WRT600N tracert exploit with stock Linksys firmware

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3 ... 5, 6, 7 ... 19, 20, 21  Next
Author Message
shurik
DD-WRT User


Joined: 17 Feb 2008
Posts: 52

PostPosted: Mon Apr 21, 2008 21:14    Post subject: Re: Firm Backup Reply with quote
crazycracker wrote:
CryptoNews wrote:
Hi,

someone (with the know how) can write five lines with the instructions to backup an installed firm?

I can do it because I'm very noob to do it, Linux knowledge is quite low.....


well from openwrts wiki you can back up the stuff with
Code:

dd if=/dev/mtdblock/1 > /tmp/firmware.trx
dd if=/dev/mtdblock/3 > /tmp/nvram.bin


and im not sure exactly which programs are in the "build 5" to send those files off the router but if it has netcat ftpput scp or something on it to get them to another computer so if someone with "built 5" can post a listing of all the programs on a "built 5" so we know how to tell you to get the files off the router


I do not know how to extract files from "/tmp/" so I tried to save on USB. However, it creates only empty files. It is a build 5 FW and before trying dd-wrt I would like to hve a copy.

dd if=/dev/mtdblock/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtdblock/3 > /tmp/memstick/host0_part1/test/nvram.bin
Sponsor
crazycracker
DD-WRT Novice


Joined: 04 Jul 2006
Posts: 49

PostPosted: Mon Apr 21, 2008 22:42    Post subject: Re: Firm Backup Reply with quote
shurik wrote:
crazycracker wrote:
CryptoNews wrote:
Hi,

someone (with the know how) can write five lines with the instructions to backup an installed firm?

I can do it because I'm very noob to do it, Linux knowledge is quite low.....


well from openwrts wiki you can back up the stuff with
Code:

dd if=/dev/mtdblock/1 > /tmp/firmware.trx
dd if=/dev/mtdblock/3 > /tmp/nvram.bin


and im not sure exactly which programs are in the "build 5" to send those files off the router but if it has netcat ftpput scp or something on it to get them to another computer so if someone with "built 5" can post a listing of all the programs on a "built 5" so we know how to tell you to get the files off the router


I do not know how to extract files from "/tmp/" so I tried to save on USB. However, it creates only empty files. It is a build 5 FW and before trying dd-wrt I would like to hve a copy.

dd if=/dev/mtdblock/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtdblock/3 > /tmp/memstick/host0_part1/test/nvram.bin



thats strange cause i have used those commands on lots of routers with dd-wrt and with openwrt and its worked fine um can you try
Code:

ls /dev/mtdblock

and post what it says cause i just want to know whats in there
and
Code:

mount

and post the results

and
Code:

df

and post the results


and just curious after those commands did it tell you something like
Quote:

15744+0 records in
15744+0 records out

or any numbers in and out other then 0
alankligman
DD-WRT Novice


Joined: 21 Apr 2008
Posts: 9

PostPosted: Mon Apr 21, 2008 22:49    Post subject: no ethernet ports Reply with quote
bubsterboo wrote:
I have managed to downgrade a 600n from build 5 to build 3. Then flashed to DD-WRT. I can't seem to get my ethernet ports to work. No matter how many hard resets i do.


I'm also having this issue. I'm running build 9419 (EKO).
shurik
DD-WRT User


Joined: 17 Feb 2008
Posts: 52

PostPosted: Mon Apr 21, 2008 23:07    Post subject: Reply with quote
crazycracker that's what I get:

ls /dev/mtdblock

0
1
2
3
4

mount

/dev/root on / type squashfs (ro)
none on /dev type devfs (rw)
proc on /proc type proc (rw)
ramfs on /tmp type ramfs (rw)
none on /proc/bus/usb type usbfs (rw)
/dev/scsi/host0/bus0/target0/lun0/part1 on /tmp/memstick/host0_part1 type vfat (rw)
/dev/scsi/host0/bus0/target0/lun0/part1 on /tmp/ftproot/ftp type vfat (rw)

df

Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 5504 5504 0 100% /
/dev/scsi/host0/bus0/target0/lun0/part1 127716 8 127708 0% /tmp/memstick/host0_part1
/dev/scsi/host0/bus0/target0/lun0/part1 127716 8 127708 0% /tmp/ftproot/ftp
jmh9072
DD-WRT Guru


