Hacking WRT54G with Linux Presentation Prepared By:Dan Scarberry TJ Dziedzinski Jeremy Leung 2114

Overview First, it relies on the linksys bug in the ping utility The ping hack is done as follows: 1. Go to the System tab of the router config. 2. Hit the "ping test" button. 3. Anything that is included in the "IP Address or Domain Name" box will be executed once you hit ping, providing the command is enclosed with ` ` marks, ie `/usr/sbin/wl - i eth2 txpwr 84`

Overview Cont. Two types of installs –RAM DiskRAM Disk –Creating Your Own FirmwareCreating Your Own Firmware –A Pre-built Firmware UpgradeA Pre-built Firmware Upgrade –Router Hardware: 125mhz MIPS Processor 16 megs ram Kernel 2.4.5

WTF ?

RAM Disk Install Use to download softwarewww.batbox.org/wrt54g-linux.html Can install with Linux or OSX(they are almost the same) 1. Modify the script called wrt54g.sh to change the ip address and password of the router It uses Java. If you prefer to use WGet, just un- comment the line in the script ***The script is unknown of working with the new version of linksys, but you can download and update from their site. This one is being tested on ***

Editing the Script Open the file with the command: Nano Wrt54g.sh To use WGet uncomment these lines: # PROGRAM="wget --quiet --http- user=$USER --http-passwd=$PASSWORD" # EXTRA="" # if you want to use curl, uncomment this #PROGRAM="curl --silent --output /dev/null -- user admin:$PASSWORD" #EXTRA="“

Router Identification Insert your router’s IP address here: # the IP address of your wrt54g HOST= And its login password here: # the login password on your wrt54g PASSWORD=YourPassword Close script and save changes

Piecing Together Your Package 2. Before executing the script you’ll decide what packages to include: The file that you download is called distro.tar UnTar it and then you can add or subtract files from it. By default it has an SSH, Snort, and iptraf Re-Tar the file when done. You want to power cycle the router to clear the ram disk after each execution of the script

Running the Script Still at the console type in “./wrt54g.sh” Run that and you should see a screen that says: - Installing to Making copy of receive tool - Starting receive tool - Sending bootstrap After that, you should be able to Remotely Connect to the box. Menu

WTF ?

Creating Your Own Firmware -Check out this site for a complete guide on using CramFS to create your own: ad-a1fd58ae09a5a3081e9851a6c18cccd65529da88 -Or you can use wrtgen at this site: And those will create your binaries for ya Menu

WTF ?

Pre-built Firmware Upgrade We can go with a prebuilt binaries from companies such as sveasoft – –Quick, Easy, and it has a huge amount of great utilities SSH, Telnet, Cron,WDS You can clear everything on the network by DNS(names) Or you can create your own by using programs such as CramFS and WrtGen –Advantages of creating your own is that you can do bad things like Trojans, backdoors, etc. Or good things like customizing to your liking

Pre-built Firmware Install -This site has links to where to download the firmware for free: We’re going to be using Sveasoft.Firmware.Alchemy_6rc5 Unzip the zip file Log Into Your Router Find the Firmware Upgrade Tab Click on browse and navigate to the bin file that you extracted from the zip file Then power off the router Turn it on and check out the services Try putting programs on it –Kismet - Rasmus’s Toy Page –WinSCP