bugtraq - Dynalink routers backdoor?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 3 Sep 2004 00:25:49 +0000
From: fabio <ctrlaltca@...ero.it>
To: bugtraq@...urityfocus.com
Subject: Dynalink routers backdoor?

I was playing with a 
Dynalink RTA 230 (http://www.dynalink.co.nz/products/rta230.htm), a linux 
based mips-cored adsl router. Looking at embedded linux system, i've found 
something like a backdoor:

# cat /etc/passwd
 admin:xxxxx(obscured)xxxxx:0:0:Administrator:/:/bin/sh
 userNotUsed:YNf8oSCwK/0/Y:0:0:Technical Support:/:/bin/sh

Then forced the pass with John:

root@...ngaz:~/john-1.6/run# ./john passwd -show
userNotUsed:userNotU:0:0:Technical Support:/:/bin/sh

the first user is the administration account also used by http config center; 
the second entry in passwd is not visible or modificable from the user config 
center. Luckly access to the http config center and telnet shell is blocked 
(not enabled by default) from outside the lan.

Many other adsl routers use the same chip/os, but 'ive no hardware to test it:
Us Robotics 9105 (without wireless) and 9106 (with wireless)
Siemens SE515 (to be confirmed)
Buffalo WMR-G54 (to be confirmed ; it might be a different chipset, but the 
firmware format looks the same)

For further references, take a look at 
http://skaya.enix.org/wiki/BroadCom96345