first time post so please bear with me.
For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck.
I have a Zyxel C1100Z DSL modem that I've purchased from my ISP and I have been trying to breakdown their newest firmware in order to bypass a new shell password feature they've implemented. The past firmware did not have this feature and simply allowed you to login via ssh/telnet and then type 'sh' to drop into a simple Busybox shell.
Now with the latest firmware, SSH seems to be severely broken/buggy, as does most of the CLI commands when you login over telnet (Cat,echo,netstat,etc.. do not function)
Since this is a new feature, I have guessed that the password is either
- Hard-coded into a CLI binary
- Pulled from a configuration I have overlooked
- Pushed remotely from the ISP
So far I have extracted the root-fs using binwalk and I've scoured many hours through each configuration, running strings to no end, I even tried to emulate MIPS using QEMU.
Running file on one of the binaries gives me:
ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header size
I installed the old firmware hoping to get an idea of how the system worked and thought some of this info might prove useful:
system type : 963168MBV_17A processor : 0 cpu model : Broadcom4350 V8.0 BogoMIPS : 398.33 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 60561
I've begun decompiling binaries using https://retdec.com/decompilation/ but that has't gotten me very far.
I have hosted the extracted firmware root in a git repo at https://github.com/bwbryant1/CTL_C110Z
I'm not asking for someone to do all of the work for me, mostly just some guidance as this is my first-attempt at reverse-engineering. Yes I have looked at past tutorials but none of the fit my firmware specifically and I have hit a brick wall.
How does one add a password to a shell? I know you can with inittab but it doesn't seem like that is what they are doing. I have no idea where the shell password prompt gets called from but I do know the text for it is stored inside /lib/private/libcms_cli.so. But I am not sure what this is.
Edit for clarification: I have ssh and telnet access but they do not give you access to the root-fs. It drops you into a kind of chrooted environment with limited capabilities. However, by typing "sh" you are prompted with "Please type in shell password:" and it doesn't ask for a username, only a pass