Joined: 04 Sep 2007
Posts: 800
Location: Ohio

PostPosted: Tue Apr 22, 2008 0:58    Post subject: Reply with quote
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin

_________________
WRT54G v3 - v24 r14471M NEWD Eko - AP
WRT350N v1.0
WRT600N v1.1 - halfway there!
Se7en is Darker...
Transient
DD-WRT User


Joined: 16 Jun 2006
Posts: 91

PostPosted: Tue Apr 22, 2008 5:41    Post subject: Re: no ethernet ports Reply with quote
alankligman wrote:
bubsterboo wrote:
I have managed to downgrade a 600n from build 5 to build 3. Then flashed to DD-WRT. I can't seem to get my ethernet ports to work. No matter how many hard resets i do.


I'm also having this issue. I'm running build 9419 (EKO).


Hmm, I'd recommend submitting a bug report to make sure the issue is addressed.

It sounds like Linksys has changed the hardware on some (but not all) v1.1's, which they're notorious for doing. Mad
Transient
DD-WRT User


Joined: 16 Jun 2006
Posts: 91

PostPosted: Tue Apr 22, 2008 6:06    Post subject: Telnet access Reply with quote
If anyone is interested, I've managed to gain basic telnet access under the standard Linksys firmware. I find it's easier to work with.

I'm using a simple program called door which is written by midnightcode.org. I tried to get utelnetd and dropbear working, but no luck there so far.

Anyway, to use simply extract the attached zip and put on your USB memory stick. Plug it into your router, go to the Traceroute page and then put the following command in your brower's address bar:

Code:
javascript:var d=document.forms[1];d.tracertstr.value='192.168.1.1;/tmp/memstick/host0/door &';d.submit();


Of course that assumes your memory stick is mounted at /tmp/memstick/host0. If not, change as appropriate.

Also, my browser seems to process the above command forever, but don't worry it works anyway. Just click to another page.

A few important notes:

- telnet server operates on port 2323
- telnet server is WIDE OPEN (no password). be sure to kill it when you're done (or simply reboot router)
- I recommend PuTTY to connect, rather than the standard Windows telnet client (try it, you'll see why). Included in the zip file is a PuTTY Windows registry entry with door preconfigured.
- Lastly, all commands must end with a ;. So instead of typing "ls -l /tmp" you need to type "ls -l /tmp;". Yes, it's a pain in the butt. I think it's because Linksys uses MSH. Maybe I'll try to fix it later.



door.zip
 Description:
-door- with PuTTY config

Download
 Filename:  door.zip
 Filesize:  9.03 KB
 Downloaded:  656 Time(s)

shurik
DD-WRT User


Joined: 17 Feb 2008
Posts: 52

PostPosted: Tue Apr 22, 2008 7:01    Post subject: Reply with quote
jmh9072 wrote:
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


Tried it. Still the same result with empty files.
Transient
DD-WRT User


Joined: 16 Jun 2006
Posts: 91

PostPosted: Tue Apr 22, 2008 7:22    Post subject: Reply with quote
shurik wrote:
jmh9072 wrote:
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


Tried it. Still the same result with empty files.


There's no "dd" command, unfortunately Sad. Try cat instead:

Code:
cat /dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
cat /dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin
crazycracker
DD-WRT Novice


Joined: 04 Jul 2006
Posts: 49

PostPosted: Tue Apr 22, 2008 15:19    Post subject: Reply with quote
Transient wrote:
shurik wrote:
jmh9072 wrote:
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


Tried it. Still the same result with empty files.


