• web instance is running as root (I have the hash for the root password thanks to /3tc/shadow, however this is useless as there are no services running on the device that allow logging in)
  
• web instance is using the developer version of lighthttpd 1.4.35
  
• I can't find any log files for shit
  
• RFI not possible
  
• I have no way of telling what the underlying programming language is unless I do some file searching
  
• /pr0c/self/environ exists but doesn't display anything sent in your request
  
• In order to use any LFI to RCE method regarding wrappers, I would have to either bruteforce or somehow find out what the underlying programming language/source code is so that I know what wrappers I'm able to use
  
• including /3tc/release and /3tc/issue returns nothing
  
• /pr0c/version returns "Kernel 1.04.00.00 (Aug 25 2014 - 16:00:55)"
  
• this is a peripheral device
  

(08-05-2016, 03:57 PM)Axari Wrote: Are there any file uploads you can control that are available to you?

(08-05-2016, 07:42 PM)meow Wrote:

(08-05-2016, 03:57 PM)Axari Wrote: Are there any file uploads you can control that are available to you?

Nope.

(08-05-2016, 07:45 PM)Axari Wrote:

(08-05-2016, 07:42 PM)meow Wrote:

(08-05-2016, 03:57 PM)Axari Wrote: Are there any file uploads you can control that are available to you?

Nope.

Shit.
I had another idea; if you have physical access to the device, perhaps you can use /dev/ttyS0 and pipe a script in through serial? (I know it sounds shitty)
Or is this peripheral device remote?

(08-05-2016, 07:46 PM)meow Wrote:

(08-05-2016, 07:45 PM)Axari Wrote:

(08-05-2016, 07:42 PM)meow Wrote: Nope.

Shit.
I had another idea; if you have physical access to the device, perhaps you can use /dev/ttyS0 and pipe a script in through serial? (I know it sounds shitty)
Or is this peripheral device remote?

It's completely remote.

(08-05-2016, 08:43 PM)meow Wrote: asdasdasdtestestestasdasdasdtestestest

(08-05-2016, 08:44 PM)Axari Wrote:

(08-05-2016, 08:43 PM)meow Wrote: asdasdasdtestestestasdasdasdtestestest

Loud and clear.

(08-05-2016, 08:52 PM)meow Wrote:

(08-05-2016, 08:44 PM)Axari Wrote:

(08-05-2016, 08:43 PM)meow Wrote: asdasdasdtestestestasdasdasdtestestest

Loud and clear.

Sorry lol, was trying something out.

Anyways, here's an update:

I was able to log into the admin panel of the device. There was an upload form but didn't allow anything except VALID jpeg files (couldn't bypass it, I tried everything I knew). Then after looking around some more I found a page that lets you import/export the system's configuration. I exported it to see if I could put a Perl reverse shell in there and then include it after importing it, however I'm faced with two problems 1. I don't know where the file is located on the fs, so I wouldn't know the path when including the file and 2. I've tried opening the exported configuration file with 2 different programs and its just unreadable shit. I need something that will give it to me in plaintext.

(08-05-2016, 08:58 PM)Axari Wrote:

(08-05-2016, 08:52 PM)meow Wrote:

(08-05-2016, 08:44 PM)Axari Wrote: Loud and clear.

Sorry lol, was trying something out.

Anyways, here's an update:

I was able to log into the admin panel of the device. There was an upload form but didn't allow anything except VALID jpeg files (couldn't bypass it, I tried everything I knew). Then after looking around some more I found a page that lets you import/export the system's configuration. I exported it to see if I could put a Perl reverse shell in there and then include it after importing it, however I'm faced with two problems 1. I don't know where the file is located on the fs, so I wouldn't know the path when including the file and 2. I've tried opening the exported configuration file with 2 different programs and its just unreadable shit. I need something that will give it to me in plaintext.

I'm pretty familiar with finding vulns directly in firmware tars, so I could take a look if you have a system firmware image, can extract the binaries and throw them in IDA for a quick looksee.