Exploit

It is too bad if your device has a backdoor directly from the vendor. In some devices of the vendor D-Link you are able to find a nice telnet server listening on the internal network interface. The following output shows the results of a Nmap scan of three different D-Link DIR devices (DIR-300revA, DIR-300revB, DIR-600revB):


root@bt:~# nmap -sSV -p 23 192.168.178.133,144,222
Starting Nmap 6.01 ( http://nmap.org ) at 2013-04-30 13:42 CEST
Nmap scan report for 192.168.178.133
Host is up (0.0067s latency).
PORT STATE SERVICE VERSION

Welcome to the following 2 crazy weeks with lots of vulnerabilities in more than 20 different home network devices. We have quite a high number of hopefully interesting vulnerabilities in devices from different vendors like Linksys, D'Link or Netgear for you.

Today we start with a short intro video which demonstrates unauthenticated execution of OS commands on two home routers of D-Link. The D-Link DIR-300 rev B and D-Link DIR-600 are still unpatched and an attacker is able to directly compromise these devices via the web interface. You will find the advisory here.

After releasing the OS command execution vulnerability in the WRT54GL router from Linksys last week there were some requests about how could we use this vulnerability for getting a remote shell.

First off all we have to analyze the firmware a bit. For this it is best to download the original firmware from the vendor and use the firmware-modification-kit or binwalk created by Craig Heffner and Jeremy Collake. Awesome toolkit from awesome guys.

So let’s extract and analyse the firmware a bit: