start	end	text
0	5560	Welcome to Kicking Devices and Taking CBEs, The Zoomer's Guide to Hacking Shit, presented
5560	11220	by yours truly, a fellow Zoomer. In this talk, I'm going to first introduce you to the life
11220	18180	of a Zoomer, what happened before 2020, things I found instead of lost stocks, the methodology
18180	23380	I used to find things instead of lost stocks, the actual hacking shit, which is why you
23380	28380	guys are here. Hopefully, we'll get through a live-ish demo, and then I'm going to take
28380	34360	you through a responsible disclosure and a call to action. So, the life of a Zoomer,
34360	40380	aka me. I'm a junior security analyst at ISC, a rising electrical engineering senior at
40380	46880	UCLA, and I'm primarily focused on cryptography, IoT and hardware security, and hiding from
46880	53000	my dog. I enjoy researching IoT devices and collecting CBEs, and my research has been
53000	62120	covered by publications such as Motherboard, Daily Swig, and ISMG. So, before 2020, aka
62120	69000	before shit hit the fan, unlike Sam, I'm not a polite hacker, but it's okay. So, last year,
69000	74100	in September, two weeks before I had to go back to school, my manager had like a mini
74100	77600	dead week, so my manager grabbed her out of nowhere, and he's like, okay, do you want
77600	81360	to poke around and find some derivatives? And I was like, sure. So, this presentation
81360	88320	is the story of how I found five CBEs in about three days, and if a Zoomer can do it, pretty
88320	94680	much anyone can. So, what do Zoomers want? There are two things we want, more than anything
94680	100120	else in the world, the first being persistent remote shell, and the second being CBEs, because
100120	107860	as you guys know, Zoomers love fame and fortune. So, what is a persistent remote shell? A persistent
107860	113160	remote shell permanently allows an attacker to execute shell commands on another computer,
113160	119360	in this case, the Tenda device, across the network, even if the device is reset or reboot.
119360	123540	And obviously, you guys know why this is so important, because effectively, once we have
123540	130280	persistent remote shell access, we have complete control over the device. What are CBEs? So,
130280	135600	according to MITRE, CBEs are common vulnerability and exposure entries, and these are unique,
135600	140620	common identifiers for publicly known information security vulnerabilities. So, of course we
140620	144460	want them because, you know, if we get our name out in the security field, but also they're
144460	148340	just a good way to keep track of the research that's going on in the field, and, you know,
148340	155740	you might find it might be a stepping stone for further research. So, in this talk, we're
155740	163100	going to be using the Tenda AC-15, AC-1900, smart dual-band gigabit Wi-Fi router, a really
163100	169760	long name, as our scapegoat. And this device was running the 2019 firmware, which is the
169760	179660	latest at the time when I began researching the 15.03.05.19 firmware version. So, the
179660	184720	reason why we start, like, you should start your IT-embedded device research journey with
184720	189340	routers is because, like, not only are they super easy to find, and, you know, they're
189340	193640	pretty much everywhere, and they're also, like, the main pivot point for most smart,
193640	199660	you know, homes and IoT networks, but they're also generally pretty cheap, and you can generally
199660	205560	find them everywhere. Also, when you, you know, find something in a router, it's more fun to talk
205560	212140	about. So, things I found instead of lost socks. So, I keep losing my socks. I'm really good at
212140	217500	it. And, obviously, when I try to find them in my router, I'm not going to get anywhere. Instead,
217500	226700	I found five CVEs. So, the first CVE, the first two instances were RCE, or remote code execution.
