search

anitsh / til

Today I Learn (til) - Github `Issues` used as daily learning management system for taking notes and storing resource links.
https://anitshrestha.com.np
MIT License
77 stars 11 forks source link

Security Analysis of Nokia G-120W-F #99

Open anitsh opened 4 years ago

anitsh commented 4 years ago

Objectives

  • [ ] Remove users
  • [ ] Change the default password for CLI access
  • [ ] Find other vulnerabilities

Later TODO Upgrade Firmware

Device Infromation: Device Name G-120W-F Vendor Nokia Serial Number ALCLFA5733B8 Hardware Version 3FE46921BAAA Boot Version U-Boot Dec-31-2016--12:00:00 Software Version 3FE46606DFHB46 Chipset MTK7526FD OS Zebra, vty shell

How the issue come to be? Issue

Resources:

Tools:

anitsh commented 4 years ago

Could not access shell. The default and web passwords does not allow shell access. There are not much information from web search.

After login with AdminGPON, the user user does not have previledges to update users.

Findings https://linux.die.net/man/8/zebra http://www.nongnu.org/quagga http://www.nongnu.org/quagga/docs/quagga.html#Config-Commands https://linoxide.com/ubuntu-how-to/configure-quagga-routing-suite-linux https://usermanual.wiki/Nokia-Bell/G120WF/html https://opensource.com/article/20/5/vty-shell http://www.pacs.agh.edu.pl/wfitj/complab/doc/Quagga/VTY-shell.html https://opensource.com/article/20/4/quagga-linux

Quagga daemons are each configurable via a network accessible CLI (called a 'vty'). The CLI follows a style similar to that of other routing software.

anitsh commented 4 years ago

image

espetoet commented 4 years ago

Hello, how are you. I have one of the same model. you managed to access the shell

anitsh commented 4 years ago

@espetoet, If you are talking about 'user>shell', then I am still not able to access it.

I was working on it yesterday but could not find anything. Neither a way to upgrade the router's firmware. If you have found any resources. Kindly, please do share. Thank you.

anitsh commented 4 years ago

Yesterday's note:

Some research on Shell

There was issue with ether net, resolved with https://askubuntu.com/questions/394217/my-eth0-has-gone-and-i-dont-have-internet-and-network-connection 1 - sudo service network-manager stop 2 - sudo ifconfig enp4s8 up to bring up the interface 3 - Then, force Ubuntu to ask for a new DHCP lease by sudo dhclient enp4s8 4 - Manually did sudo service network-manager start *This is when i got the connection to the network. There was issue after disconnecting the cable with internet connection again, resolved it with sudo dhclient enp4s8

espetoet commented 4 years ago

Hello again. by chance you have the modem firmware. factory firmware

833M0L3 commented 4 years ago

Hello @codeanit , you can access the full shell with Telnet or SSH. Export the config file of the router and modify it's content and set LimitAccount_ONTUSER to false. Upload the modified config file back to the router and use the credentials ONTUSER:SUGAR2A041 to login into SSH or Telnet with full root permission. Follow this guide to decode the config file https://0x41.cf/reversing/2019/10/08/unlocking-nokia-g240wa.html

Don't forget to read the comments from here : https://gist.github.com/thedroidgeek/80c379aa43b71015d71da130f85a435a

Info about the credentials : https://www.tenable.com/security/research/tra-2019-09

QiiioW commented 3 years ago

Hello @codeanit , you can access the full shell with Telnet or SSH. Export the config file of the router and modify it's content and set LimitAccount_ONTUSER to false. Upload the modified config file back to the router and use the credentials ONTUSER:SUGAR2A041 to login into SSH or Telnet with full root permission. Follow this guide to decode the config file https://0x41.cf/reversing/2019/10/08/unlocking-nokia-g240wa.html

Don't forget to read the comments from here : https://gist.github.com/thedroidgeek/80c379aa43b71015d71da130f85a435a

Info about the credentials : https://www.tenable.com/security/research/tra-2019-09

After login with AdminGPON, the user user does not have previledges to update users.

tarekkabalan commented 3 years ago

where to buy Onu Nokia Model G 120w F online

gr455 commented 2 years ago

@espetoet, If you are talking about 'user>shell', then I am still not able to access it.

I was working on it yesterday but could not find anything. Neither a way to upgrade the router's firmware. If you have found any resources. Kindly, please do share. Thank you.

