Several topics here.
-
There seems to be a remote code execution shell (busybox --> ash) embedded in the linux kernel that allows arbitrary command of the router via connection with a master server.
-
Reinstalling OpenWRT or reverting to factory firmware does not correct the issue.
-
the file structure of the OpenWRT firmware image has nested directories and symlinks that override settings in Luci.
-
I decided to disconnect from internet, leave the OpenWRT settings default and then pipe some commands for ash to execute in the event the bootloader was backdoored. Then I reconnected to the internet. Here's some of the output I got in my Putty terminal:
Decompress to stdoutâ–’â–’recv(%s) errormalformed packet received from %s: size %ure ply from %s: peer is unsyncedreply from %s: delay %f is too high, ignoringreply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f re ach:0x%02xwant smaller interval: offset/jitter = %udeficit %d, rta_len=%d!recvse nd failedresponded to query from %sduplicate peer %s (%s)ntpdsending query to %s timed out waiting for %s, reach 0x%02x, next query in %uspoll:%us sockets:%u int erval:%usperiodicunsync
--- %s ping statistics ---
%lu packets transmitted, %lu packets received, %lu duplicates, %lu%% packet loss
round-trip min/avg/max = %u.%03u/%u.%03u/%u.%03u ms
command line is not complete, try "help"duplicate "%s": "%s" is the second value resolving %sgateway %s is a NETWORKnetmask %.8x and host route conflictbogus net mask %snetmask and route address conflictSIOCADDRTSIOCDELRT/proc/net/psched%*08x %*08x%08x%08x/proc/net/ipv6_routeNext HopDestinationKernel IPv6 routing table
%-44s%-40sFlags Metric Ref Use Iface
%32s%x%*s%x%32s%x%x%x%x%s
%-43s %-39s %-5s %-6d %-2d %7d %-8s
OUT-OF-RANGE
%04x:
%d bytes from %s to %s: icmp type %u (%s) code %u
%02xIPV6_CHECKSUMsetsockopt(%s)SO_SNDBUFTOSsetsockopt(%s,%d)can't set multicast source interfacegetsocknametraceroute to %s (%s), %d hops max, %d byte packets
%2dUNICAST_HOPSsetsockopt(%s) %dTTLsent %d octets, ret=%d *packet too short (%d bytes) from %s
%s (%s) %d bytes to %s %u.%03u ms ! !N !H !P !F-%d !S !A !C !V !U !I !T !<%d> ERROR truncatedcan't send flush requestnonecan't talk to rtnetlinkOVERRUNEOF on netlinksender address length == %dtruncated messagemalformed message: len=%d!RTN ETLINK answersunexpected reply!message truncatedremnant of size %d!if%dnil ifnam eDeleted %d: %s@NONE: @%s: NO-CARRIER,,M-DOWNmtu %u qdisc %s master %s state %s SIOCGIFTXQLENqlen %d[%d]%c link/%s peer brd can't find device '%s'/etc/ipro ute2/rt_%sdatabase %s is corrupted at line %dprotosglobalnowheresitescopesrealms dsfieldtables???%u: %s inet inet6 family %d peer %s/%d brd %s any %s scope %s secondary tentative dadfailed deprecated dynamic noprefixroute flags % 02x valid_lft forevervalid_lft %dsec preferred_lft forever preferred_lft %dsec %snot RTM_NEWNEIGH: %08x %08x %08xBUG: wrong nlmsg len %ddev %s lladdr %s r outer proxy ref %d used %d/%d/%d probes %u%cINCOMPLETE%cREACHABLE%cSTALE%cDELAY% cPROBE%cFAILED%cNOARP%cPERMANENTNot a route: %08x %08x %08x