226840	232880	So, this allows attackers to execute code or commands on a target device remotely over a
232880	238480	network. And the reason why we want this is because it allows us to read, write, and delete
238480	243820	content, gain persistent access, which is something similars want, and build botnets. I think there
243820	249080	was a talk yesterday about how teams have too much time on their hands and enjoy building botnets,
249080	257740	and I agree with this. The second attack we found was XSS, cross-site scripting. This allows
257740	263520	attackers to inject malicious client-side scripts in web applications that will typically affect
263520	269040	several users when executed by the browser. The reason why we want this is because it allows us
269040	275620	to capture sensitive information, perform phishing attacks, and perform unauthorized actions. The
275620	282740	third attack we found was CSRF, or cross-site request forgery. This forces end-users to execute
282740	288140	unwanted state-changing actions on web applications in which they're currently authenticated. And the
288140	293580	reason why we want this is because it allows us to indirectly perform unintended actions,
293580	300640	exploit vulnerabilities that require authentication. Something to note here is that
300640	307940	the user has to be authenticated for this attack to work. However, if you can chain this with other
307940	312800	attacks, then, like I mentioned before, you can exploit vulnerabilities that require authentication
312800	318180	and thereby increase the severity of those vulnerabilities, something that we will talk
318180	324560	about a little more later on in this talk. So the last vulnerability I found was the hard-coded
324560	329900	Telnet password in the source code. And this allows attackers to log in to the unencrypted
329900	336640	Telnet daemon. And as you can see, this allows attackers to bring hell on earth. Okay, maybe not
336640	342460	exactly hell on earth, but it definitely allows us to gain direct root shell access and basically
342460	350480	persistent, which is something we want, and to build botnets. So generally, routers aren't
350480	357300	supposed to allow Telnet, and usually it's not an option that's always on. And even if they do,
357300	364700	usually the IoT devices will have the option for users to toggle this on or off. Unfortunately,
364700	370140	or well, fortunately for us, the Tenda router does not do this, and the Telnet daemon remains
370140	377980	on perpetually forever. Okay, so the methodology. So in this section, we're going to talk about the
377980	382800	recon and areas of interest that you guys should look at and pay attention to when you're beginning
382800	391480	your IoT research. So recon, again, is the most important part when you're formulating a task
391480	399140	against any hardware or software. So the main things I looked at was four things. First, we
399700	405080	because this is a good place to, you know, figure out what vulnerabilities exist in the device to
405080	410500	start with, and also just because generally vulnerabilities will, you know, show up in the
410500	415740	different endpoint or instance of the same device, or like a different device produced by the same
415740	421460	manufacturer. The other things we looked at are, I looked at our network ports, the web interface,
421460	429980	and again, because this is an embedded device, the firmware. So for the network ports, so I used
429980	435500	Nmap. Again, something I should mention before going in further into this is that all of the
435500	440980	methodology that we're going to talk about basically focuses on the vulnerabilities I've
440980	445440	found. So we're going to be focusing on the Telnet and the hard-coded Telnet password,
445440	451680	RCE, and then XSS and CSRF. So because you're looking for Telnet, you should check out and
451680	459340	try to see if you can find port 23, 2323, or check if 9527 is open. It's also really cool to
459340	466040	check for other open ports and check for unencrypted and unauthenticated communications.
466120	472000	I think I found a really weird port called CSRListener or ERCListener, something I didn't
472000	478280	really have time to check out. So I only had three days to work on this. But if you guys ever do feel
478280	483100	like playing around with the Tender router, that's something I encourage you to check out and play
483100	491020	with. Okay, so the web interface. So this router actually came with a web interface, not all
491020	498380	embedded devices do. A good place to start, you know, your analysis is just manual testing and
498380	504220	then later on use Verbsuite to try and help yourself out. So we began this process by
504220	507900	mapping out the application, you know, going through the web interface, looking for injection
507900	513420	points through user supply data, and then going through the request and looking for user control
513420	520660	data. Something I want to mention here is that if you can see in this picture, many people overlook
520660	526460	user control data, such as the headers here or the cookie. And because you have access to this
526460	531900	data, you have the power to change it. It's something to keep in mind when you're beginning
531900	538460	your research careers. The next thing we're going to look at is firmware. And as I mentioned before,
538460	545420	we're focusing on hard-coded passwords and RCE. So I use Binlog to extract the files from the
545420	551200	firmware, and then IDA Pro to, you know, disassemble the code and parse it. So because
551200	556140	we're looking for hard-coded passwords, the best thing to do is to parse this assembled code and
