Posts

Cisco CSR1000v 3.13 crashes on VMware ESXi 5.1

Initial version of Cisco CSR1000v 3.13 (csr1000v-universalk9.03.13.00.S.154-3.S-ext) was broken and kept crashing while booting on VMware ESXi 5.1, but apparently does work on ESXi 5.5. Cisco has silently replaced it with 3.13S0a version (csr1000v-universalk9.03.13.00a.S.154-3.S0a-ext) without providing any release notes or even updating filedates. Which is exactly as broken as old one - stuck in infinite reboot loop. Download is here , but for some reason for 3.13 only OVA packaged one is available after free registration. If you need ISO simply unpack OVA with 7zip and use ISO you can find inside for install. And then it will fail. Perhaps something to do with crazy nested virtualization CSR uses. Thanks guys.

Export all SMTP addresses from Exchange using PowerShell

Tested with Exchange 2010. You'll need Exchange Management shell but no need for exchange admin rights. Get-Recipient -ResultSize unlimited | Select Name -ExpandProperty EmailAddresses | Where-Object {$_.SmtpAddress -ne $null} | Select Name,SmtpAddress,IsPrimaryAddress | Export-csv -Encoding unicode -NoTypeInformation AllEmailAddress.csv

How to change Atheros AR9xxx aka ath9k EEPROM values

One of my Atheros AR9280 minipcie cards had some odd undefined regulatory domain (0x6B) configured. This caused even latest Linux ath9k driver to break so I wanted to change it to valid regdom. Which ath9k developers think is sin and are trying to prevent people from doing, but luckily our old friend iwleeprom has Atheros support letting us to fix this.

Modifying Huawei B593u firmware images using FMK

Nothing special here in my opionion, but I've seen few comments saying that FMK  doesn't work with Huawei B593u. Just follow instructions below and you end up with normal firmware image having one important difference - you can telnet in as admin from LAN side of device.

Inside old Motorola (Symbol) AP-5131 access point

Image
I found couple Motorola AP-5131 802.11a/g access points today. It's old design from Symbol Technologies dating back to 2005 with manufacturing date from 2010.

Netdisco2 on Ubuntu 14.04

Netdisco is neat tool to collect layer-2 forwarding database from switches, match MACs with layer-3 ARP table from router and present it over searchable webui. Old "Netdisco 1" was quite horrible to setup, but it did still do its job. Recently "Netdisco 2" was released making admins life much easier and also bringing fancy new look for webui. So here's my notes about installing new virtual machine with Netdisco 2.

Huapwn - Backdoor on your Huawei B593u

Public Huawei document I linked couple days ago mentioned factory diagnostics tool called  " Huawei deviceLocker V0.1" that will grant access to root shell on router. I got curious on how this would actually work and came to conclusion it must be something extremely simple and insecure, it IS Huawei after all. Did some poking around /bin/web process I figured this out - it's all there in clear-text for anyone to read. And that admin password is in Huawei docs, not exactly secret either. In case you didn't realize there's no need for authentication to exploit this. Protip: Try to hide you backdoors a bit better next time.