Friday, June 16, 2017

RHEL7 / CentOS7 network interface going down once per hour

There's really bizarre bug in RHEL7 / CentOS7. Once per hour NetworkManager will remove IP addresses from ethernet interface after hitting some bug and triggering "link loss" action. Interface may come back by itself or may not. It does come back when you login as root on console as login triggers some repair action part via systemd...

Thursday, June 15, 2017

Migrating user accounts from older Linux to RHEL7 / CentOS7

Another pointless change just to break backwards compatibility - RHEL7 and CentOS7 prevent users with uid lower than 1000 from logging in. This is bad when you're migrating accounts from existing Linux server where uids start at 500.

RHEL7 / CentOS7 with sshd on ports 22 and 443

Short version: Not as simple as you thought.

Friday, May 19, 2017

Tracking wired client behind Aruba AP

So you have setup with Aruba RAPs that bridge their wired ports to VLAN on controller. Web interface only tracks wireless clients so you have no idea what AP client with particular IP is connected to.

Monday, May 15, 2017

Scan Intranet for Windows PCs missing MS17-010 / WannaCry / NSA ETERNALBLUE patches

So you have used all you tricks to get MS17-010 fix deployed but how to confirm that every forgotten PC on your network is actually patched?

We'll scan our intranet using Metasploit checking for this particular vulnerability. PCs with local firewall blocking SMB traffic will be missed, but those are not exploitable anyway due same firewall.

Sunday, March 26, 2017

Backdoor and root shell on ZTE MF286

ZTE MF286 has built-in factory backdoor allowing root shell access on embedded Linux running inside router. However since we don't know RSA-2048 private key used for encrypting device specific password we're not able to use this. Which doesn't mean we won't have other means to gain root shell.

Thursday, March 23, 2017

Locking custom LTE bands on ZTE MF286

My ZTE MF286 is running DNA firmware version B04. It's somewhat limited in LTE band selection, but that can easily be worked around with curl.

Inside ZTE MF286 router

ZTE MF286 4G router is built around Qualcomm QCA9563 soc with 802.11bgn, QCA9882 802.11ac wlan, QCA8337 gigabit switch and MDM9230 LTE chip. There's also tempting serial port knowing all components used are already supported by LEDE (that has replaced OpenWrt).

Photos here.

Inside Huawei B315s-22 4G router

Huawei B315s-22 contains Huawei HiSilicon 6361 SoC, Realteak Ethernet switch and Broadcom WLAN. Not much to see, but some photos here.

Sunday, March 19, 2017

Linux SNAT with per-connection source address from IP pool

When doing NAT with pool of addresses to choose from (instead of masquerading) Linux insists on always using same IP from pool for particular source IP. Often this is preferred, but not always. To workaround we need to patch kernel a bit.