556140	561400	run strings. In this case, as you can see, we found this hard-coded password, but sometimes
561400	567400	you might not always find hard-coded passwords. Generally, although if you do run strings and you
567400	573300	do look for other cool, you know, strings in your firmware, you might find other interesting behavior,
573300	580160	which is cool to look out for. The next thing we're going to be looking out for is RCE. So
580160	587100	it's good to pay attention and search for system.cmd, popen, and exec. As you can see here,
587100	592760	I found two instances of do system.cmd in the firmware, and we will talk about that a little
592760	603130	later. So now it's time to actually hack shit, which is why you guys are here. So we're going to
603130	610950	start with ccert. So I found the first instance of ccert that I found was on the sys.tool.reboot.get
610950	615910	endpoint. Something to mention here is that, you know, state changing GET requests, as I mentioned
615910	624450	previously, are inherently susceptible to ccert. This, again, works because of the lack of anti-ccert
624450	630450	tokens and other anti-ccert protections. But, for example, if an attacker used this payload,
630450	637370	image source payload, and successfully socially engineered the end user to run this, then the
637370	642490	router would reboot. And if the attacker found a way to persistently send this to the router and
642490	646930	persistently get that to the end user and persistently get the end user to submit this
646930	654250	request, you would have persistent denial of service. The second vulnerability attack that
654250	660410	we're going to talk about is XSS or cross-site scripting. So I was really prepared to go all
660410	665410	out and, you know, use body tags and image tags and, you know, figure out a complicated payload
665410	671690	to get this to work. I was very determined to get XSS working. I ended up just using a really basic
671690	677250	script tag and that too on the Wi-Fi name, so I was kind of disappointed. But it's okay. I mean,
677250	684890	efficiency is good. So here, I'm just using this to output and display the document cookie,
684890	688690	which you can kind of see here. The document cookie, this is something I kind of want to
688690	697130	mention for later, is that this is the password and this is the MD5 hash for mouse. So, first
697130	701570	of all, it's good to pay attention that, you know, the router is using MD5 hashes, which is also
701690	706970	really easy to, you know, crack. And there's tons of software out there such as, you know,
706970	711250	Hashcat and John the Ripper. So, first of all, that was the biggest problem, but also
711850	717050	this is something to look out for in the later parts of this talk.
717950	725650	So, something I want to mention here is that, as you can see, for XSS to work, the attacker has
725650	731470	to be authenticated, which makes this, you know, attack have really low severity. However, because
731470	738030	we found Csurf, we can change this and, you know, increase the severity by training XSS with Csurf.
739130	744830	And you can use a payload like this. So, what this does, it's kind of hard to see here, but
744830	750290	all this does is it sends the document cookie, which, as you know, is the password to the attacker.
750370	757010	Okay, so the next thing to look at, since we've gone through the web interface, is to start
757010	762350	parsing the firmware. So, as you remember from the recon section, this is the first instance of
762350	768290	the do system cmd command. So, we found this in the form set USB on load function and the
769130	777190	httpd binary file on variable v2, which was device name. So, our next logical conclusion
777730	782890	would be to look for this endpoint in the web interface, since we have access to the web
782890	788610	interface, which is what we do. And we come across this endpoint and, as you can see, there's the
788610	794110	device name. So, here we're just going to do a simple reboot command and the device reboots.
794110	800370	Nothing much to see here. But, as you can tell, this is an authenticated request, which means that
800370	807070	for this RCE to work, the attacker needs to be authenticated. So, we're going to increase
807070	813510	the severity here by chaining this with CSRF again. So, if the attacker is able to successfully
813510	820410	social engineer the end user, we can get this to reboot. And we basically... or, well, reboot is a
820410	829330	very simple thing, but we could... we basically have RCE here, unauthenticated. So, as I kept
829330	834950	parsing the firmware and playing around, poking around, I came across this string in the tendo
834950	841650	login binary file. So, because it was, you know, the tendo login binary file, I figured I have to use it
841650	847670	to log into something. So, and since I knew that Telnet was running on the device, I tried, you know,
847670	854430	running this on the device. Okay, by the way, this is the md5 hash for fired up. Like, legit, just
854430	862470	fired up. So, here I just Telnet it into the device and use fired up and I have persistent
862470	869290	shell access to the device, which is one of the things Zoomers want and my goal has been achieved.
869610	876950	Again, as... so, as I mentioned, we found another instance of do system cmd. So, this one was in
876950	884430	the tendo Telnet function in the httpd binary file. And as you can see here, this was on variable v3,
884430	889690	which was land.it. So, we're going to try something a little different here instead of going through
889690	895830	the web interface and instead go through Telnet, since we have, you know, root shell access.
