/refillHistories', authorize, refillHistoryRoutes);
391
    // app.use('/api/warehouses', authorize, warehouseRoutes);
392
    // app.use('/api/gst-registered-addresses', authorize, gstRegisteredAddressesRoutes);
393
    // app.use('/api/stockFlavourTransfer', authorize, stockFlavourTransferRoutes);
394
    // app.use('/api/brands', authorize, brandRoutes);
395
    // app.use('/api/lastId', authorize, lastIdRoutes);
396
    // app.use('/api/warehouseSlots', authorize, warehouseSlotRoutes);
397
    // app.use('/api/stockexchange', authorize, stockExchangeRoutes);
398
    // app.use('/api/bagSlots', authorize, bagSlotRoutes);
399
    // app.use('/api/vendItems', authorize, vendItemRoutes);
400
    // app.use('/api/organizations', authorize, organizationRoutes);
401

402
    // app.use('/api/scrapsale', authorize, scrapSaleRoutes);
403
    // app.use('/api/clusters', authorize, clusterRoutes);
404
    // app.use('/api/distributors', authorize, distributorRoutes);
405
    // app.use('/api/purchaseProducts', authorize, purchaseProductRoutes);
406
    // app.use('/api/roles', authorize, roleRoutes);
407
    // app.use('/api/pickLog', authorize, pickLogRoute);
408
    // app.use('/api/returnLog', authorize, returnLogRoute);
409
    // app.use('/api/product-mismatch', authorize, productMismatchRoutes);
410
    // app.use('/api/stockUpdateLog', authorize, stockUpdateLogRoutes);
411
    // app.use('/api/purchaseOrder', authorize, purchaseOrderRoutes);
412
    // app.use('/api/draft-purchaseOrder', authorize, draftPurchaseOrderRoutes);
413
    // app.use('/api/inventoryDiscrepancy', authorize, inventoryDiscrepancyRoutes);
414
    // app.use('/api/audit-questions', authorize, auditQuestions);
415
    // app.use('/api/purchaseOrderProduct', authorize, purchaseOrderProductRoutes);
416
    // app.use('/api/notificationRecipients', authorize, notificationRecipientsRoutes);
417
    // app.use('/api/notificationDetails', authorize, notificationsRoutes);
418
    app.use('/api/expoPushToken', expoPushTokenRoutes);
419

420
    app.use('/api/userSalary', salaryRoutes);
421
    app.use('/api/baseSalaryChange/',baseSalaryChangeRoute)
422
    app.use('/api/compoffChange',compoffChangeRoute)
423
app.use('/api/meetings',meetingRoutes)
424
    // app.use('/api/inventory-ordering', authorize, inventoryOrderingRoutes);
425
    // app.use('/api/product-recommendation', authorize, productRecommendationRoutes);
426

427
    // app.use('/api/responsefrompaytm', responseFromPaytmRoutes);
428
    // app.use('/api/v2', authorize, SpecialUserRoutes);
429

430
    // app.use('/api/dashboard-login', dashboardLoginRoute);
431
    // app.use('/api/user-login', userLoginRoutes);
432
    // app.use('/api/coils', authUserOrMachine, coilRoutes);
433
    // app.use('/api/rfidusers', rfidUsersRoutes);
434
    // app.use('/api/rfidtransactions', rfidTransactionRoutes);
435
    app.use('/api/releasenote',releasenoteRoute)
436
    // app.use('/api/rfidrechargeLogs', rfidRechargeLogsRoutes);
437
    // app.use('/api/machineDetails', machineDetailsRoutes);
438
    // app.use('/api/orders', orderRoutes);
439
    // app.use('/api/products', productRoutes);
440

441
    // app.use('/api/ebill', ebillRoutes);
442

443
    // app.use('/api/login-verify', loginVerifyRoutes);
444
    // app.use('/api/onboarding', onBoardingRoutes);
445
    // app.use('/api/downtime', downtimeRoutes);
446
    // app.use('/api/transactions', transactionRoute);
447

448

449
    // app.use('/api/payments', authenticate, paymentRoutes);
450
    // app.use('/api/products', authenticate, productRoutes);
451
    // app.use('/api/ratings', authenticate, ratingsRoutes);
452
    // app.use('/api/v1', authenticate, SpecialMachineRoutes);
453
    // // Global error handler should be the last piece of middleware
454
    // app.use('/api/uploadImage', authorize, ImageUploadRoute);
455
    // app.use(errorHandler);
456

457
    // new code Empoyee Tracking
458
    app.use("/api/attendance", attendanceRoute);
459
    app.use("/api/odometer", odometerRoute);
460
    app.use("/api/attendanceoverride", attendanceOverrideRoute)
461
    app.use("/api/distanceoverride", distanceOverrideRoutes)
462

463
    app.use("/api/shifts", shiftRoute);
464
    // app.use("/api/discountOffer", authorize, discountOfferRoutes);
465
    app.use("/api/breaks", breakRoute);
466
    app.use("/api/leaves", leaveRoute);
467
    app.use("/api/expenses",  expenseRoute);
468
    app.use('/api/incentives',  incentiveRoutes);
469
    // app.use('/api/fines',  fineRoutes);
470
    // app.use('/api/leaveEncashed',  leaveEncashedRoutes)
471
    // app.use('/api/companyassets',  companyAssetRoutes);
472
    // app.use('/api/scrap', authorize, scrapRoutes)
473
    // app.use('/api/assettransfer', authorize, assetTransferRoutes)
474
    // app.use('/api/compensatoryleave', authorize, compensatoryRoutes)
475

476
    // Maintenance routes
477
    // app.use('/api/maintenance-questions', authorize, maintenanceQuestionsRoutes);
478
    // app.use('/api/maintenance-records', authorize, maintenanceLogsRoutes);
479
    // app.use('/api/maintenance-slots', authorize, maintenanceSlotsRoutes);
480

481
    // Hardware and Temperature routes
482
    // app.use('/api/hardware', authorize, hardwareRoutes);
483
    // app.use('/api/temperature', authorize, temperatureRoutes);
484

485
    // Distributor request routes
486
    // app.use('/api/distributor-requests', authorize, distributorRequestRoutes);
487

488
    // --- Serve the React App ---
489
    // IMPORTANT: Define the route where your React app will be served
490
    const REACT_APP_BASE_ROUTE = '/'; // This should match what you set in vite.config.js and BrowserRouter
491

492
    // Serve static files from the React app's build directory
493
    app.use(REACT_APP_BASE_ROUTE, express.static(path.join(__dirname, 'gg-main-website', 'dist')));
494

495
    // For any other GET request that doesn't match an API route or static file
496
    // within the React app's base route, serve the React app's index.html.
497
    // This is crucial for React Router to handle client-side routing.
498
    // app.get(`${REACT_APP_BASE_ROUTE}/*`, (req, res) => {
499
    //     res.sendFile(path.join(__dirname, 'gg-main-website', 'dist', 'index.html'));
500
    // });
501

502

503
    // app.use(express.static(path.join(__dirname, 'gg-main-website', 'dist')));
504

505
    // // Fallback route for React Router
506
    // app.get('*', (req, res) => {
507
    //     res.sendFile(path.join(__dirname, 'gg-main-website', 'dist', 'index.html'));
508
    // });
509

510

511

512
    app.listen(port, '0.0.0.0', () => {
513
        console.log(`Server running on port ${port} with Worker ${process.pid}`);
514
    });
515

516
}
517
// module.exports = app

The repository appeared to belong to one of the company’s developers and contained source code related to the application. Fortunately or unfortunately, it had been left public, exposing a wealth of internal information that was never intended to be accessible to external users.

While reviewing the repository, we discovered Google Cloud service account credentials committed directly to the source code.

