8

first time post so please bear with me.

For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck.

I have a Zyxel C1100Z DSL modem that I've purchased from my ISP and I have been trying to breakdown their newest firmware in order to bypass a new shell password feature they've implemented. The past firmware did not have this feature and simply allowed you to login via ssh/telnet and then type 'sh' to drop into a simple Busybox shell.

Now with the latest firmware, SSH seems to be severely broken/buggy, as does most of the CLI commands when you login over telnet (Cat,echo,netstat,etc.. do not function)

Since this is a new feature, I have guessed that the password is either

  1. Hard-coded into a CLI binary
  2. Pulled from a configuration I have overlooked
  3. Pushed remotely from the ISP

So far I have extracted the root-fs using binwalk and I've scoured many hours through each configuration, running strings to no end, I even tried to emulate MIPS using QEMU.

Running file on one of the binaries gives me: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header size

I installed the old firmware hoping to get an idea of how the system worked and thought some of this info might prove useful:

system type             : 963168MBV_17A
processor               : 0
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 398.33
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
unaligned exceptions            : 60561

I've begun decompiling binaries using https://retdec.com/decompilation/ but that has't gotten me very far.

I have hosted the extracted firmware root in a git repo at https://github.com/bwbryant1/CTL_C110Z

I'm not asking for someone to do all of the work for me, mostly just some guidance as this is my first-attempt at reverse-engineering. Yes I have looked at past tutorials but none of the fit my firmware specifically and I have hit a brick wall.

How does one add a password to a shell? I know you can with inittab but it doesn't seem like that is what they are doing. I have no idea where the shell password prompt gets called from but I do know the text for it is stored inside /lib/private/libcms_cli.so. But I am not sure what this is.

Thank you

Edit for clarification: I have ssh and telnet access but they do not give you access to the root-fs. It drops you into a kind of chrooted environment with limited capabilities. However, by typing "sh" you are prompted with "Please type in shell password:" and it doesn't ask for a username, only a pass

  • Brandon, if you figure out a shell password, please post same. I'm currently not able to call up a shell in a Zyxel C2100Z modem, which is distributed exclusively (as far as I can tell) by CenturyLink – Digger Jun 17 '17 at 3:44
  • try supervisor:zyad1234 – Brandon Bryant Jun 17 '17 at 5:47
  • After logging into the modem's console (via SSH) using my personal username/password combo, I attempted to get a shell up. I tried the following passwords: supervisor:zyad1234 and zyad1234. Neither one worked. I then backed out of the console and tried logging in using the username supervisor and the password zyad1234 with no joy. I then tried logging in using a username of admin and the password 1234. I then got the message Connection closed by 192.168.0.1. Now, I can't get back in, even with my personal username/password... – Digger Jun 17 '17 at 22:15
  • I think from what I've learned there is a 15 minute timeout after 3-4 failed logins – Brandon Bryant Jun 17 '17 at 23:56
  • Yeah, Brandon, I tried logging in after a 2 two hour wait and got back in. Still can't figure out the shell password, though... – Digger Jun 18 '17 at 1:04
4

The password seems to be generated dynamically from /etc/profile

...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,supervisor,support,user" > /var/group
...

You would need to try to crack the DES hash with a program like John the Ripper or replace it with another known password or nothing.

  • Thank you for looking into this, cimarron. I did crack that password, it gave me supervisor:zyad1234 unfortunately its not accepting this user/pass combo on ssh or telnet. I still haven't reset to factory and tried the credentials. There could some configuration being overwritten or this might be deprecated – Brandon Bryant Jun 17 '17 at 5:47
  • 1
    It appears there is another generated one in /etc/miniboot.sh: echo 'admin:tP2w1wFvu8GXo:0:0:Administrator:/:/bin/sh' > /var/passwd which is just a username of admin and password 1234. Have you already tried that one? – cimarron Jun 17 '17 at 7:10
  • Yeah. I've cracked everything that's in plaintext and unfortunately none of them work. Thank you! – Brandon Bryant Jun 17 '17 at 23:56
  • 1
    I see your issue now. Sorry, I thought your problem was in the login but your edit cleared it up. It does indeed look like libcms_cli.so is responsible for the additional password prompt. I did a little reversing and found it seems to just do a plaintext password comparison of what you enter with a password it gets from somewhere; I didn't spend too much time trying to figure it out but it comes from some cmsobject. Anyway, you should be able to patch address 0x617c to a nop instruction (00 00 00 00) previously a bnez v0, 0x6194 (14 40 00 05) which should bypass the string unequal comparison – cimarron Jun 18 '17 at 7:52
  • Awesome thank you! I believed I was on the right track, I just had no idea how to begin decoding the MIPS assembly. Now to just get that file uploaded to a read only filesystem. I requested the source code from zyxel under GPL requests and once I get that I should (hopefully) be able make my own firmware update. In the mean time, the firmware mod kit, FMK, doesn't have support for extracting and then rebuilding jffs2 images so I'm going to have to try on my own with the mkfs.jffs2 command. Again thank you, that helps me out tremendously – Brandon Bryant Jun 18 '17 at 9:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.