896010	901610	So, what we're going to do is we're going to figure out how to set the value of land.it
903430	910790	to, you know, to something that will get us a remote code execution. So,
911370	917450	you go a little below this, you know, function, there's a command called cfm,
917450	923610	which you can see here. So, what I'm going to do is I will set the value of land.ip using cfm,
923610	928410	and I'm just going to set it to, like, the simple land.ip address and then, you know,
928410	934050	touch a trash file. Something to note here is the reason why we're putting this in the temp folder
934050	940950	is because that was one of the few read-write folders on the device. Something to keep a
940950	946090	lookout for is when you're trying to, you know, change the state of an embedded device, you want
946090	950910	to find a read-write folder so that you can actually do stuff with it, because most folders
950910	957550	will be read-only. So, as you can see here, the trash file doesn't exist. And one thing to note
957550	964070	here is that for this to work, you want the router to reboot first, because, like, it'll get executed
964070	970590	once you actually turn that into the device. So, until you turn that into the device, this
970590	975370	command won't work, so that's why the trash file doesn't already exist. So, what we're going to do
975370	981250	is I've rebooted the device, and then we turn that back in, and once we see the end of temp,
981250	986950	you can see that the trash file has been created, thus giving us, you know, an RCP.
988370	992670	Okay, so now it's time for the live-ish demo.
996060	1002280	So, for the first demo, I hope to show you guys a small glimpse in the kind of damage you can
1002280	1008640	do with root shell access, and we will be demonstrating this through TomNet. So, since
1008640	1015400	the router is an embedded device, we want to see where stuff is stored. In this case, basically,
1015400	1022020	the non-volatile memory, which is the flash memory. So, in general, in embedded systems,
1022020	1028340	you can usually find MTVs, which are memory technology devices, and these are device files
1028340	1035980	created in Linux to interact with flash memory. So, a good way to see this is to figure out first
1035980	1043620	how they are being partitioned in actual device memory. So, we will be doing this by cd'ing into
1043620	1050300	the proc folder and outputting the contents of the MTD file. What's interesting to note here
1050300	1059940	is the MTD6 block partition and the MTD7 block partition, where the 6th is cfm-backup and the
1059940	1066360	7th is cfm. The cfm function is something that we discovered while we were playing around with
1066360	1076180	the RCE on the lan.ip parameter, and hopefully we will find similar parameters such as the lan.ip
1076180	1083060	in one of these block partitions. So, now we will go into the dev folder.
1083240	1089740	So, we will first display the contents of the MTD6 block partition, which is the cfm-backup
1089740	1097040	partition. The first param that pops out is the 2G wifi password, and as we keep scrolling up,
1097040	1101600	we can see a lot of other interesting parameters that we could potentially, you know, play around
1101600	1109480	with or observe. But if we keep scrolling up, we find the sys.userpass parameter, which as we know
1109480	1118360	from previous results, consists of the md5 hash of mouse. And now we are going to output the
1118360	1125820	contents of the MTD7 block. So, as we can see, the wifi password is obviously still the same.
1125820	1131460	Also, by the way, this is the cfm partition. But now when we go to the sys.userpass parameter,
1131600	1139540	the value is slightly different. And this is the md5 hash of mouse2. So, a little bit of backstory
1139540	1146320	here. I originally set the password of the admin console to be mouse2, and then later on I changed
1146320	1153500	it to mouse. So, what's interesting is that the cfm-backup partition stores the actual password
1153500	1162580	that's being used on the admin console, aka mouse. And the cfm partition stores the most recent,
1162580	1170080	previously used password. So, now we basically have access to the router's wifi passwords,
1170080	1176880	both 2G and 5G. And we also have access to the user's admin console password,
1176880	1182040	among other interesting information. Now, although this information is certainly fun,
1182040	1188660	it would be definitely way cooler if we could change this. So, now our next goal is to figure
1188660	1196240	out how to change, say, either the wifi password or the admin console password so that we're the
1196240	1203100	only people who have access to it, and the OG user isn't able to access either their admin console
1203100	1208980	or, you know, the router's wifi. What we're going to do is we're going to use a similar method to
1208980	1215160	how we change the value for the lan.ip parameter, where we use cfm-set. So, here we're going to use
1215160	1224020	cfm-set sys.userpass, and we will be changing it to the mouse is alive. So, a quick note here,
1224020	1228760	while analyzing hardware or software, it's important to understand how the system is doing things.
