项目说明
I WILL NOT MANUALLY UPDATE THIS REPOSITORY ANYMORE
If you want to add a router in the list, please make a pull-request, also remember to USE THE POC and paste the result in your pull-request.
Telnet clients and other solutions may not be relevant (some false negative / positi).
Some random 代码/data about the backdoor I found in my Linksys WAG200G (TCP/32764).
The backdoor may be present in other hardware, I'll update this readme accordingly. :)
Possible fix :
if it's listening on the internet: add a firewall rule in the web UI ()it also seems to work on the LAN side. (issue 35)but apparently, not for every body (issue 57) so use the PoC again after adding the rule to make sure the firewall does its job.install an open 源码 firmware (for example OpenWRT or Tomato) this is NOT magical, OpenWAG200 is vuln: kill the backdoor after each reboot (issue 61 & TCP-32764-First-Aid)use this alternati: amod (thank you pidocchio and nremond)redirect the port traffic in your router firewall to a local unused IP and done (\[\])Probable source of the backdoor:
SerComm (nice finding :) )Confirmed by a header (socket_header.h) in cisco gpl sources (thank you Andreas Fett!)Backdoor LISTENING ON THE INTERNET confirmed in :
Linksys WAG120N ()Netgear DG834B V5.01.14 ()Netgear DGN2000 1.1.1, 1.1.11.0, 1.3.10.0, 1.3.11.0, 1.3.12.0 (issue 44)Netgear WPNT834 (issue 79)OpenWAG200 maybe a little bit TOO open ;) (issue 49)Backdoor confirmed in:
Cisco R fwv 2.0.3.2 & 1.3.0.5 (issue 57)Cisco WAP4410N (issue 11)Cisco WRCisco WR (issue 36)Diamond DSL642WLG / SerComm IP806Gx v2 TI ()Le WBR3460B ()Linksys R Firmware V1.3.3.5 (issue 55)Linksys WAG120N (issue 58)Linksys WAG160n v1 and v2 ( )Linksys WAG200GLinksys WAG320N ()Linksys WAG54G2 (@_xistence)Linksys WAG54GS ()Linksys WRT350N v2 fw 2.00.19 (issue 39)Linksys WRT300N fw 2.00.17 (issue 34)Netgear DG834[∅, GB, N, PN, GT] < 5 (issue 19 & issue 25 & issue 62 & jd & Burn2 Dev)Netgear DGN1000 (don't know if there is a difference with the others N150 ones... issue 27)Netgear DGN1000[B] N150 (issue 3)Netgear DGN2000B (issue 26)Netgear DGN3500 (issue 13)Netgear DGND3300 (issue 56)Netgear DGND3300Bv2 fwv 2.1.00.53_1.00.53GR (issue 59)Netgear DM111Pv2 ()Netgear JNR3210 (issue 37)Backdoor may be present in:
all SerComm manufactured devices ()Linksys WAG160N ()Netgear DG934 probability: probability: 99.99% ()Netgear WG602, WGR614 (v3 doesn't work, maybe others...) ()Backdoor is not working in:
Belkin F5D7230-4 6000 (SerComm manufactured product) (issue 51)Belkin F9K1002 v3 (SerComm manufactured product)Cisco E2000 fwv 1.0.02 (issue 17)Cisco Linksys E4200 V1 fwv 1.0.05 (issue 18)Cisco Linksys X2000 (issue 40)Cisco EPC3925 Cisco RV082 v03 fw4.2.2.08 (issue 94)Linksys E2500 ()Linksys E3000 fwv 1.0.04 (issue 16)Linksys E3200 Firmware : 1.0.04 (Build 1)Linksys E4200 Firmware : 2.0.26 (issue 53)Linksys RV082 v02 fw2.0.2.01-tm (issue 94)Linksys WAG354G V.2 EU (issue 69)Linksys WRT100 fwv 1.0.00 (Issue 71)Linksys WRT110 fwv 1.0.07 (issue 70)Linksys WRT120N fwv 1.0.07 (@)Linksys WRT160Nv2 (issue 43)Linksys WRT160Nv3 Linksys WRT320N (issue 31)Linksys WRT54GL(v1.1) Firmware v4.30.16Linksys WRT54GS v1.52.8 build 001 (thanks Helmut Tessarek)Linksys WRT600N running 1.01.36 build 3 ( & issue 46)Linksys WRT610N V1 fwv 1.00.03 B15 (issue 60)Netgear CG3100 (issue 6)Netgear CG3700EMR as provided by ComHem Sweden (issue 20)Netgear DG834G v5 (manufactured by Foxconn as opposed to the previous , nice finding anthologist issue 28)Netgear DGN2200Bv3 (V1.1.00.23_1.00.23) (issue 41)Netgear DGN3500 (amod 9.3.1 based on official 1.1.00.34 - )Netgear DGND3700 (issue 33)Netgear DGND4000 (V1.1.00.14_1.00.14) (issue 67)Netgear ProSafe F fwv 3.1.1-14 (thank you Jason Leake :) )Netgear R4500 firmware V1.0.0.4_1.0.3 (issue 64)Netgear R6300 (issue 15)Netgear R7000 ()Netgear RP614v[4,2] V1.0.8_02.02 (issue 22 & issue 24)Netgear (aka. SuperHub) swv 2.38.01 (issue 16)Netgear (aka. SuperHub 2) swv1.01.26 (issue 16)Netgear WGR614v3 (issue 8)Netgear WGR614v7 (thanks "Martin from germany" [your e-mail doesn't work])Netgear WGR614v9 (issue 7)Netgear WN2500RP (issue 15)Netgear WNDR3700 ()Netgear WNDR4000 (issue 10)Netgear WNDR4500 ()Netgear WNR2000v3 (issue 43)Netgear WNR3500L firmware V1.2.2.30_34.0.37 (issue 65)Netgear WNR3500Lv2Sercomm AD81ABASome clarifications:
I didn't want to waste my time in writing a full report, it's a very simple backdoor that really doesn't deserve more than some crappy slides. Moreover, my English is quite bad.
I had a lot of fun in writing / drawing the slides, all the necessary information is in them. If people don't understand them or find them "too full of meme" then - well - it's too bad for them. :)
项目信息
开发语言:Python
Star 数:1292
技术要点
该项目属于黑客技术方向的开源资源,代码结构清晰,适合安全研究人员学习参考。项目围绕some codes and notes about the backdoor listening on TCP-32764 in linksys WAG200G.展开,提供了可运行的实现,对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看,此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论,梳理项目的初始化流程、核心模块职责与数据流转,逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包,解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证,避免影响生产系统。
免责声明
本资源来源于开源社区,仅供安全研究、技术学习与合法授权范围内的攻防演练使用,请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。