Download as PDF, PPTX
Uploaded byTim N
ifwt remote (sydney ruxmon edition)
This document summarizes how to exploit vulnerabilities in fixed wireless terminals to remotely root the devices. It describes examining the hardware components and boot process to find entry points. Exploits discussed include using removable media to gain root access, cracking weak passwords, and exploiting unpickle serialization and remote code execution via eval. A demonstration shows using these techniques to remotely root a terminal via its management interface and UDP vulnerabilities. Potential further attacks discussed include installing backdoors, intercepting data and calls, and creating botnets.
More Related Content
![[ENG] IPv6 shipworm + My little Windows domain pwnie](https://cdn.slidesharecdn.com/ss_thumbnails/prez-120915051946-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
ifwt remote (sydney ruxmon edition)
- 1. Device inspection To remoteroot Uncovering thesekritz of proprietary software on a fixed wireless terminal and weap0nizing them into a remote exploit Where What Who Ruxmon Melbourne Device Inspection to remote root Tim Noise
- 2. tIMNOISE • twitter/dnoiz1 • github/dnoiz1 •mIRC/dnz • streetz/notorious D N Z • tim@drkns.net Internet subscriber and pirate impersonator
- 3. FixedWirelessTerminals • Linux Based •System on Chip • Provide PoTS and ADSL • 3G/LTE Backhaul • Battery and Solar • Remote Managed • Deployed in Clusters For people without copper or fiber
- 4. ExternalConnectors • Ether overUSB (DHCP) • Aerial socket • 2 RJ11 ports for ADSL CPE and PoTS Things we can probe
- 5. ExternalConnectors • SIM Cardslot • 2 Management Ethernet Ports (NO DHCP) • 2 RJ11 power management ports Things we can probe
- 6. WhatsInside?Rub the torxand the genie comes out CPU NAND0 NAND1 UART Removable CF Card for /
- 7. WhatsInside?Rub the torxand the genie comes out Mini PCMCIA 3G Modem
- 8. BootProcessRedboot the buspirate,yarr GND RX TX VCC / NC
- 9. redboOTcatching a bootloader • is listening on hardcoded TCP port + Interface preboot • holds variables that contain boot parameters
- 10. GainingROOTalways want thatuid 0 - the usual tricks • Removable root Media • hashcat / jtr • kernel paramaters • init=/bin/sh • single user mode • Lucky for us, the root password is printed on the PCB (not even joking)
- 11.
- 12. LoggingINConnecting using themanagement USB interface
- 13. PortsANDProcessessWhats running onthis thing?
- 14. PortsANDProcessessWhats running onthis thing?
- 15. PortsANDProcessessWhats running onthis thing?
- 16. BacktotheSourceWhere is thisprocess stored and launched from
- 17. DECOMPYLEUsing multiline stringsas comments is great!
- 18. Vulnerability1:UNPICKLESerializing objects itsso convenient for passing them over a udp socket
- 19. Vulnerability1:UNPICKLESerializing objects itsso convenient for passing them over a udp socket
- 20. Vulnerability1:UNPICKLESerializing objects itsso convenient for passing them over a udp socket
- 21. Vulnerability1:UNPICKLESerializing objects itsso convenient for passing them over a udp socket
- 22. Vulnerability1:UNPICKLESerializing objects itsso convenient for passing them over a udp socket
- 23. Vulnerability2:evalEvaling a concatenatedstring is a good way to check if its a member of an enum
- 24. PuttingitallTogethermaking use ofour discovered vulnerabilities
- 25. PuttingitallTogethermaking use ofour discovered vulnerabilities
- 26. PuttingitallTogethermaking use ofour discovered vulnerabilities
- 27. PuttingitallTogethermaking use ofour discovered vulnerabilities
- 28.
- 30.
- 31. OneStepFURTHER • Connect backpayloads • Dial 1900 numbers for profit • UDP broadcast the attack • Intercept data and telephony • Insta-botnet / onion network • Other bad things For internet bad men
- 32.
- 33. tIMNOISE • twitter/dnoiz1 • github/dnoiz1 •mIRC/dnz • streetz/notorious D N Z • tim@drkns.net Internet subscriber and pirate impersonator