I was playing with a
Dynalink RTA 230 (http://www.dynalink.co.nz/products/rta230.htm), a linux
based mips-cored adsl router. Looking at embedded linux system, i've found
something like a backdoor:

# cat /etc/passwd
admin:xxxxx(obscured)xxxxx:0:0:Administrator:/:/bin/sh
userNotUsed:YNf8oSCwK/0/Y:0:0:Technical Support:/:/bin/sh

Then forced the pass with John:

root@sbongaz:~/john-1.6/run# ./john passwd -show
userNotUsed:userNotU:0:0:Technical Support:/:/bin/sh

the first user is the administration account also used by http config center;
the second entry in passwd is not visible or modificable from the user config
center. Luckly access to the http config center and telnet shell is blocked
(not enabled by default) from outside the lan.

Many other adsl routers use the same chip/os, but 'ive no hardware to test it:
Us Robotics 9105 (without wireless) and 9106 (with wireless)
Siemens SE515 (to be confirmed)
Buffalo WMR-G54 (to be confirmed ; it might be a different chipset, but the
firmware format looks the same)

For further references, take a look at
http://skaya.enix.org/wiki/BroadCom96345

[ reply ]