Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LevelOne WBR-6002 N is affected too, but not listed in README.md #107

Open
azazar opened this issue Jul 16, 2016 · 1 comment
Open

LevelOne WBR-6002 N is affected too, but not listed in README.md #107

azazar opened this issue Jul 16, 2016 · 1 comment

Comments

@azazar
Copy link

azazar commented Jul 16, 2016

Backdoor is working and listening on the internet on LevelOne WBR-6002 N .

$ ./poc.py  --ip=192.168.0.1 --shell
welcome, here is a root shell, have fun

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 *:49152                 *:*                     LISTEN      
tcp        0      0 *:80                    *:*                     LISTEN      
tcp        0      0 *:32764                 *:*                     LISTEN      
udp        0      0 localhost.localdom:3073 *:*                                 
udp        0      0 *:23460                 *:*                                 
udp        0      0 *:1900                  *:*                                 
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
@azazar azazar changed the title LevelOne WBR-6002 N is affected too LevelOne WBR-6002 N is affected too, but not listed Jul 16, 2016
@azazar azazar changed the title LevelOne WBR-6002 N is affected too, but not listed LevelOne WBR-6002 N is affected too, but not listed in README.md Jul 16, 2016
@jay
Copy link

jay commented Jul 18, 2016

As noted the README isn't being updated manually any longer. You may make a pull request and reference this issue in the 'LISTENING ON THE INTERNET' section, for example

diff --git a/README.md b/README.md
index 3cfa9f1..5674552 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ Backdoor **LISTENING ON THE INTERNET** confirmed in :
 - Netgear DGN2000 1.1.1, 1.1.11.0, 1.3.10.0, 1.3.11.0, 1.3.12.0 ([issue 44](https://github.com/elvanderb/TCP-32764/issues/44))
 - Netgear WPNT834 ([issue 79](https://github.com/elvanderb/TCP-32764/issues/79))
 - OpenWAG200 maybe a little bit TOO open ;) ([issue 49](https://github.com/elvanderb/TCP-32764/issues/49))
+- LevelOne WBR-6002 N ([issue 107](https://github.com/elvanderb/TCP-32764/issues/107))

 Backdoor confirmed in:
 - Cisco RVS4000 fwv 2.0.3.2 & 1.3.0.5 ([issue 57](https://github.com/elvanderb/TCP-32764/issues/57))

also would be helpful to know the firmware

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants