5268ac routers

[drsnooker]

A nice even 1000 passwords for the 5268AC. I think this is a good place to leave it, unless anybody has any more ideas...

https://pastebin.com/22ZGhHg4

[drsnooker]

Look at what Santa left in my stocking!!!!



Let's crack it open and see if its firmware contains any mysteries....

[drsnooker]

This pace edition is straight from the factory! I've got root access over UART. And check out the /usr/bin directory.... factory_set_default_wifi_passwd!
*sad trombone* It's just a script to pull the default password from elsewhere, not the algo. Now to find the elsewhere!

Code:

%factory# ls /usr/bin
battery                                factory_set_default_wifi_passwd
bunzip2                                factory_set_default_wifi_ssid
bzcat                                  factory_set_device_key
bzcmp                                  factory_set_dsl_media
bzdiff                                  factory_set_factorymode
bzegrep                                factory_set_ip_address
bzfgrep                                factory_set_led
bzgrep                                  factory_set_led_mode
bzip2                                  factory_set_mac_range
bzip2recover                            factory_set_mfg_timestamp
bzless                                  factory_set_model
bzmore                                  factory_set_pca
call_qcsapi                            factory_set_serial
dumpmem                                factory_set_trusteng
factory                                factory_set_wifi5g_device
factory_batt                            factory_set_wifi5g_ipaddr
factory_battery_calib                  factory_set_wifi5g_mac_addr
factory_battery_daemon                  factory_set_wifi5g_mfg
factory_cert                            factory_set_wifi5g_model
factory_cert_get_file                  factory_set_wifi5g_netmask
factory_cert_install                    factory_set_wifi5g_param
factory_cert_list                      factory_set_wifi5g_passwd
factory_cert_remove                    factory_set_wifi5g_pca
factory_cert_request                    factory_set_wifi5g_serial
factory_cert_request_install            factory_set_wifi5g_ssid
factory_cert_verify                    factory_set_wifi_cal
factory_disable                        factory_set_wifi_continuous_transmit
factory_download                        factory_test_usb_filecopy
factory_download_pkgstream              factory_tftp_upload
factory_dsl_test_qln                    factory_unboot
factory_enable                          factory_usb_overload_status
factory_get                            factory_verify_credentials
factory_get_current_wifi_rx_count      factory_wifi5g_finalize
factory_image_switch                    factory_wifi5g_update_image
factory_kmsgd                          feature_support
factory_log                            features
factory_reset_dsl                      jrecv
factory_reset_wifi5g                    jsend
factory_set_accesscode                  openssl
factory_set_authcode                    pkgstreaminstall
factory_set_current_wifi_channel        quantenna_support
factory_set_current_wifi_fixed_tx_rate  sendarp
factory_set_current_wifi_mode          setmem
factory_set_current_wifi_ssid          telnetd
factory_set_current_wifi_tx_frequency  tftp_upload
factory_set_current_wifi_tx_power
%factory#

[b1tninja]

Looks very promising, terrific work; sorry I'm no help.

Thanks Calexico! 
For everybody else: although I've pulled NAND chips and dumped them, this is all done on a vanilla modem, using an UART connection. If you want to join in, pick up a 5268ac modem from ebay ($25) and a USB UART adapter, like a PL2304HX ($4) So for less than $30, you can really pretend to be a hacker! (or just a hack LOL)

Curious if you've had any luck reading the filesystem from the NAND? I couldn't find any open source implementation of OpenTDS... so I was going to try and figure it out. I'd like to be able to modify the files, but there seems to be some checksums likely for bad block detection

My idea is to unpack a pkgstream and then compare the chunks with the NAND dump and go from there... another was to try and emulate with QEMU

[drsnooker]

@b1tninja, I eventually got a clip and managed to get the NAND dumped in situ. However, since we know the root password as well as the algo for the password of user: rma (also with root privileges), it was no longer necessary to figure out how to binwalk the NAND dump, as you can just access the modem over UART.

[b1tninja]

@b1tninja, I eventually got a clip and managed to get the NAND dumped in situ. However, since we know the root password as well as the algo for the password of user: rma  (also with root privileges), it was no longer necessary to figure out how to binwalk the NAND dump, as you can just access the modem over UART.

Unfortunately the newer firmwares seem to prevent downgrade and one of the scripts at startup disables input over the debug port. 

I did find a compatible connector for that the uart though which is handy: samtec MEC1-108-02-S-D-A.

Alright well thanks anyway guess I'm on my own I'll report back here when I figure it out

[drsnooker]

Perhaps if you purchase a used one of ebay, the FW might not have been upgraded past the point that you can change the firmware to an older one. Or perhaps downgrade to 11.0 first before going for 10.5.3?

[drsnooker]

I ended up buying a Sonic edition 5268AC. The WIFI passwords still seem to follow the basic rules of start with a number and no more than 3 letters in a row.




I never thought I would actually find the wifi keygen, but perhaps a clue could come from the ESSID gerenation algo.
The RMA password again is generated using the pseudopwd that @90h reversed, so root access over UART was quickly set up.

In /rwdata/pkg/sonic-config.pkgstream there are two notable comments:

<------------------ SNIP ------------------>

# Changes
#    2015-04-22  - Added second "CASE" value and bumped the "loop_thru_case" to 2
#                - Change SSID0 to "Sonic-XXXX" [SN-5268-PDP-01]
#                        Note: XXXX is a random number.  This mandates that SSID0 be loaded by the factory build
#                              The assumption is that "/sys/module/board/parameters/wifissid0" will contain this value??
#                - Make primary 5Ghz SSID (SSID5) the same as the primary 2.4GHz SSID (SSID0) [SN-5268-PDP-01]
#                        Note: Similar assumption is that SSID5 will be loaded from by the factory build
#                - Wifi PassPhrase be set to 12 alpha/numeric characters [SN-5268-PDP-01]
#                        Note: Similar assumption is that WiFi passphrase be loaded by the factory build
#                - WPS button must be functional for 2.4GHz and 5Ghz on primary SSIDs (0 & 5). [SN-5268-GCG-03]
#                - Add, but not enabled, IPv6 dual-stack information for future ACS-enabling
#    2015-06-09  - Added Broadcast/Multicast group to include teh Bonjour discovery
#    2015-06-17  - Disable IPv6 detection
#    2015-07-13  - New SSH password (Need to encrypt)
#    2015-08-21  - Encrypted new password




#2015_08_20.... Change SSH password and encrypt.
    echo "--Changing root password"   
    echo root:'$1$D6xa9FbN$9b9TgxSBUYzISHNGTn6qJ/' | chpasswd -e
   
    echo "--Changing Tech password"
    usermod -p "w53t3uMR" tech

<------------------ SNIP ------------------>


Sadly, unlike the previous root password, this one is not cracked by 8 chars with a leading number
-a 3 -1 ?d?u?l ?d?1?1?1?1?1?1?1
It's possible it follows the Tech password without a number in the first spot, but I already have root access using the RMA user, so don't feel like burning electrons trying to solve the new root password.


And lastly the SSID number is also pulled directly from NVRAM as suggested by the changes of 4/22, it is not calculated.
/sys/module/board/parameters/wifissid0 just shows the complete ESSID, not just the number.