In my previous post, I demonstrated how to gain root access by enabling a Telnet daemon via the routers AT-over-TCP interface. In this post I will close this gasping security hole by replacing the Telnet with a Secure Shell (SSH) daemon. Netgear’s firmware does not ship with a SSH daemon itself. So we first build a statically linked Dropbear instead of the rather heavy OpenSSH daemon.

Building Dropbear SSH

Section titled “Building Dropbear SSH”

I’ve build a statically linked version of Dropbear using a Debian-based Docker image as it allows us to use the packaged cross-compiler toolchains by Debian:

FROM debian:bullseyeRUN apt-get update && \    apt-get -y install \        wget tar bzip2 build-essential \    gcc-arm-linux-gnueabihf \    binutils-arm-linux-gnueabihfRUN wget https://matt.ucc.asn.au/dropbear/releases/dropbear-2022.82.tar.bz2RUN tar xvf dropbear-2022.82.tar.bz2WORKDIR /dropbear-2022.82ENV CC=arm-linux-gnueabihf-gccENV CFLAGS="-DDROPBEAR_SVR_PASSWORD_AUTH=0"RUN ./configure --host=arm-linux-gnueabhf \    --disable-zlib \    --disable-shadow \    --disable-syslog \    --disable-lastlog \    --enable-staticRUN make PROGRAMS="dropbear scp" MULTI=1RUN arm-linux-gnueabihf-strip dropbearmulti

With this Dockerfile we can build the image, create a temporary container and copy the resulting binary from the image to your local folder:

docker build -t dropbear .id=$(docker create dropbear)docker cp ${id}:/dropbear-2022.82/dropbearmulti ./docker rm ${id}

Installing Dropbear

Section titled “Installing Dropbear”

Now that we have a statically linked version of the SSH daemon, we will need to copy it to our target. I accomplished this by using netcat (nc):

mkdir -p /data/mod/binpushd /data/mod/binnc -l -p 1234 > dropbearmultichmod +x dropbearmultiln -s dropbearmulti dropbearln -s dropbearmulti scp

On the machine which builds Dropbear

Section titled “On the machine which builds Dropbear”

nc <ip-of-target> 1234 < dropbearmulti

This is followed by installing a SystemD service which start the SSH daemon on system boot:

cat > /etc/systemd/system/dropbear.service <<EOF[Unit]Description=Dropbear SSH serverAfter=network.target[Service]Type=forkingExecStart=/data/mod/bin/dropbear -RPIDFile=/var/run/dropbear.pid[Install]WantedBy=multi-user.targetEOFsystemctl daemon-reloadsystemctl enable --now dropbear.service

Before you will be able to connect to the target, you will need to install an authorized_keys file. Password login is not supported.

mkdir -p /home/root/.sshcat > /home/root/.ssh/authorized_keys <<EOFssh-rsa AAAAB3NzaC1...GaoxPrQ== # replace by your SSH keyEOF

All that remains is a quick test:

ssh root@<ip-of-target>

Disable SSH daemon

Section titled “Disable SSH daemon”

In order to restore the security of the device we must also disable the Telnet daemon. There are in principle two options to achieve this:

• Reverse the steps from my first blog post via the AT-over-TCP interface.
• Use the iptables firewall to block access to the Telnet port

I’ve decided to go for the second option:

cat > /etc/systemd/system/block-telnet.service <<EOF[Unit]Description=Block Telnet accessAfter=network.target[Service]Type=simpleExecStart=/usr/sbin/iptables -I INPUT -p tcp --dport telnet -j DROPExecStop=/usr/sbin/iptables -D INPUT -p tcp --dport telnet -j DROP[Install]WantedBy=multi-user.targetEOFsystemctl daemon-reloadsystemctl enable --now block-telnet.service