1
{
2
  "type": "service_account",
3
  "project_id": "go-grab-13dac",
4
  "private_key_id": "b044ac6e633a1fe8d661b1e94d0e8970cxxxxxxxx",
5
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUBZKxL/qXy3LM\nmyigJ+Qh4BDxmWGGf7y6XqY9+qggX7nyt62b4xxxxxxxueKb5HuJNTr0/\nTXaq86LLvN6JykyujCz87RHf1gTAc1DoV88I5Yos7RC/xJdyraLWdKo/l0joc8VQ\nI9ErPXdIfFDZCEaS9Wo20UQAbzik6ydJi8cK/hXEt7+gS3LqsRzyZ18oUuSD63MR\n3R0XB8U0fvfC5Rcs5rbGuaKTYU3FaEWvL120Bgf8LVKIj+5z1xJTjFixuGr3yuQ/\nWhk5YEX1nerfOqq09qLQx9QoMV3NHuxxxxxxq80d4jaz2SlkeJnD5W1l2tr\naz+9VJPHAgMBAAECggEACuTCxX3cSZnu98Y+01PsPbP8UJOIXQ9/PRC517Df+QtN\nJ42Ys3LGzPtoVuUvfUlg81kMzM5sOuKdxJANDjVtAzqB/uO1CK7coWafHKPnE0oe\np7gipAB5+VF0cfCOxsv8QnUxPF8uvfDF54kjRoqOV0woNQ4fXNxpNeHpHnERBaNY\nwQTI07ZlqzF8axuOozf870IlV5AvPMmU9oAeueMa8pqq4qvr9Ox2uP53kV3GsdQZ\nHbibcKNVo3eo8DSX54t7KMdSRmFjMIdt+9Ae+hOuWEx7YoQQOIk1RvErCLoFvIOD\nIX5QtINObuTfUu5LLSuHjlZJbAUvQIm+guuMFo6+mQKBgQDLtqoNI7LV8V/x5Eed\nAhtCk0pRjRpRK37DUmq0ef3IdYgUfPLCtqW4Bm3uSQm87XnjMenUK/RfE1PRQRMR\nTSovRN4FmhIvmhZUPd8mz6L5fN3Zi0BL+UqXk9Yazn7TbQ2rc/6dYKoulEgCGfeA\nWADO2QRB4Cd9dxl3ZcL6bF2naQKBgQC6A5bMW1gXaU3mGcky5xw384EN1YZcpFxsxxxxxxxezjuB91L2e3HPdQG10uig+IOIGmWhgcjTefQfVv2P7v6ywNVBKit/\nuYmW9Z2tf3A2Uqvo0SC57LrX7/Ashinh0wA+uFHHG0jGibVO5KlW6ySS1+NLYYgv\nhY+yExyrrwKBgCZcRldlEocRBeUx/H5HaES4IbWLoZoJW7yCJ4/GrRBzeWWKRdh+\ntmQZ6deGL2xBN8OdoY+Pm1vP8uejnmiSpE/0Yu6hHa2TEYNZh0zyqpjad5hAjaIA\n1pgGgbnYiq9biMhxdk/CZSmSSKEErMOhTr2kxhV1lVod9FC0e+vWPiiJAoGAMnH4\nulDnUeoH6ygBDWHpoC7UR9kpSAR24A8Hm4fFurwrRZ4uOy/Eev29PqKfpRyeY9Eh\nco6eEy+sM9W1463ms9r/jaCH9NUn2MqLSrovWbbeyoye/FOCiYlunlL+kkSMJSbg\nwSGhY9q9YMJFvjB60AyS7ZPIm0/G7ARPlN5j/xcCgYAvEyEDhICoeD0F86wDjzF/\nG86c7JtsRG6iutsoU2l8PMP/EyiQ2LY6CBJcKH+WDaTVhBRu0kzglVFfIBBzDU/g\nEwc7cG6U08FisxpkHD+StkTUDBgfQlblQ3oFrXfPpQ6rLdSatfMoONrOLxZfUDPh\xxxxxxxxxx/YFhsQapQ==\n-----END PRIVATE KEY-----\n",
6
  "client_email": "firebase-adminsdk-xxxxx@go-grab-13dac.iam.gserviceaccount.com",
7
  "client_id": "11195855701960100xxxxx",
8
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
9
  "token_uri": "https://oauth2.googleapis.com/token",
10
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
11
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-ou9x6%40go-grab-13dac.iam.gserviceaccount.com",
12
  "universe_domain": "googleapis.com"
13
}

Even more concerning, the credentials had not been revoked or rotated and were still valid at the time of testing. Depending on the permissions assigned to the service account, this could have provided extensive access to cloud resources associated with the organization.

The hijack of 300+ machines

Returning to the API endpoints, we began systematically testing the various functionalities exposed by the application. During this process, we identified several low- and medium-severity vulnerabilities. However, to keep this write-up focused and concise, I will not be covering those findings in detail.

Instead, I will focus on the issues that ultimately led to the full compromise of the environment.

While testing the available endpoints, we came across a particularly interesting endpoint: /api/machineDetails. This endpoint exposed information related to Dataplicity.

Dataplicity is basically a remote access and management service specifically built for small Linux-based IoT devices.

We decided to investigate the exposed data further to determine whether it could be leveraged for additional access or privilege escalation opportunities.

Going Beyond Privileges

Using the credentials exposed by the /api/machineDetails endpoint, we attempted to log in to the Dataplicity dashboard. Unsurprisingly, the credentials were valid and granted us access.

What made this finding particularly severe was that these credentials were not limited to a single device. The endpoint exposed credentials for every machine managed by the organization, more than 300 machines in total.

The Dataplicity interface provided an overview of all registered devices and their current status, indicating whether each machine was online or offline.

Among the available features, the most interesting and impactful was the Terminal functionality. This feature allowed direct shell access to the underlying machine through the web interface, effectively providing remote command execution on any device for which valid credentials were available.

As can be clearly seen in the screenshot above, we did not have permission to access this directory because our session was running as the dataplicity user rather than root or gograb.