There's no "dd" command, unfortunately Sad. Try cat instead:

Code:
cat /dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
cat /dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


yah thats why i was hoping somone could post the files on "build 5" routers from my other post
could you post a list of the files in
/bin
/sbin
/usr/bin
/usr/sbin


and post what they built busybox with im pretty sure that just running "busybox" will show you it after i think "Currently defined functions"



also this stuff came at a bad week cause its april vacation so i cant spend alot of time screwing around with this stuff well technically i could but i'm not going to[/quote]
Transient
DD-WRT User


Joined: 16 Jun 2006
Posts: 91

PostPosted: Tue Apr 22, 2008 15:38    Post subject: Reply with quote
Using the cat commands top dump the firmware should work. I tried it on my "build 3" and was able to do it successfully anyway.
shurik
DD-WRT User


Joined: 17 Feb 2008
Posts: 52

PostPosted: Tue Apr 22, 2008 16:49    Post subject: Reply with quote
Transient wrote:
shurik wrote:
jmh9072 wrote:
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


Tried it. Still the same result with empty files.


There's no "dd" command, unfortunately Sad. Try cat instead:

Code:
cat /dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
cat /dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


unfortunately the same effect: empty files. this time tried both mtd and mtdblock folders. any more ideas on how to backup firmware?
alankligman
DD-WRT Novice


Joined: 21 Apr 2008
Posts: 9

PostPosted: Tue Apr 22, 2008 17:24    Post subject: Re: no ethernet ports Reply with quote
Transient wrote:
alankligman wrote:
bubsterboo wrote:
I have managed to downgrade a 600n from build 5 to build 3. Then flashed to DD-WRT. I can't seem to get my ethernet ports to work. No matter how many hard resets i do.


I'm also having this issue. I'm running build 9419 (EKO).


Hmm, I'd recommend submitting a bug report to make sure the issue is addressed.

It sounds like Linksys has changed the hardware on some (but not all) v1.1's, which they're notorious for doing. Mad


Logged (issue #0003055). However, that wouldn't necessarily explain why the WAN port is working, but not the LAN ports.


Last edited by alankligman on Tue Apr 22, 2008 23:55; edited 1 time in total
CryptoNews
DD-WRT Novice


Joined: 07 Jun 2006
Posts: 38

PostPosted: Tue Apr 22, 2008 18:01    Post subject: Reply with quote
crazycracker wrote:
Transient wrote:
shurik wrote:
jmh9072 wrote:
Try these commands:
Quote:
dd if=/dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
dd if=/dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


Tried it. Still the same result with empty files.


There's no "dd" command, unfortunately Sad. Try cat instead:

Code:
cat /dev/mtd/1 > /tmp/memstick/host0_part1/test/firmware.trx
cat /dev/mtd/3 > /tmp/memstick/host0_part1/test/nvram.bin


yah thats why i was hoping somone could post the files on "build 5" routers from my other post
could you post a list of the files in
/bin
/sbin
/usr/bin
/usr/sbin


and post what they built busybox with im pretty sure that just running "busybox" will show you it after i think "Currently defined functions"



also this stuff came at a bad week cause its april vacation so i cant spend alot of time screwing around with this stuff well technically i could but i'm not going to
[/quote]

Hi,

find attached the list of th directories asked



File_list.txt
 Description:

Download
 Filename:  File_list.txt
 Filesize:  13.18 KB
 Downloaded:  627 Time(s)

shurik
DD-WRT User


Joined: 17 Feb 2008
Posts: 52

PostPosted: Tue Apr 22, 2008 18:04    Post subject: Reply with quote
CryptoNews wrote:

find attached the list of th directories asked


I was about to post the list but noticed that you were faster than me!
Goto page Previous  1, 2, 3 ... 5, 6, 7 ... 19, 20, 21  Next Display posts from previous:    Page 6 of 21
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum