router penetration and overcoming

Greetings,

I have recently received an offer from a friend of my to test his home network for topmost security, so that I could gain further practice on security penetration and himself in security penetration prevention. Old news and a peice of cake, until I discovered he had a router. Now, only a few of you that speak to me off of AO may know that a router is my bane of security penetration. I see no possible way to crack a router, although I know it can be done and has been done. My point is this: What methods and tactics do you all use to bypass router protection (this would go for firewalls too) so that you can either A: remove the router completely out of the equasion .. or B: craft packets well enough to control the network with the router still active.

Any thoughts or suggestions? I figure it is time I learn this aspect of security for a change, rather than throw my hands up everytime a router (or software firewall) comes into the game plan. My thank in advance for your ideas. Right now I'm currently running a good old nmap -sS -P0 -v -D decoy1,decoy2,.....decoy13 -T Sneaky hisip so I'm hoping he left the configuration port open.

regards,
Pooh Sun Tzu

Find out what router/firewall he's using and research for vulnerabilities about that router/firewall. Hopefully his router is not fully patched up yet...so you might get lucky :)

Yes, most routers are just hardware running a sofware/firmware operating system.

Some of them will run a varient of *nix. (Surprise!).

However, some of them are propritary (Cisco IOS).

Just like any other software... a router can have flaws that allow you to disable, bypass or take control of. It just depends on which router and how up to date it is... like cybr1d pointed out.

If the user has no ports open on their router... then you don't have much choice but to attack the router... or use social eng. to get them to let you in... (surprise package... etc.)

For example: I have my router configured to allow remote users (read myself) to certain services from certain subnets/ip addresses. If someone else tries to access it and they are not in the allowed addresses... then they will be denied. They'd then have to find out which ip addresses are allowed... and proxy to match it. Good luck...

It won't do you much good to "disable" a router... because that is the gateway in and out of the network.
Good for DoS... but not for penetration testing.

Just as an example... look at this "exploiting cisco routers" article...

Part 1
Part 2

Thanks a ton for the information so far guys. phishy, so in short, if all the ports are shut off and set to deny, I would either have to proxy (tunnel? confused) my way in by acting as an allowed IP address... otherwise I'm SOL for penetration?

Quote:

---

Originally posted here by pooh sun tzu
Thanks a ton for the information so far guys. phishy, so in short, if all the ports are shut off and set to deny, I would either have to proxy (tunnel? confused) my way in by acting as an allowed IP address... otherwise I'm SOL for penetration?

---

On my config, yes. But some routers (like home linksys routers) and the such don't allow you to filter by ip address. They will just forward prots. I'm using ACLs (access control lists)... so I can set who and what has access to where. Not every router will allow this. You'd either have to find a flaw in the IOS that I'm using... or find some way to access my network tunneling through some proxy... or go to the site that I've allowed.

Or, you might be able to trick me into downloading a program you've created... that will "call home" and give you access... ;)

Quote:

---

Originally posted here by pooh sun tzu
Thanks a ton for the information so far guys. phishy, so in short, if all the ports are shut off and set to deny, I would either have to proxy (tunnel? confused) my way in by acting as an allowed IP address... otherwise I'm SOL for penetration?

---

Most of the stuff I have seen are mainly to DOS the router. I have been doing a little research since Cybrid challenged me to see if I could do something to his router and firewall. (Of course I have only been looking at one or two brands of routers exploit links) A lot depends on whether they have updated firmware or not, since most of the info I am finding seems a bit dated. (6-12 months old)

Quote:

---

Or, you might be able to trick me into downloading a program you've created... that will "call home" and give you access...

---

A trojan for instance would make perfect sense, but wouldn't that depend upon the ruleset for outgoing on the router? Even if I told it to form up on port 79, the router would still have to allow it. Not sure how that would help incalling home, unless the router didn't have outgoing rulesets...

Quote:

---

I have been doing a little research since Cybrid challenged me to see if I could do something to his router and firewall.

---

Any information either of you find, if you could post the results and how-you-did-it's here, that would be amazing :)

Quote:

---

Originally posted here by pooh sun tzu

Any information either of you find, if you could post the results and how-you-did-it's here, that would be amazing :)

---

I will post it if I find anything. Just gotta get some tie over the weekend to do some looking.

Quote:

---

A trojan for instance would make perfect sense, but wouldn't that depend upon the ruleset for outgoing on the router? Even if I told it to form up on port 79, the router would still have to allow it. Not sure how that would help incalling home, unless the router didn't have outgoing rulesets...

---

Or what about something that you send (like a trojan) that would modify the router settings? User opens .exe - then exe exploits router from the inside and opens ports.

Quote:

---

Originally posted here by pooh sun tzu
A trojan for instance would make perfect sense, but wouldn't that depend upon the ruleset for outgoing on the router? Even if I told it to form up on port 79, the router would still have to allow it. Not sure how that would help incalling home, unless the router didn't have outgoing rulesets...

---

Yes... but then you could be smart... and say... what services do everyone allow out?
Http? Ftp? Hmmm?

But the reason they usually allow them out are because they are running the actual services. I don't think a trojan could bind on the same port if another service is being used. I taught him well enough, so we WON'T open a port he isn't using.

I'll look into a writing a quick script that will alter his router from his personal computer, and then have it kill itself after one usage, and keep it nonmorphing. Shouldn't be too difficult, when I can figure out his router information that is.

Have you tried to telnet into the router or connect with a browser and use the default log in. I set a small network up for a friend of mine a while ago The router (netgear) he has, has still got the default log in,ie Admin/password. Password being the password.

I have had to go back to carryout a bit of maintainance a few times and he still has not changed the password and iv'e told him he should.

Not much help i'm afraid but you never no.

Jinxy

Quote:

---

Originally posted here by jinxy
Have you tried to telnet into the router or connect with a browser and use the default log in. I set a small network up for a friend of mine a while ago The router (netgear) he has, has still got the default log in,ie Admin/password. Password being the password.

I have had to go back to carryout a bit of maintainance a few times and he still has not changed the password and iv'e told him he should.

Not much help i'm afraid but you never no.

Jinxy

---

Unless he has the remote administration enabled (which should show as an open port right) this will not work. (Unless you are on the internal network)

Hmm....good point jarrod. That brings up an Idea....if the router has wireless potential...simple wardriving would allow some sort of access to further penetrate the target.


If you really really want to go through all the trouble of getting in...another Idea is to physically access his/her Internet Cable (Cable or DSL?), install a physical keylogger or traffic monitor in between or a wireless hotspot for that matter...and continue from there, very unlikely that someone would go through all that trouble to access his PC.


I'd also take into consideration Jarrod's DOS idea. So far he hasn't had any luck with the few tools he's used to even scratch the surface of my network. We'll let you know if he gets anywhere :D

CXGJarrod.
You are quite correct. And i don't suppose remote admin will be enabled by default.
Still i thought it was worth a shot.

Have a look at this link: http://www.securitytracker.com/alert...r/1006463.html


Jinxy

Quote:

---

Unless he has the remote administration enabled (which should show as an open port right) this will not work. (Unless you are on the internal network)

---

A bit off topic but I thought I'd add this. In the NetGear RP114, this is a known flaw (NetGear knows this and doesn't think this is a serious security issue). The specific issue is that you can access the router from external using the internal private addressing scheme. I also think (IIRC) you can also access it externally by default using outside addressing (Big reason why that router is no longer located near an external address for me and why the default pass was changed immediately upon purchasing -- but how many people have purchased this and never done it!?). Personally, I think this is an issue but hey.. might be just me. :D

All the commercial grade, (read: (l)user grade), routers I have come across have remote admin turned off by default.... A smart move IMO.... ;) So remote admin is not possible without an exploit of the router itself.... which is possible. You need to determine the firmware version and router type itself. I read recently, (here on AO so do a search), that the latest version of NMap has signatures for several of the common commercial grade routers. I know that linksys' default admin password is admin and D-Link's is 1234 - I'm sure you can come up with others if you google it. If you can breach it with the available exploits and gain admin then it is yours.

It did interest me to note the level of frustration you have when presented with a router. Sucks doesn't it? But what you are really saying is that a wide open box is fun for you, you can compromise it, or at least have a good go at it. But if someone spends the $40-60 to put the router in the way or a software firewall you are somewhat "castrated". You demonstrate perfectly the reason why people who don't understand their OS and how it exposes them can mitigate many issues with the simple expenditure of a small amount of money rather then their precious time to learn. This goes back to the rather long and heated thread that was closed, (where I got the "last word" :p), where placing any kind of "obfuscator" between a non-technical person's box and the public network was questioned.

Your post, whether you intended it or not, proves both yours and my position that it is, in fact, a good thing...... ;)

Quote:

---

Originally posted here by pooh sun tzu
But the reason they usually allow them out are because they are running the actual services. I don't think a trojan could bind on the same port if another service is being used. I taught him well enough, so we WON'T open a port he isn't using.

I'll look into a writing a quick script that will alter his router from his personal computer, and then have it kill itself after one usage, and keep it nonmorphing. Shouldn't be too difficult, when I can figure out his router information that is.

---

What I meant by that was he has to allout 80 OUT because he wouldn't be able to access web pages (unless he us using a proxy through port 1080 or 8080, etc)... You are thinking port forwarding... which is IN...

Similar to how trojans connect to an IRC server on port 6667, join themselves to a room (most of the time hidden) and wait for instructions...

They connect out from their PC and into a server.

It doens't actually open up port 6667 on the compromised host...

It really creates somewhat of a tunnel.

A thing wich could be interesting to lookup is firewalking (and the tool firewalk). Nice pdf about it: http://ducer.w00nf.org/trash/securit...s/firewalk.pdf. Someone asked me to write a tut on it, but I don't have the time atm. Very short, it's a method to determine the ACL's on the firewall/router, by messing with the TTL of the packets.

Quote:

---

Have you tried to telnet into the router or connect with a browser and use the default log in.

---

Nope, his linksys (i think so far) has it turned off by default.