The Password2 prompt after user>shell is vulnerable to command injection. Inputting '; /bin/sh; # would pop a root shell

Tested on: Device Name: G-2425G-A Vendor: Nokia Hardware Version: 3FE48299DDAA Boot Version: U-Boot Dec-31-2016--12:00:00 Software Version: 3FE49362IJHK29 Chipset: MTK7528

neelabhraman commented 2 years ago

When connecting via telnet login with below cred username:ONTUSER Password:SUGAR2A041

It gives root access directly without going to shell image

Source:

  1. above discussion https://github.com/codeanit/til/issues/99#issuecomment-673031084
  2. https://www.websec.ca/publication/Blog/backdoors-in-Zhone-GPON-2520-and-Alcatel-Lucent-I240Q
neelabhraman commented 2 years ago

Question:

What to do after gaining root access ?? I was hoping to flash a new firmware in the NOKIA router hardware so that it can be used as a repeater (given that it doesn't have internet LAN INPUT hence cannot be used with other ISP's as a router)

Kalyan-M commented 2 years ago

Question:

What to do after gaining root access ?? I was hoping to flash a new firmware in the NOKIA router hardware so that it can be used as a repeater (given that it doesn't have internet LAN INPUT hence cannot be used with other ISP's as a router)

You can execute scfgtool set OperatorID MXXV to unlock many webUI elements including pppoe credentials. scfgtool is present in /usr/exe

Albonycal commented 2 years ago

just discovered this issue.. the command injection isn't working after a new update ( also I didn't knew this issue was public) Software Version: 3FE49362IJHK46 fixes the command injection.. I'll try messing with the config

amitgorai commented 10 months ago

@espetoet, If you are talking about 'user>shell', then I am still not able to access it. I was working on it yesterday but could not find anything. Neither a way to upgrade the router's firmware. If you have found any resources. Kindly, please do share. Thank you.

The Password2 prompt after user>shell is vulnerable to command injection. Inputting '; /bin/sh; # would pop a root shell

Tested on: Device Name: G-2425G-A Vendor: Nokia Hardware Version: 3FE48299DDAA Boot Version: U-Boot Dec-31-2016--12:00:00 Software Version: 3FE49362IJHK29 Chipset: MTK7528

Hi bro same device I have with same configuration , and backup and restore option not showing , Help me to solve my issue

833M0L3 commented 10 months ago

@amitgorai What's your Hardware Version and Boot version? The current CPEs used by Wlink have been updated with a new system. Every CPE now has a uniquely generated username and pass. And those command injection and ONTUSER backdoor account has already been removed on the latest BOOT version.

amitgorai commented 10 months ago

@amitgorai What's your Hardware Version and Boot version? The current CPEs used by Wlink have been updated with a new system. Every CPE now has a uniquely generated username and pass. And those command injection and ONTUSER backdoor account has already been removed on the latest BOOT version.

Device Name: G-2425G-A Vendor: Nokia Hardware Version: 3FE48299DDAA Boot Version: U-Boot Dec-31-2016--12:00:00 Software Version: 3FE49362IJHK29 Chipset: MTK7528

amitgorai commented 10 months ago

@amitgorai What's your Hardware Version and Boot version? The current CPEs used by Wlink have been updated with a new system. Every CPE now has a uniquely generated username and pass. And those command injection and ONTUSER backdoor account has already been removed on the latest BOOT version.

Actually I was not using this router from last one year ,, I tried to use it on my existing wifi connection yesterday then I got to know ... It's fully locked...

amitgorai commented 10 months ago

@espetoet, If you are talking about 'user>shell', then I am still not able to access it.

I was working on it yesterday but could not find anything. Neither a way to upgrade the router's firmware. If you have found any resources. Kindly, please do share. Thank you.

The Password2 prompt after user>shell is vulnerable to command injection. Inputting '; /bin/sh; # would pop a root shell

Tested on: Device Name: G-2425G-A Vendor: Nokia Hardware Version: 3FE48299DDAA Boot Version: U-Boot Dec-31-2016--12:00:00 Software Version: 3FE49362IJHK29 Chipset: MTK7528

Hi @833M0L3 where I can use this password2 ??

833M0L3 commented 10 months ago

@amitgorai what are you trying to achieve? If you want the admin access then try going into http://192.168.1.254/su.html and use

This should work if you haven't used your router for a long time since the change started happening recently. That is ofcourse if you are a wlink user. I have no idea about others.

amitgorai commented 10 months ago

@amitgorai what are you trying to achieve? If you want the admin access then try going into http://192.168.1.254/su.html and use

  • Username : wlinkuser
  • Password : 35wl#Login465

This should work if you haven't used your router for a long time since the change started happening recently. That is ofcourse if you are a wlink user. I have no idea about others.

Hi @833M0L3 Yes I want su access of my Device Name: Nokia G-2425G-A And yes I was not using from last one year ... Then yesterday I tried to use with my isp ..then I got to know its fully locked ( backup and restore option also not visible ) , then I Googled and came to this post as I can see @gr455 post the device he had , I have the same, but as he mentioned that if I use his given password in Password2 section I can get root access , so I want to know where I can use this password...

833M0L3 commented 10 months ago

@amitgorai If you meant the telnet access , you can do that from windows terminal or using PUTTy. On the terminal enter telnet 192.168.1.254 .

But since you have connected your router to the ISP , I am sure a lot of config has been changed and I am sure telnet/ssh are disabled by default. But give it a try. If you don't know how telnet and ssh works , try googling it.

daley1323 commented 5 months ago

Did you progress

parthnagdev commented 1 month ago

just discovered this issue.. the command injection isn't working after a new update ( also I didn't knew this issue was public) Software Version: 3FE49362IJHK46 fixes the command injection.. I'll try messing with the config

@Albonycal How did you update the firmware? Do you have the link to website where the update firmware is available?