Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[zcutlip]

I had a breakthrough yesterday.  I don't want to share details just yet, but hopefully I'll have something good over the weekend or early next week.

Just FYI: my goal, is to get an interactive shell on a live device.  I think that should be useful.  I want to be sure no one has accomplished this already.  Please let me know if we can do this already and I missed it somehow.

[SecTSys]

I haven't seen or heard any mention of this as of yet on the HH3 B so That is great news.

[burakkucat]

I had a breakthrough yesterday.

That is excellent news, Zach. Like STS, I am unaware of anyone else making any developments.

hopefully I'll have something good over the weekend or early next week.

 

[SecTSys]

hopefully I'll have something good over the weekend or early next week.

Indeed

[zcutlip]

Just a quick status update. I've had a few minor successes, but so far I still don't have access.

I've spent many hours disassembling the executables and libraries in IDA Pro[1], and most of the code on this device is very robust.  I'm not seeing the low-hanging fruit that we find on many vendors' products.

However I did find one program that looks fairly promising, if I can get it running in a debugger.

I'll update again when I know more.

[1] None of which would be possible without asbokid's dump of the root filesystem. Nice work.

[SecTSys]

I've spent many hours disassembling the executables and libraries in IDA Pro[1], and most of the code on this device is very robust.  I'm not seeing the low-hanging fruit that we find on many vendors' products.

It seems that the HH3.0 B is quite a secure router then in comparison to typical routers such as netgear, which boosts my confidence on using the HH3.0 B

I do however wish to add another task to the process.

Is it possible to get into the Router in order to add a blocklist for example if i wanted to block Chinese IP addresses at the router, - I will check to see if this is possible at the modem, but basically to have this feature on a router i feel is essential. and my FTP servers been getting a lot of attention lately from Chinese IP's.

my ESET Firewall and the Titan FTP Server i have are more than capable of handling it and all ip Addy's that attempt and fail are blocked instantly. but I would rather they were not coming into my network at all. hence adding the ability to block things at the router level, so that it will just drop the packets from said IP Addresses rather than forward them.

[zcutlip]

It seems that the HH3.0 B is quite a secure router then in comparison to typical routers such as netgear, which boosts my confidence on using the HH3.0 B

Agreed.  Though it does carry on quite a bit of business with the mothership, the details of which aren't visible to the user.

I do however wish to add another task to the process.

Is it possible to get into the Router in order to add a blocklist for example if i wanted to block Chinese IP addresses at the router, - I will check to see if this is possible at the modem, but basically to have this feature on a router i feel is essential. and my FTP servers been getting a lot of attention lately from Chinese IP's.

That shouldn't be a problem, once we have interactive shell access (as root).  However, one of my minor successes (which I was initially very excited about) is that I have been able to decrypt and re-encrypt/re-sign the device's configuration backup file.  I can make changes to the configuration and upload the modified backup file via the web interface's configuration restore facility.  Unfortunately, as far as I can tell, there aren't any settings that can be modified in the backup file that aren't already exposed via the web interface. :-(  I was hoping there would be hidden settings that could be tweaked.  Sadly, I don't see any way to block IPs or IP ranges by modifying and uploading the config file or through the web interface.

You can see for yourself by running strings on the configuration management library, and grepping for "BackupFile":
strings bthh3.0b-rootfs/lib/libcfmapi.so | grep BackupFile
This reveals the XML tags in the encrypted backup file that get transformed to and from the device's running XML configuration.

I do have some of the device's code running in QEMU and am debugging it in IDA Pro's debugger.  Hopefully this analysis will expose additional attack vectors.

I'll keep you posted as I know more.

Cheers.

[SecTSys]

your a gentleman and a scholar zcutlip.

keep up the good work - i am going to have a look at those files you just mentioned!

[btsimonh]

zcutlip: looks like fantastic work so far.  pls drop an occasional post in PSIDOC to keep the community up to date.

Can I get that root filesystem/flash dump complete anywhere?  And the config file encrypt/decrypt code? (email me if you'd rather not post it...)
(got them now ).


btsimonh

[btsimonh]

has anyone seen a firmware upgrade image for the v3b?

s

[zcutlip]

has anyone seen a firmware upgrade image for the v3b?

s

I know I haven't.  It's tricky since the device updates itself[1] from the mothership automatically and in the background.  However if I can get a root shell on it, it should be possible to let it receive the firmware image but disable the actual updating step.  Then snag the image off the device.  At least that's what I'm hoping to do.

I suspect the image is signed and possibly encrypted.  It will be interesting to see how it's signed/encrypted and if there are any weaknesses there.

Zach

[1] Or are updates pushed to it via TR-069 CPE management? Hard to say at this point.  I've messed around a bit with emulating BT infrastructure and proxying HTTP requests between BT[2] and the device to analyze the conversation, but I haven't gotten far into that just yet.

[2] A fun trick since I'm not in the UK and don't have BT service. ;-)

[SecTSys]

yeah i see what you mean there - i couldn't get anywhere with the backup files - and there was no hidden settings or anything that I could see either... 

Other than that you lot are working at a level much higher than my Pay grade - so i think as of now - i will still look at and poke about with things you all find. - but there really isn't much i can do here...

If i do find anything i will let you know but...

Happy Hacking people!

[snadge]

just want too further reiterate a thanks for everything your doing on cracking the BTHH3B 

[zcutlip]

I'm happy to help.  This is a fun project, and I'm learning a bunch along the way. Thanks to SecTSys for inviting me to play along.

[SecTSys]

Gah - No worries Zcutlip, - when i saw you featured on the Hak5 show - and saw the work you did, - and half knowing that everyone here including myself was a little bit stumped on this i thought what would proove a betteer challenge than this for you.

I hope i was right!