Kiosk Touchscreen Terminal Hacking

There's this huge financial company in my country that's basically backed by the government. They're running everything — transport, banks, ATMs, payment terminals — total monopoly. You can't even ride a bus without having their app installed and buying a ticket through it. What really caught my attention though are their kiosk terminals. I'm almost certain they're weak as hell. I'm thinking if I can figure out the endpoint these kiosks are sending payment requests to, I could intercept or replay them. Since the payment amount is determined by the actual cash inserted into the terminal, there’s probably a way to spoof that request. If that’s possible, I could essentially trigger a kind of "infinite money" bug by mimicking the right calls.

I once triggered a kiosk to get out of its soykafty coded program by tapping the upper right edge of the screen therefore forcing the [X] that was hidden and out of screen to get out of the program Underneath it was just a dumb windows xp box, security guard saw me and I bolted This way 10 years ago tho Look for nuts, screws, bolts, any security key hole and you will find your way in probably Also have rubber ducky at hand to plug, unplug and fuarrrk off at moments notice

>>26949 PS mind you most of the payment processing is done by electronically de-coupled credit card reader that can't get hacked, even from the inside of the box communication. That is why people just make skimmers

>>26946 Just thought What OS is on this kiosk? Android? Maybe it is SO BAD that they have 5555 open port (default Android debug port). In this case just install ADB Framework (e.g. from official Android SDK) sneak in internal Wi-Fi network and run "adb devices" and if yeah, then "adb connect". All. You can do whatever you want with OS Try to do some recon. Search in google: who sells kiosk terminals, who manufactures them. Imagine, you're CEO of commerial firm and wanna buy some kiosks. Who sells them? Which way they got them? 99.99% it is not open source but recon gives some clue: which CVE for which OS could be applied. And in what conditions. Also anon above gave good advices, esp.: >>26953 And always: DO NOT GET fuarrrkING CAUGHT. Always think about cameras and security, esp. cameras! If you live in such dystopian electronic society you almost sure have a huge bunch of cameras on every step. DO NOT GET CAUGHT Sorry

>>26971 Yes I am doing the recon already, the terminal is running on a SIM card, thats how it gets the internet connection so I am pretty sure the kiosk is just an android. >>26949 It's not one of those, it does not even have a credit card reader, you basically put a money in it then select the service you want to pay (steam, bills etc...). So I am guessing the request is something like curl -X post "https://ENDPOINT" '{"service" : "steam", "value" : "$", "amount" : "100"}. IF I AM ABLE TO INTERCEPT THE REQUEST I CAN MODIFY THE AMOUNT FIELD CAUSE THE INPUT FROM THE USER ISNT BEING HANDLED CAUSE THERE IS NO USER INPUT THE AMOUNT IS DETERMINED WITH THE AMOUNT OF MONEY YOU PUT IN THE TERMINALLLLL. p.s after couple days i did some more recon and i found their android wallet app, I reversed it with jadx-gui and I am currently going through it and I LITERALLY JUST FOUND A FUNCTION CALLED IsTerminal() WHCIH BASICALLY CHECKS IF THE COMPUTER IS A TERMINAL OR JUST A NORMAL PHONE I AM ON SOMETHING LAINSSS

>>26987 I'm so happy for you! Feels like unexplainable proud. Try to search some "@GET", "@POST", "Retrofit" strings in APK. More chances to list all (the most of) usable endpoints. Well, some may not being used and maybe if you luck enough some got a bad practices of auth (Or no auth at all). Like someone after authorization puts magical hard-coded header key./value and then uses it as marker of auth. Even if you don't find such a bad practices easily, you would at least get some info about data structures (as Retrofit methods use data-class (with JSON-like structure) as input and other data-JSON-like-class as output. Wish you good luck! You are on the way of something! Keep the mood and find something cool!

>>27004 yes thank you for the tip, you can exploit the project in jadx so I did it and i am just using ripgrep to find what i need + fzf with vim which is way easier. Here is the apk file if you want to hack on your own its a third world soykafhole app so I am sure there are so many bugs that can turn you into a fuarrrking millionare without anyone ever catching you. I am so close I am one step away from a fuarrrking revolution. https://files.catbox.moe/kthffb.apk

>>27006 Congrats, but may you add them to a Tor-friendly file hoster? catbox blocks Tor exit nodes. http://kqdrhdqaqeqc3txz7uekmesz3ny6rut477657gf2y5tnwkya7nv65pid.onion/ aHR0cDovL2V0ZXJuYWxjYnJ6cGljeXRqNHp5Z3V5Z3Bta2psa2RkeG9iN3RwdGxyMjVjZGlwZTVzdnlxb3FkLm9uaW9uLwo=

>>27007 I will but just look up telcell wallet filetype: apk

>>27007 http://eternalcbrzpicytj4zyguygpmkjlkddxob7tptlr25cdipe5svyqoqd.onion/file/d4e1aced1dc8f4105aef03b6f5f4b45a51e7840d0f3668/5830c3e2f777.apk p.s drop some more onions pls hehe

>>26971 most run windows android. openvms is common very old machines.