default from %s/%u from %s from 0/%u via %s table %s src %s metric %d dead onl ink pervasive notify %c cache expires %dsec error %d iif %s%u: from %s/ %u0/%dto %s/%u to 0/%d tos %s fwmark %#x/%#x fwmark %#x iif %s lookup %s %s %d r ealms %s/map-to %s masquerade (DUP!)%d bytes from %s: seq=%u ttl=%d time=%u.%03u ms MSS Window irttMetric Ref Use/proc/net/routeKernel IP routing table
Destination Gateway Genmask Flags %s Iface
%*[^
]
%63s%lx%lx%X%d%d%d%lx%d%d%d
%-15.15s %-15.15s %-16s%-6s%5d %-5d %6d %s
%-6d %-2d %7d %s
-net-hostA:nedump terminatedany"%s" is invalid lladdrprefix"%s" may be inet %s, but it is not allowed in this contextan %s %s is expected rather than "%s""ip ne igh flush"nud stateflush terminatedNothing to flush*** Flush is complete after % d round(s) ***
*** Round %d, deleting %d entries ***
*** Flush not complete bPuTTYailing out after %d roundscan't send dump requestne ed at least destination addressnot a route?wrong len %dcan't connect the routeca n't flush link addressesscopeeither "%s" is duplicate, or "%s" is garbage"ip rou te flush"protocoltable-1can't flush routing cacheneed "dev IFACE""dev" (%s) must match "label" (%s)broadcast can be set only for IPv4 addressesvalid_lft is zero
preferred_lft is greater than valid_lft
type vlanunknown VLAN encapsulation protocol '%s'argument of "%s" must be "on" o r "off"type vrffwmasktable IDIPqlennetns"dev"wrong address (%s) length: expected %d bytesSIOCSIFHWADDRSIOCSIFNAMESIOCSIFTXQLENSIOCSIFMTUlockredirectkernelbootst aticgatedmrtzebrabirdEcho ReplyICMP 1ICMP 2Dest UnreachableSource QuenchRedirect ICMP 6ICMP 7EchoRouter AdvertRouter SolicitTime ExceededParam ProblemTimestampTi mestamp ReplyInfo RequestInfo ReplyErrorPacket Too BigEcho RequestMembership Que ryMembership ReportMembership ReductionNeighbor SolicitNeighbor Advert^nqNxwp:*S :lI:d46aAbgL=0:dd:wn:Il^FIlnrdvt:i:m:p:q:s:w:z:f:46-1onoff
g enericloopbacketherinfinibandieee802trieee802.11ieee1394irdaslipcslipslip6cslip6 pppipiptunnel6sitgrevoid%s requires an argumentaddchangechgreplacedeletelistshow lstflushLOOPBACKBROADCASTPOINTOPOINTMULTICASTNOARPUPLOWER_UPUGHRDMDAC!n/proc/sys /net/ipv4/route/flushshowflushaaddappendchangechgdeletegetlistshowprependreplace testflushadddeletelistshowupdownnamemtuqlenmulticastarppromiscaddressnetnsmaster nomasterdevsrcviamtuadvmssscopeprotocoltabledevoiftometriconlinkpermanentreachab lenoarpnonestaleincompletedelayprobefailedidprotocolreorder_hdrgvrpmvrploose_bin dingtodevnudprotocoldevoifiifviatablecachefromtoscopeallrootmatchexactmainlinkna metypedevaddressadddeletesetshowlstlistfromtopreferenceorderprioritytosfwmarkrea lmstablelookupsuppress_prefixlengthsuppress_ifgroupdeviifnatmap-totypehelplocaln atbroadcastbrdanycastmulticastprohibitunreachableblackholexresolveunicastthrowâ–’ UNKNOWNNOTPRESENTDOWNLOWERLAYERDOWNTESTINGDORMANTUPpeerremotebroadcastbrdanycast valid_lftpreferred_lftscopedevlabelnoprefixroutelocaltoscopeuplabeldevfromiifoif devnotifyconnectedto802.1q802.1ad#net#hostmetricnetmaskgwgatewaymsswindowirttdev device reject!mod"dyn#reinstateadddeldeletebad packet, malformed option fieldSO_ BROADCASTcan't send signal/proc/meminfoCached: %lu %*s
MemAvailable: %lu %*s
SReclaimable: %lu %*s