1228780	1235720	So, in this case, when you enter a password to log in on the admin console, it gets md5-hashed,
1235720	1241460	and this hash is compared to the actual value stored in flash memory. So, here it's important that
1241460	1246720	when you're actually setting the user pass, you're setting it to the md5-hash and not the actual
1246720	1253680	plain text password that you want. So, now we will set this, and again, important to note that you have
1253680	1260840	to reboot for this to actually, you know, take into effect. Once the router reboots, we will try
1261400	1268140	logging in onto the admin console with our new password. Okay, so now that the router has rebooted,
1268140	1280490	we will log in with the mouse is alive, and boom, we're in. So, for the second demo in this talk,
1280490	1285290	we are going to find another way to gain persistent access to the device. Of course,
1285290	1289570	we can always tell that into the router. I think also this is a good place to mention
1289570	1298970	that Tenda has not released any updated firmware. So, as long as the AC1900 routers are using the
1298970	1305390	2019 firmware, even potentially older firmware versions might have the hard-coded telnet password,
1305710	1313150	then you should be able to use FireItUp to gain access to the router. But, come on, that's so basic.
1313490	1318650	So, instead, we're going to try to see if we can chain one of our previously found
1318650	1326170	RCEs with the telnet to find another way of getting persistent access to the device.
1326450	1333210	So, when we start, the first thing to do is to check if you can download files onto the router.
1333210	1339210	The best way to do that is to check if Wget is available on the embedded system that the device
1339210	1347370	is using. So, when we type Wget here, we can see that the device is running a BusyBox version 1.19.2,
1347370	1354470	which is a commonly found Linux system that's used a lot in embedded devices. And we can obviously
1354470	1362510	see that Wget also exists, so this makes our life so much easier. I've already set up a reverse shell
1363050	1370130	that connects to port 8123. So, here I'm going to serve it. I will be using Netcat to listen on
1370130	1378030	port 8123 for incoming connections. So, my first step is I'm going to download the shell
1378030	1383290	because we're hosting it, change the permission so that we can actually run it, and then run the
1383290	1399680	shell. Okay, as we can see, the connection has been received and we have access to the device.
1399680	1405680	But the first question to ask is, is this persistent? And we kind of know that it isn't,
1405680	1411340	but a good way to check is by rebooting the router. What happens when the router reboots?
1411340	1418160	But obviously, what we're expecting is that we won't find the shell in the comp folder
1418160	1424240	because it's not persistent. And obviously, this is what happens. So, now what we're going to do
1424240	1431800	is we're going to see if we can use the RCE to change this. So, we're going to first go ahead
1431800	1437480	and connect cat to 8123 and start listening for incoming connections so that we don't accidentally
1438120	1443860	run our script and forget to connect cat. I'm going to make a new fast script here
1443860	1452620	called sizzle where we're going to use the RCE in land.ip. So, basically, we're going to do a
1452620	1457700	cfm set land.ip and then run the same commands that we ran initially. So, we're going to cd
1457700	1464160	attempt, download the shell, change the permissions, and run the shell. Something really important to
1464160	1470980	note here is that you want to make sure you actually include the actual land.ip address
1470980	1476800	in the beginning when you're setting land.ip. Otherwise, what will happen is, if you remember,
1476800	1485080	during the actual RCE, it is running telnet at the land.ip address. So, if you don't do that,
1485480	1491360	a. your router won't work properly and b. you won't be able to actually telnet into the device
1491360	1497780	because there's nowhere to telnet to. This can only be fixed if you have physical access to
1497780	1504640	the device, which in our case, or in a normal attacker's case, we won't have. Since, anyways,
1504640	1510120	we're going to be running the script and because we know that land.ip isn't going to actually run
1510120	1514820	until we reboot it and obviously when we're running the script, we might as well have,
1514820	1520900	you know, our port connect back to the router. So, it makes sense to also, which is what we're
1520900	1529040	doing here, to download the shell and then again change the permissions and run the shell.