Quote:

---

simple wardriving would allow some sort of access to further penetrate the target.

---

He lives in WA, I live in UT. Not a possibility.

Quote:

---

I'd also take into consideration Jarrod's DOS idea.

---

Unless the DoS is directly tied to a exploitation so I can bypass the router, it won't do me any good. I'm here to penetrate, not go scripty on him :) However, if it is a DoS that does give actual exploitation (like old CISCO routers that reset the password/uid if they received too many 1m pings within a certain period, or the semi old CISCO's that would buzz the admin during a DoS via wireless pager with a new login and password that was randomized, thus transmitting it to my pager).. then tell me how it works.

Quote:

---

NMap has signatures

---

As I said in my first post :) already running nmap checks

Quote:

---

But what you are really saying is that a wide open box is fun for you, you can compromise it, or at least have a good go at it.

---

It isn't that at all, actually. Even on a totally locked down box like my old winxp test I at least had a chance of zero day penetration testing, or dumb luck with perhaps stack smashing. With a router in place, that limits the activity I can preform to near null. Thus my frustration :) I -know- I can do security penetration, but because of my limited knowledge on routers I feel like I'm fresh out of the tutorial section when it comes to router penetration. I do see your point though, and agree (again) that having even a simple firewall/router in place can deter MUCH more attacks than trusting on internal security alone.

Quote:

---

What I meant by that was he has to allout 80 OUT because he wouldn't be able to access web pages (unless he us using a proxy through port 1080 or 8080, etc

---

Brilliant, simply amazing. I never looked at it that way and will imediatally begin researching what ports he may keep open on the OUT for programs or services. One thing that would hinder that though is port differences. His source port may end up being 1051 to access websites, as only the server is required to use port 80 on that connection. It would have to be an outgoing port (service) that sticks to one usage, rather than a program which randomizes. (like my grsecurity patch)


Thanks a ton for that link neel, I'll look in to it right away. Thanks everyone for all your help and keep it coming!

Not to step on any toes, but alot of these suggestions are considered loud. According to hacking exposed 4th edition.
PS: Word on the street, little linksys 4P routers are getting blown through even by the skiddies(hearsay). I dumped mine back two febs ago.

Quote:

---

I'll look into a writing a quick script that will alter his router from his personal computer, and then have it kill itself after one usage, and keep it nonmorphing. Shouldn't be too difficult, when I can figure out his router information that is.

---

While this may not be a direct answer pooh. I will give you my 2 cents anyhow, The system we use is built upon a set of rules and regulations. If you understand both then you can break anything. While it may take you a large amount of time to accomplish this, it can be done. There may be several of you out there that disagree, you must remember one thing. The rules are subject to human error, these little grey boxes are only as smart as we tell them to be.



Be safe and stay free

Pooh: If this is a Linksys then by default it allows _any_ outbound connection to anywhere on the public network, (in fact all the commercial grade routers do - they don't want the users having to work out for themselves how to get to the web or send email to granny. Thus, if he's simply plopped the Linksys in the way without any further configuration then all ports outbound are open.... Note also, logging sux unless you get another app to pick up the SNMP messages it can send out. The log that comes in the interface gives destination and port for outbound traffic.... that's it.... not even a time....

If he's sophisticated he could go in and apply agress rules in a rather clunky way but there are always certain things he's going to allow unless he wants to reconfigure the box every time he wants to do something. That will become tiresome. At a minimum he's probably going to leave either 80, 8000 or 8080 open for web, 443, for SSL, (so he can buy stuff on EBay), 25 and 110 for email. After that your knowledge of him will tell you what other ports outbound would be open, (does he play games? Which? Kazaa? FTP files around etc. etc).

Hey Pooh, talking about trojan and router, have a look at this post. It was posted before you joined (I think) by a guy called Agent_Steal. Download the pdf, it's a great read.
http://antionline.com/showthread.php?s=&threadid=254165

Cheers,
cgkanchi

I have another Idea. If you can "Socially Engineer" him to visit a website with an install script in it. spyware brings up some good strategies.

Check this path: "C:\Program Files\Internet Explorer\iexplore.exe" http://install.sidesearch.lycos.com/about.asp"

I have a "Shortcut" in my desktop from Lycos Sidesearch. If I click on that...guess what will happen.

My point is: Have him visit a website that will download a similiar thing on his desktop. Upload some of your "tools" on an FTP...and have the"shortcut" link to them and download them into the victims PC.

Quote:

---

Originally posted here by pooh sun tzu
A trojan for instance would make perfect sense, but wouldn't that depend upon the ruleset for outgoing on the router? Even if I told it to form up on port 79, the router would still have to allow it. Not sure how that would help incalling home, unless the router didn't have outgoing rulesets...

---

Go out on port 53 would be my advice, since the network must get external dns from somewhere...

Steve

I glanced through the posts and did not see any reference to SNMP. If he has that open and set for default, it is possible to get all the info you would want from the router and you would be able to make changes to the config. I know with Cisco gear, if you leave the SNMP settings at default, you can get a copy of the config.
If this has been discussed and I missed it, I'm sorry.