Device inspection to remote root
•
0 likes•8,774 views
Tim Noise - Ruxmon 31/07/15 calyptech fixed wirelress terminal exploit source code: https://github.com/dnoiz1/ifwt-remote-root/blob/master/pwrtropic.py
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (17)
Similar to Device inspection to remote root
Similar to Device inspection to remote root (20)
Recently uploaded
Recently uploaded (20)
Device inspection to remote root
- 1. Device inspection To remoteroot Uncovering the sekritz of proprietary software on a fixed wireless terminal and weap0nizing them into a remote exploit Where What Who Ruxmon Melbourne Device Inspection to remote root Tim Noise
- 2. tIMNOISE • twitter/dnoiz1 • github/dnoiz1 • mIRC/dnz • streetz/notorious D N Z • tim@drkns.net Internet subscriber and pirate impersonator
- 3. FixedWirelessTerminals • Linux Based • System on Chip • Provide PoTS and ADSL • 3G/LTE Backhaul • Battery and Solar • Remote Managed • Deployed in Clusters For people without copper or fiber
- 4. ExternalConnectors • Ether over USB (DHCP) • Aerial socket • SIM Card slot • 2 RJ11 ports for ADSL CPE and PoTS Things we can probe
- 5. ExternalConnectors • SIM Card slot • 2 Management Ethernet Ports (NO DHCP) • 2 RJ11 power management ports Things we can probe
- 6. WhatsInside?Rub the torx and the genie comes out CPU NAND0 NAND1 UART Removable CF Card for /
- 7. WhatsInside?Rub the torx and the genie comes out Mini PCMCIA 3G Modem
- 8. BootProcessRedboot the buspirate, yarr GND RX TX VCC / NC
- 9. GainingROOTalways want that uid 0 - the usual tricks • Removable root Media • hashcat / jtr • kernel paramaters • init=/bin/sh • single user mode • Lucky for us, the root password is printed on the PCB (not even joking)
- 12. LoggingINConnecting using the management USB interface
- 13. PortsANDProcessessWhats running on this thing?
- 14. PortsANDProcessessWhats running on this thing?
- 15. PortsANDProcessessWhats running on this thing?
- 16. BacktotheSourceWhere is this process stored and launched from
- 17. DECOMPYLEUsing multiline strings as comments is great!
- 18. Vulnerability1:UNPICKLESerializing objects its so convenient for passing them over a udp socket
- 19. Vulnerability1:UNPICKLESerializing objects its so convenient for passing them over a udp socket
- 20. PuttingitallTogethermaking use of our discovered vulnerabilities
- 21. PuttingitallTogethermaking use of our discovered vulnerabilities
- 22. PuttingitallTogethermaking use of our discovered vulnerabilities
- 23. PuttingitallTogethermaking use of our discovered vulnerabilities
- 24. DEMO
- 26. OneStepFURTHER • Connect back payloads • Dial 1900 numbers for profit • UDP broadcast the attack • Intercept data and telephony • Insta-botnet / onion network • Other bad things For internet bad men
- 27. QUESTIONS?
- 28. tIMNOISE • twitter/dnoiz1 • github/dnoiz1 • mIRC/dnz • streetz/notorious D N Z • tim@drkns.net Internet subscriber and pirate impersonator