{"id":152,"date":"2023-10-19T02:03:57","date_gmt":"2023-10-19T02:03:57","guid":{"rendered":"https:\/\/thered0ne.com\/?p=152"},"modified":"2025-12-29T19:32:10","modified_gmt":"2025-12-29T19:32:10","slug":"smart-rg-router-not-that-smart","status":"publish","type":"post","link":"https:\/\/thered0ne.com\/?p=152","title":{"rendered":"Adtran – Smart\/RG Router Not That Smart !"},"content":{"rendered":"\n

Disclaimer<\/strong>: The first thing I will tell you is any actions made by using the code contained in this article are solely your responsibility not mine. This article is written to show you only my methodology, how do I approach routers for finding vulnerabilities and not how to hack into someone’s router. <\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

$ Introduction:<\/strong> <\/h2>\n\n\n\n

Hello again in this new article. I cooked something special this time ! I found a 0day !<\/p>\n\n\n\n

This will be about a specific router called Smart\/RG manufactured by AdTran <\/strong>company. This device uses the open source OpenWRT project. What I understood is each ISP can do whatever they want with their equipments. My ISP implemented the OpenWrt in their solutions and they changed\/added some features for managing the router, monitoring, remote access and logging… <\/p>\n\n\n\n

I will show in this article how I managed to exploit a vulnerability in the router and how I deal with embedded devices in general…<\/p>\n\n\n\n

<\/p>\n\n\n\n

$ <\/strong>Goals:<\/h2>\n\n\n\n

Throughout this article, you will understand how:<\/p>\n\n\n\n

    \n
  • I found the vulnerability Command injection<\/strong><\/li>\n\n\n\n
  • I analyzed the router for credentials \/ Backdoors \/ Hidden Users.<\/li>\n\n\n\n
  • JUCI \/ LUCI \/ UCI \/ UBUS \/ RPCD \/ JSON-RPC works.<\/li>\n\n\n\n
  • Netdata <\/strong>helped me escalate the vulnerability.<\/li>\n\n\n\n
  • I build the exploit code.<\/li>\n<\/ul>\n\n\n\n

    <\/p>\n\n\n\n

    <\/p>\n\n\n\n

    $ <\/strong>The Raaaouter baby ! <\/h2>\n\n\n
    \n
    \"\"
    Smart\/RG sr400ac\/ad<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

    A description from the manufacturer:<\/strong><\/h4>\n\n\n\n
    \n

    The SR400ac is a carrier-grade Ethernet router, equipped with a Gigabit Ethernet WAN port, a Dual-Band Wi-Fi Access Point using the latest 802.11ac technology, and four Gigabit Ethernet ports for LAN connection. <\/em> <\/p>\n\n\n\n

    The SR400ac’s Dual-Band Wi-Fi technology simultaneously uses both the 2.4GHz and 5GHz bands via six internal high-gain antennas fed by six individual high-power amplifiers.<\/em><\/p>\n\n\n\n

    Coupled with the SmartRG AccuBeam technology, the SR400ac delivers high wireless speeds as well as whole-home coverage, even in periods of heavy network use.<\/em><\/p>\n\n\n\n

    Regardless of your IPTV middleware platform, the SR400ac comes fully equipped for the task, with features such as IGMPv2\/v3\/MLD Snooping and Proxy, Advanced Multicast traffic handling, and dynamic\/static VLAN mapping\/tagging. The SR400ac assures Quality of Service is maintained in the triple play environment, delivering a high quality UHD IPTV experience.<\/em><\/p>\n<\/div><\/div>\n\n\n\n

    <\/p>\n\n\n\n

    The hardware seems pretty good right ? but everything is about the software though. Don’t be fooled by the surface ! Let’s look under the hood:<\/p>\n\n\n\n

    User Interface: <\/strong> <\/h4>\n\n\n
    \n
    \"\"
    Login page<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

