5

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 )
Just out of curiosity about what I would find, I tried to send some commands to it and it also worked on the first attempt. Something like ls or ifconfig was funny to see from it... until I tried the ps command which printed out the following:

PID USER       VSZ STAT COMMAND
    1 0          592 S    init                
    2 0            0 SW   [kthreadd]
    3 0            0 SW   [ksoftirqd/0]
    4 0            0 SW   [events/0]
    5 0            0 SW   [khelper]
    6 0            0 SW   [async/mgr]
    7 0            0 SW   [sync_supers]
    8 0            0 SW   [bdi-default]
    9 0            0 SW   [kblockd/0]
   10 0            0 SW   [cfg80211]
   11 0            0 SW   [rpciod/0]
   12 0            0 SW   [kswapd0]
   13 0            0 SW   [aio/0]
   14 0            0 SW   [nfsiod]
   15 0            0 SW   [crypto/0]
   21 0            0 SW   [mtdblockd]
   60 0         1368 S    xmldb -n wrgn49_dlob_dir600b -t 
   61 0          888 S    servd -d schedule_off 
  177 0          852 S    logd -p notice 
  178 0          828 S    klogd -p notice 
  185 0          852 S    gpiod 
  453 0          996 S    /var/run/fakedns --port=63481 --address=/#/1.33.203.3
  490 0          872 S    ddnsd 
  502 0          832 S    telnetd -l /usr/sbin/login -u Alphanetworks:wrgn49_dl      
  510 0          592 S    init                
  693 0            0 SW   [RtmpCmdQTask]
  700 0         1008 S    hostapd /var/servd/hostapd-ra0.conf 
  701 0          852 S    updatewifistats -i ra0 -x /phyinf:3 -r /runtime/phyin
  723 0          836 S    portt -c DNAT.PORTT 
 1127 0          988 S    udhcpc -i eth2.2 -H dlinkrouter -p /var/servd/WAN-1-u
 1656 0          852 S    neaps -i br0 -c /var/run/neaps.conf 
 1665 0          828 S    netbios -i br0 -r dlinkrouter 
 1666 0          844 S    llmnresp -i br0 -r dlinkrouter 
 1683 0         1012 S    udhcpd /var/servd/LAN-1-udhcpd.conf 
 1769 0          960 S    lld2d -c /var/lld2d.conf br0 ra0 
 1853 0         1008 S    proxyd -m 1.33.203.39 -f /var/run/proxyd.conf -u /var
 1944 0          984 S    dnsmasq -C /var/servd/DNS.conf 
 1973 0         1508 S    httpd -f /var/run/httpd.conf 
 4379 0          968 S    /usr/sbin/phpcgi /htdocs/web/command.php 
 4380 0          692 S    sh -c ps >> /var/cmd.result 
 4381 0          592 R    ps

Here I am especially concerned about the telnetserver (pid 502), the fakedns (pid 453) and also the cockiness of my provider, providing a router that is not updated for security vulnerabilities anymore, and taking my money for renting that box to me...
So the first thing to do was to kill all those suspicious processes but, as expected, after a reboot of the machine everything was like before, up and running. I checked several standard config-files but they seemed normal..

So my questions are now: is my router seriously compromised? Is it enough to prevent those processes from starting up? Did I miss something? Also this "xmldb" (pid 60) seems kind of suspicious to me.

Improve this question
8
  • 1
    Does your router have a "reset" button to revert to factory resets? This looks completely compromised. You need to get a new router or a new provider.
    – schroeder ♦
    Commented Sep 10, 2015 at 19:42
  • @schroeder "completely compromised" how? I am curious
    – Ulkoma
    Commented Sep 10, 2015 at 20:03
  • If after a reboot, the fakedns code is still running, it will be impossible to determine how far the intrusion goes. Things are persisting. Time to nuke the thing from orbit.
    – schroeder ♦
    Commented Sep 10, 2015 at 20:10
  • 1
    @Ulkoma You also have fakedns and proxyd pointing to the same IP: 1.33.203.3 (Japan)
    – schroeder ♦
    Commented Sep 10, 2015 at 20:15
  • 2
    +1 to @schroeder for "nuke from orbit" (i.e.: hard reset). Look around some third-party firmware sites for instructions on flashing back to the factory default image. Usually it's something like a "30/30/30" process. If that doesn't clear the badware out, time for a new router. A new ISP wouldn't be a bad idea either. And just never trust the ISP's router in general - put your own behind it.
    – Iszi
    Commented Sep 10, 2015 at 20:28

1 Answer 1

Reset to default
2

When you run ps the output is the current running process list. Sometimes this will list the process including the command line arguments used to start the process. Here are some possibly dangerous looking commands from your output:

  453 0          996 S    /var/run/fakedns --port=63481 --address=/#/1.33.203.3
  502 0          832 S    telnetd -l /usr/sbin/login -u Alphanetworks:wrgn49_dl       
 1127 0          988 S    udhcpc -i eth2.2 -H dlinkrouter -p /var/servd/WAN-1-u
 1853 0         1008 S    proxyd -m 1.33.203.39 -f /var/run/proxyd.conf -u /var
 1944 0          984 S    dnsmasq -C /var/servd/DNS.conf 
 4379 0          968 S    /usr/sbin/phpcgi /htdocs/web/command.php 
 4380 0          692 S    sh -c ps >> /var/cmd.result
  • I see fakedns is pointing all of your dns requests to 1.33.203.3.
  • Telnet accepting connections from only Alphanetworks.
  • It appears as if your traffic is being proxied to 1.33.203.39 (can't find any documentation on the -m flag).
  • You have a php page running under the name "command.php" I would suggest checking out the source code to that file.
  • The output of 'ps' is being appended to cmd.result (that may have been you).

In a possibly related note a google search for "proxyd -m" returns this gist.

If any/all of this seems phishy to you, I suggest factory resetting your device. If there are no available patches for your device see if you can load any open source firmwares (such as OpenWRT) and confirm the hash of the image when you download it.

Improve this answer
6
  • thanks for the analysis :) yes that telnet credentials are from a standard passwordlist from backtrack i found out until now. this "command.php" was also what granted me today the access to the routers cli This proxyd is seems pretty tough to me... i kill the process - it starts again... there is also a dynamic dns running as far as i can see, ddnsd. Maybe here i can find out something about where this goes?
    – fab
    Commented Sep 10, 2015 at 21:49
  • so unfortunately for my hardware version of this shi*** dlink router, there is no wrt image available :-( the reset with the reset button did nothing, everything is still there..
    – fab
    Commented Sep 10, 2015 at 22:44
  • How out of date is this thing? You don't need WRT or any other open source stuff, just the latest factory firmware if it has been patched and reload it. The reset button merely clears the configuration memory, so whatever's been flashed is still there. If properly patched firmware isn't available for reload, smash it with a hammer and send it out in the first garbage pickup so someone else doesn't get bitten.
    – Fiasco Labs
    Commented Sep 11, 2015 at 3:54
  • Ok tonight, after work, i will try to flash the factories firmware. I will let you know about the results
    – fab
    Commented Sep 11, 2015 at 11:04
  • The outcome is, that i found a newer firmware but i cannot telnet into the router anymore to check if those backdoors are really gone now... Does someone has an idea how to verify the removal of that stuff? I guess the initial entry point for all of this, command.php is fixed now, posts to this file seem not to do anything anymore
    – fab
    Commented Sep 12, 2015 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .