So, I'm a bit bored tonight... I scan my network just for fun and found out something about the unifi router.
So I tried login with root, guess the password.
login as: root
root@192.168.0.1's password:
BusyBox v1.6.1 (2013-12-23 17:22:03 HKT) built-in shell (ash)
Enter 'help' for a list of built-in commands.
Well, that is easy.
# cat /etc/shadow
#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
Looks like this password hashes have been recycled a few times in router firmware.
check it out. Not a surprise I guess. More interesting bits below:
# ps
PID USER VSZ STAT COMMAND
1 root 1584 S init
2 root 0 SW< [kthreadd]
3 root 0 SW< [ksoftirqd/0]
4 root 0 SW< [watchdog/0]
5 root 0 SW< [events/0]
6 root 0 SW< [khelper]
9 root 0 SW< [async/mgr]
74 root 0 SW< [kblockd/0]
84 root 0 SW< [khubd]
101 root 0 SW [khungtaskd]
102 root 0 SW [pdflush]
103 root 0 SW [pdflush]
104 root 0 SW< [kswapd0]
106 root 0 SW< [crypto/0]
663 root 0 SW< [mtdblockd]
726 root 4428 S /usr/sbin/mini_httpd -d /usr/www -c /cgi-bin/* -u ro
730 root 2632 S /usr/bin/pc
732 root 1588 S -/bin/sh
733 root 4964 S /usr/bin/logic
734 root 2560 S /usr/bin/ip6mon
735 root 2564 S /usr/bin/ramon
736 root 2576 S /usr/bin/ip6aac
742 root 1592 S /usr/sbin/inetd
744 root 2224 S /usr/sbin/dropbear
1412 root 2612 S /usr/sbin/pppd plugin rp-pppoe.so eth5 user
1420 root 1204 S /sbin/udhcpc -i eth8 -m 1500 -f
1534 root 1984 S /usr/sbin/dhcp6c -c /var/dhcpv6/dhcp6c_301203713 -f
1698 root 1204 S /sbin/miniupnpd -f /etc/upnpd.conf -d
1921 root 1208 S /usr/sbin/radvd -C /var/radvd.conf -d 1
1967 root 2040 S /usr/sbin/dhcp6s -c /var/dhcpv6/br0.conf -f br0
2007 root 1320 S /sbin/dproxy -c /etc/dproxy.conf -d
2124 root 1244 S /sbin/udhcpd /var/udhcpd.confge
6840 root 2280 R /usr/sbin/dropbear
6841 root 1592 S -sh
6872 root 1584 R ps
# pwd
/var/log
# cat device_info
Manufacturer: innacomm
ProductClass: RG4332
SerialNumber: RGWINNIN15********
IP: 192.168.0.1
HWVer: RTL8196C
SWVer: RG4332_V2.7.0
There is a samba config file in /etc, but when I try to connect it doesn't work. Not sure what is the purpose of it.
# cat smb.conf
[global]
workgroup = home
netbios name = dsl_route
server string = Samba Server
security = user
local master = Yes
preferred master = Yes
encrypt passwords = yes
smb passwd file = /var/smbpasswd
#private dir = /tmp/smbvar
socket options = TCP_NODELAY
wins proxy = no
log level = 10
load printers = no
guest account = root
log file = /var/log/smblog
max log size = 0
interfaces = 192.168.1.1/255.255.255.0
dns proxy = no
browseable = yes
guest ok = yes
writeable = no
display charset = utf8
unix charset = utf8
dos charset = utf8
public = yes
[usb1_1]
path = /mnt/usb1_1
writeable = yes
browseable = yes
directory mask = 0777
create mask = 0777
I'm getting sleepy, so I'll continue this next time I hope... Bai for now.