1529300	1533740	So, once we've created the script, it's obviously still being served on our server
1534160	1539300	and we're going to go ahead and download our sizzle script.
1541940	1551440	And then we will change the permission and go ahead and run it.
1552660	1560040	So, our connection has been received and yeah, there's nothing to see detail, but
1560040	1570180	um, when we list out our files, this is obviously all the files in the temp folder.
1570340	1574780	But is this persistent? And this is something that we still want to check. So, we would think
1574780	1579560	it's persistent and hopefully because of RCE, everything should work according to plan,
1579560	1584720	but it's still good to check this. So, we're going to go ahead and reboot. Before we reboot,
1584720	1591300	this is something that I kind of screwed up on a little bit when I was initially testing this out.
1591760	1596220	Again, when you're trying to exploit systems, it's very important to understand how the system
1596220	1600940	is processing things, or like in this case processing the RCE. But everything in the
1600940	1606720	lambda.ip gets executed as soon as the router starts up. So, what I initially was doing when
1606720	1613980	I was netcatting is that I was netcatting too late after the router, you know, had already started
1613980	1620360	up. So, my netcat listener was missing the connection. So, that's why we're going to go
1620360	1627560	ahead and first make netcat listen on port 8123 before we actually reboot the router. So, now
1627560	1636340	that it's listening, we can go ahead and reboot the device and wait for it to reboot.
1636340	1642780	And so, as soon as it starts up, we have access to the device with everything that
1642780	1665870	Zoomers want to achieve in life. Cool. So, hopefully you guys had fun with the live-ish
1665870	1671390	demo. And now that we've talked about how you can actually exploit the device,
1671390	1676750	we're going to talk about responsible disclosure. So, the thing with responsible disclosure is
1676750	1682990	before you can actually apply for CVs, it's good to talk to a manufacturer and see if you can
1683710	1688370	get things fixed so that other people can't do the same exploits that you did.
1688430	1695170	So, this is what responsible disclosure should actually look like. So, ideally,
1695170	1702090	I would initially contact Tenda and they would reply to me within 45 days. We would talk about
1702090	1710670	litigation, see if they need any extra information from me, and then hopefully I would get free swag.
1710670	1715830	And then we'd go move on to public disclosure and I would apply for CVs.
1716090	1724850	What ended up happening was that January 2nd, I made my first initial vendor contact to Tenda.
1724850	1733530	They ghosted me. January 17th, I did my second vendor contact. I think they checked my email.
1733530	1738130	Oh yeah, by the way, I obviously tracked my email. So, I think they checked my email
1739930	1746050	January 18th at about 8 a.m. PST and I was like, why are you ghosting me, bro? But it's okay,
1746050	1753010	I'm so used to it by now. So, July 10th, I got tired of waiting and I decided to write my blog
1753010	1760030	and apply for CVs. This is something that you guys should look out for when you actually start
1760030	1765490	researching and you move on to the Responsible Disclosure Conference. Try to get free swag.
1766090	1772370	So, the next part and the last part of my presentation is a short call to action. So,
1772370	1777090	this was the Zoomer's Guide to Hacking Shit. These are a couple of resources that can get
1777090	1783810	you started in your research career. This is the QR code for my slides. So, if you guys want to check
1783810	1789190	out the links, this is a good place to get started. The first is a link to my blog, which has a little
1789190	1797150	more details on the actual walkthroughs of each vulnerability. The next is the AC-15 firmware
1797150	1805510	version 15.03.05.19. So, a little backstory here is that they definitely did check my email and
1805510	1811690	this is my proof because they removed this firmware from their global firmware site. But,
1811690	1815810	it still exists on the US site. So, if you guys want to play around with it, I definitely encourage
1815810	1822990	you to do so. The next is a MITRE link, best place to get started with checking out old CVEs.
1823210	1827910	And then, Verbsuite and NRAP, if you guys don't already have this. IDA Pro,
1827910	1833450	great resource for disassembling code. And then, there's a short more resources link.
1834770	1841010	So, that was the Zoomer's Guide to Hacking Shit and Picking Devices and Taking CVEs.
1841010	1846430	I will be joining the Discord channel for extra questions.