We had been reading about a recently disclosed and highly discussed Linux privilege escalation vulnerability known as “copy.fail”. A related vulnerability, known as DirtyFrag, had also attracted significant attention. Unlike classic vulnerabilities such as Dirty COW, which relied on race conditions, these issues stemmed from flaws in Linux kernel subsystems rather than traditional memory corruption bugs.

You can read more about these vulnerabilities here: Copy.fail and DirtyFrag

Since GCC was already installed on the system, I decided to use the DirtyFrag exploit. Initially, however, the exploit failed because none of us realized that the target Raspberry Pi devices were running on an ARM architecture rather than x86.

After quickly searching for an ARM-compatible version of the exploit, we came across an ARM64/AArch64 port of DirtyFrag. The repository was based on the original work by V4bel and had been adapted specifically for ARM-based systems.

With a compatible version of the exploit in hand, we proceeded to test whether the target machines were vulnerable.

And BOOM! We were root.

Root access announcement

Literally at this point we could do whatever we wanted from the machine: uninstall the running software, change the UPI parameter so that all the transactions go to us instead of the Go-Grab team, or take the machines offline entirely.

The last part

➜  gg-machine-build tree
.
|-- backend
|   `-- backend
`-- frontend
    |-- build
    |   |-- GoGrab.png
    |   |-- GoGrab2.png
    |   |-- asset-manifest.json
    |   |-- assets
    |   |   `-- upi
    |   |       |-- amazonpay.svg
    |   |       |-- googlepay.svg
    |   |       |-- paytm.svg
    |   |       |-- phonepe.svg
    |   |       |-- samsungpay.svg
    |   |       `-- upi-icon.svg
    |   |-- coffeeD.png
    |   |-- default_product_image.png
    |   |-- favicon.ico
    |   |-- index.html
    |   |-- info.png
    |   |-- infoButton.png
    |   |-- logo192.png
    |   |-- logo512.png
    |   |-- manifest.json
    |   |-- payment-failure.gif
    |   |-- payment-failure1.gif
    |   |-- payment-failure11.gif
    |   |-- payment-success.gif
    |   |-- payment-success.jpg
    |   |-- robots.txt
    |   |-- sadkid.gif
    |   |-- serverdown.jpeg
    |   |-- serverdown.png
    |   |-- static
    |   |   |-- css
    |   |   |   |-- 307.2e9dce54.chunk.css
    |   |   |   |-- 348.31d6cfe0.chunk.css
    |   |   |   |-- 354.f66f4b23.chunk.css
    |   |   |   |-- 376.2e288fef.chunk.css
    |   |   |   |-- 408.4ae0fefd.chunk.css
    |   |   |   |-- 473.0e2deebc.chunk.css
    |   |   |   |-- 481.c360b5e2.chunk.css
    |   |   |   |-- 519.7fadf8cd.chunk.css
    |   |   |   |-- 578.76f2db3f.chunk.css
    |   |   |   |-- 660.de896818.chunk.css
    |   |   |   |-- 694.6f33be38.chunk.css
    |   |   |   |-- 801.f82278c8.chunk.css
    |   |   |   |-- 807.1ed4ebb1.chunk.css
    |   |   |   |-- 926.322d6e5b.chunk.css
    |   |   |   `-- main.6da30c0b.css
    |   |   `-- js
    |   |       |-- 145.beebdc5c.chunk.js
    |   |       |-- 206.f8819006.chunk.js
    |   |       |-- 243.a3eca5e0.chunk.js
    |   |       |-- 289.6a2c5b64.chunk.js
    |   |       |-- 307.7a8743ad.chunk.js
    |   |       |-- 348.7ba1226a.chunk.js
    |   |       |-- 354.3dee829c.chunk.js
    |   |       |-- 355.aacb1184.chunk.js
    |   |       |-- 376.1a5073b0.chunk.js
    |   |       |-- 408.c31f6bc1.chunk.js
    |   |       |-- 473.4b1740cf.chunk.js
    |   |       |-- 481.664f4e62.chunk.js
    |   |       |-- 519.1dc50fa0.chunk.js
    |   |       |-- 578.343a0070.chunk.js
    |   |       |-- 660.27e02022.chunk.js
    |   |       |-- 694.1d53c888.chunk.js
    |   |       |-- 779.6c7dcc4e.chunk.js
    |   |       |-- 801.db765cee.chunk.js
    |   |       |-- 807.00da08e1.chunk.js
    |   |       |-- 807.00da08e1.chunk.js.LICENSE.txt
    |   |       |-- 926.20e3edc5.chunk.js
    |   |       |-- main.39daa36b.js
    |   |       `-- main.39daa36b.js.LICENSE.txt
    |   |-- support_qr.png
    |   `-- tom-and-jerry-sad.gif
    |-- start_frontend.sh
    `-- triggerRelay.py

9 directories, 70 files

This was the tree view of all the files present in it; the backend was a binary. As I like reverse engineering, I quickly thought of seeing what was inside the binary.

After spending some time I was able to extract the whole backend code.

total 184
drwxr-xr-x   17 0x1622  staff    544 Jun  3 11:51 .
drwxr-xr-x    5 0x1622  staff    160 Jun  3 11:49 ..
-rw-r--r--@   1 0x1622  staff   8196 Jun  3 14:05 .DS_Store
drwxr-xr-x    4 0x1622  staff    128 Jun  3 11:43 controllers
drwxr-xr-x    8 0x1622  staff    256 Jun  3 11:43 imageLoader
drwxr-xr-x   13 0x1622  staff    416 Jun  3 11:43 Interaction
-rw-r--r--    1 0x1622  staff  19963 Jun  3 11:43 machineAgent.js
-rw-r--r--    1 0x1622  staff  35752 Jun  3 11:43 machineAgent.js.jsc
-rw-r--r--    1 0x1622  staff   2169 Jun  3 11:43 machineState.js
-rw-r--r--    1 0x1622  staff   4200 Jun  3 11:43 machineState.js.jsc
drwxr-xr-x    8 0x1622  staff    256 Jun  3 11:43 middlewares
drwxr-xr-x  163 0x1622  staff   5216 Jun  3 11:49 node_modules
-rw-r--r--    1 0x1622  staff   1074 Jun  3 11:43 package.json
drwxr-xr-x    6 0x1622  staff    192 Jun  3 11:43 routes
-rw-r--r--    1 0x1622  staff   3907 Jun  3 13:29 server.js
-rw-r--r--    1 0x1622  staff   4072 Jun  3 11:43 server.js.jsc
drwxr-xr-x    8 0x1622  staff    256 Jun  3 11:43 src

There were around 866 directories and 8026 files in the backend.

At this point, we had obtained both the frontend and backend source code for the entire system. But the satisfaction of hacking the vending machine and getting the items for free was still missing :(

This section is dedicated to Codex, which helped me set up a complete local testing environment. With its assistance, I was able to configure the application, adapt the API endpoints to work locally, and get the entire stack running on my machine.

Basically I was able to run their whole setup locally to test for vulnerabilities.

This is how http://localhost:3000 would look like on the vending machine system.

And this was mine:

Yes, I know this does not look great, but it was more than sufficient for testing.

NOTE: The vulnerabilities mentioned below are not yet properly tested. These vulnerabilities are working locally on my laptop, but I am pretty sure they would work on the machine as well.

The first request after selecting an item and checking out is this:

It basically generates a QR in this type:

The next request continuously checks if the user has paid the money or not. On successful payment, the value of "resultStatus": "PENDING" changes to "resultStatus": "TNX_SUCESS" and "resultcode": "402" changes to "resultcode": "01".

The next request is only made if the user has paid the money:

The next request is pretty straightforward: a PUT request is sent to this endpoint to get the item dispensed.

This is the last request sent, which again is pretty straightforward and basically updates the machine on the number of items available.

While testing locally, I was able to bypass the payment and eventually get the item for free.

The vulnerability was basically that there were no checks on /api/v1/createOrderWithVendItems to verify whether the payment was made, which creates a flow that eventually gets us items for free.

Some random stuff we planned but did not do

Our initial idea was to display it across every vending machine managed by the company. However, after discussing the potential impact, we decided against it.

When Manav asked about bounty this was the reply he got

Manav's bounty discussion

Bounty offer follow-up

As a POC like my previous blog, I was not able to shoot some good video, though I will try to add a video later if possible of shutting down a vending machine remotely. edit: i am back home , did not get time to shoot one :(

Ending Note

This summer, I learned a lot about IoT and discovered many new techniques along the way. I also collaborated with several young hackers on government and private projects. You can view some of them here: 1, 2, and 3.

There are many other projects that I cannot disclose at the moment, but you can expect more technical and detailed blog posts soon :)

At this point, I have almost stopped playing CTFs and have started focusing primarily on real world security research. I am also happy to say that I earned more money this summer than I ever have before, and I will soon be starting my final year of college.

I hope you enjoyed reading my blogs. You can reach out to me anytime if you have questions about cybersecurity or need learning resources.

You can directly ask me on X/Twitter or discord (0x1622).

This is how we hacked all Vending Machines of BITS PILANI (HYDERABAD VERSION)