2

I have an AP at home and I'm trying to secure it as much as I can. I found an bug by accident. My AP has 3 ports opened:

  • 22/ssh
  • 53/dns
  • 8081/blackice - icecap

What I found is that my port 8081 is running the lighttpd software for accessing the AP remotely. It wouldn't be anything special, but actually I did an nmap scan and lighttpd is version 1.4.31 which is an insecure version of lighttpd software, because of one specific bug CVE-2013-4559:

I would like to update this software but the AP is not mine. It belongs to my ISP (small local ISP) and he told me that there is no risk at all and he won't update it, at least for now.

Also, he told me that if I'll be able to get the access to it the way that I found in this bug report, he will update the software and I'll get the free month. Well, as you may know from my earlier questions I have a school project and what I'm trying to do is to get the best security on my local network. And actually, if I can get a free month for backdooring my AP and learn something new it would be even better for me.

So, my question is... does anyone know how can I actually get the access from this bug? Because I have no idea how to make this type of backdoor.

I have an access to the AP from my local network. That AP is actually AP+Router and it's also my gateway to ISP so I can't get access from the other side of the network. OS that is running on AP is (if it's needed):

  • Device type: general purpose
  • Running: Linux 2.6.X
  • OS CPE: cpe:/o:linux:linux_kernel:2.6
  • OS details: Linux 2.6.32 - 2.6.35
  • Network Distance: 1 hop
  • Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Also, the AP is connected to my LAN and PoE. Thank you for your advise!

closed as off-topic by schroeder, Xander, TildalWave, Rory Alsop Nov 4 '14 at 15:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – schroeder, Xander, TildalWave, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure we can help you. There is no exploit for this, it has to be done manually in order to get the CGI scripts to crash. What we'd need is access to the scripts that the router is running. – schroeder Nov 3 '14 at 17:42
  • You mean like, you need a sample/copy of those files or you need to access it exactly on that router? – Dawid Zbiński Nov 3 '14 at 17:47
  • I mean that the problem can only be exploited by crashing the software being run, and we'd need access to that software to figure out how to crash it, and then to see if it can be manipulated into elevating access. – schroeder Nov 3 '14 at 17:48
  • Alright, I see the problem here. And I have one more question, just for sure I understand it correctly. in the CVE-2013-4559 there is something like: "which might cause lighttpd to run as root if it is restarted"... it means that we need to crash whole thing's software (wireless AP) or crash just the lighttpd software ? – Dawid Zbiński Nov 3 '14 at 17:53
  • 1
    Crash the lighttpd service. It looks like it might restart as root instead of www-user. – schroeder Nov 3 '14 at 18:00