    <\/p>\n\n\n\n

    \"\"
    Dashboard<\/em><\/figcaption><\/figure>\n\n\n\n

    To be honest, I like the UI is pretty well done and it gives you all the details about your traffic. The dashboard you’re seeing is a from an open source project called Netdata<\/strong>. Netdata <\/strong>is designed to collect real-time metrics, such as CPU Usage … Well all activities and display them in intuitive way.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    <\/p>\n\n\n\n

    I admit it, it’s a pretty UI they have. However, this Netdata <\/strong>dashboard helped me a lot to escalate my vulnerability !<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    $ <\/strong>The vulnerability ! <\/h2>\n\n\n\n

    This is getting interesting ! If you are familiar with hacking especially hacking IoT devices or routers, you will know that most hackers are not interested in client-side attacks such as XSS, CSRF… But rather in RCEs or Hardware hacking. The common one is to root the device to find internal vulnerabilities like the one I found: Command Injection<\/strong>. Of course you can find all theses mentioned vulnerabilities but most hackers will search first for the ones that have a great impact.<\/p>\n\n\n\n

    In the world of IoT there are other ways of hacking, doing it the hard way: It’s called “rooting the device”<\/strong>. What you do is you open the device up and you search for a two specific connectors\/ports:<\/p>\n\n\n\n

      \n
    • UART<\/li>\n\n\n\n
    • JTAG<\/li>\n<\/ul>\n\n\n\n

      For UART (Universal asynchronous receiver-transmitter) is a serial communication in which the data will be sent bit by bit.<\/p>\n\n\n\n

      \"\"
      UART data frame<\/em><\/figcaption><\/figure>\n\n\n\n

      <\/p>\n\n\n\n

      \"\"
      UART connector<\/em><\/figcaption><\/figure>\n\n\n\n

      Is really easy to root these device by just using an Arduino or a serial module via USB. The most of time this is my last resort when I can’t find the firmware in internet or a user which allows to me be root on my device that I bought.<\/p>\n\n\n\n

      <\/p>\n\n\n\n

      The second port is JTAG<\/strong> (Joint Test Action Group). This JTAG is mainly used to verify and testing printed circuit boards to see if there isn’t any bug or something that can crash the system. However, since this port is kept after the manufacture, hackers use it to execute command too but not for testing but for extracting the firmware, change it or to understand better how the device work for further vulnerabilities.<\/p>\n\n\n\n

      <\/p>\n\n\n

      \n
      \"\"
      JTAG connector<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

      Enough of electronic stuff ! Let’s go to main subject… \ud83d\ude42<\/p>\n\n\n\n

      There are numerous topics related to hardware hacking that are beyond the scope of this article. To delve deeper, simply search ‘UART hardware hacking’ in your preferred search engine and explore the wealth of information available.<\/p>\n\n\n

      \n
      \"\"<\/figure>\n<\/div>\n\n\n
      \n\n\n\n

      Let’s go back to our router, shall we?<\/p>\n\n\n\n

      \"\"
      Diagnostic page<\/em><\/figcaption><\/figure>\n\n\n\n

      This is where every researcher go first. That’s what I did too I’m no exception at all. If you are familiar with this, you will know surely what’s coming next. If you don’t know, that’s okay ! That’s the purpose of this article \ud83d\ude09<\/p>\n\n\n\n


      Running the ping command in the usual manner yields the following result:<\/p>\n\n\n

      \n
      \"\"
      Ping command<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

      The trick here is the IP is concatenated with a real ping<\/strong> command in the router’s OS. Our goal is to inject another command along with the ping command and execute them both.<\/p>\n\n\n\n

      I tried to inject “;” but it didn’t work. It just didn’t execute. No error, nothing.<\/p>\n\n\n

      \n
      \"\"<\/figure>\n<\/div>\n\n\n

      I tried different combinations such as :<\/p>\n\n\n\n

      <\/circle><\/circle><\/circle><\/g><\/svg><\/span>