Firmware Hero
0

ya-station-root-shell

Root shell on a Yandex Station Mini 2 from your laptop — no disassembly, no soldering, five minutes on the same Wi-Fi.

  • Root exploit
  • Alpha
  • Low brick risk
  • Reversible

Source code

This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it

Before you start

How hard is it?
HardUses the command line or developer tools.
What you need
  • Comfort with the command line
  • A computer
Can it break my device?
Very unlikely to break anything.
Can I undo it?
Yes. You can go back to the official software.
Get itOpens github.com

Did it work for you?

Did ya-station-root-shell work on your Yandex Station?

No reports yet.

One-tap reports from owners. Bricked reports are checked before they count.

Compatibility

Devices: Yandex Station.

No compatibility information yet.

Getting started

From the project's README ("Quick start (attacker side, macOS)"):

All scripts run from a machine on the same network. The station needs a power cycle to re-run its boot sync.

sudo python3 poc/dns-spoof.py # answers quasar.yandex.net → your IP sudo python3 poc/fake-quasar.py 443 # serves the forged cert + config ./poc/grab-shell.sh # polls :5555, grabs root shell

The forged server certificate and CA key are not included in this repo — the CA key is already public (see the Fluepke/emudrahahahahaha repository and the Mozilla Bugzilla entry). Generate your own leaf cert from that key to reproduce.

Read the full instructions

Risk and recovery

Brick risk
Low
Reversible
Yes
Requires opening the device
No

From the project's README ("Defending your own station"):

  • The attack requires LAN presence: put IoT/untrusted devices on a separate SSID/VLAN, or at minimum isolate the speaker.
  • Cert pinning or DNSSEC on the device is the firmware-level fix (proposed in the report to Yandex).
  • If you already have root: /etc/init.d/ is editable after a remount — but an OTA update reflashes the rootfs, so freeze updates before customizing (and know how to restore the stock OTA binary when you're done).

Read the full instructions

Credits, license and support

License
MIT