freeusedtotal %12s%12s%12s%12s%12s%12s
Mem: availablebuff/cacheshared%12s%12s%12s%12s%12s%12s
-/+ buffers/cache: Swap: %2u) %s
unknown signal '%s'bad signal name '%s'you need to specify whom to kill%s: no pr ocess killedcan't kill pid %dvlafxons:+P:+ PID USER VSZ STAT COMMAND mgtp ezy%5u %-8.8s %s %s setterror: '%s' must be of the form name=valueerror: malfor med setting '%s'error: '%s' is an unknown keyerror %sing key '%s'%s = error read ing key '%s'+neAapwq/etc/sysctl.conf/proc/sys;#=fchdir/proc/statcan't read '%s'
%s
Mem: %luK used, %luK free, %luK shrd, %luK buff, %luK cachedCPU:%4u%% usr%4u%% s ys%4u%% nic%4u%% idle%4u%% io%4u%% irq%4u%% sirqLoad average: loadavg PID PPID USER STAT VSZ %VSZ %CPU COMMAND
%5u%6u %-8.8s %s %.5s%4u%%%4u%% d:n:bHmno process info in /proc%04u-%02u-%02u % 02u:%02u:%02u
%02u:%02u:%02u up %u day%s, %2u:%02u%u min, load average: %u.%02u, %u.%02u, %u .%02u
%s%u.%u.%u.%uinterface=%smask=%uopt%u=siaddr=giaddr=boot_file=%.128ssname=%.64sd econfigbindtodevicebind(%s)connectsocket(%s)UDPoption 0x%02x did not fit into th e packetcan't add option 0x%02xsending renew to server %sbroadcasting renewunica sting a release of %s to %sreleasesending %sentering released state (default)bou nd/usr/share/udhcpc/default.scriptudhcp 1.35.0 =:, , /-started, v1.35 .0leasefailno lease, forkPuTTYing to backgroundno lease, failinglease lost, ente ring init stateSIGTERMreceived %spacket with bad magic, ignoringread error: %m, reopening socketno server ID, using 0.0.0.0lease of %s obtained from %s, lease t ime %u%sDHCP NAKnakDone(%d) (core dumped)[%d] Running
%*c%d %s%*c%s%sline %d: can't set tty process group: %m%d: %msyntax error: %s(.. .)${$((${#))"} || && until while ; fi; done() { ... }<<...esac>|>>>&<& | if ; t hen ; else ; do for in case ;; %lldNo current jobNo previous job%s: ambiguous%s : no such jobjob %s not created under job control -%u-lIllegal number: %s%s=%s
illegal option -%cno arg for -%c optionbad substitution%.*s: is read only%.*s: b ad variable name%:OLDPWDCDPATHcan't cd to %s: %m%s: %s not found
can't open '%s': %mcan't access tty; job control turned offcan't fork: %m[%d] | %sYou have stopped jobs.
is a shell keywordspecial alias is an alias for %s is a function is a %sshell builtin: not found
pvVredir errorbad fd numbercan't create pipe: %m/dev/fd/%dparameter not set or n ull%.*s: %s%s*?[\no such filecan't open %s: %snonexistent directorycan't create %s: %sbuilt-in shell (ash)
%s %s
newlineredirection&&||;;`casedoelifelseforthenuntilwhileeerrexitfnoglobIignoreeo fmmonitornnoexecxxtracevverboseCnoclobberaallexportbnotifyunounsetEerrtrace^www^ CV:F:i:np:qRr:s:T:+t:+SA:+O:*ox:*fBbvvipipefailPATH=/sbin:/usr/sbin:/bin:/usr/bi n*?[\â–’â–’IFS=
00
!!( )0* ,368<BCde+w
x)yâ–’â–’â–’
â–’)â–’â–’259
subnettimezonerouterdnslprsrvhostnamebootsizedomainswapsrvrootpathipttlmtubroadc astroutesnisdomainnissrvntpsrvwinsleaseserveridmessagevendortftpbootfiletzstrtzd bstrsearchsipsrvstaticroutespxeconffilepxepathprefixreboottimeip6rdmsstaticroute swpadâ–’â–’@=â–’MemTotalMemFreeMemSharedShmemBuffersCachedSwapTotalSwapFreeDirtyWriteb ackAnonPagesMappedSlabcpu %llu %llu %llu %llu %llu %llu %llu %lluPuTT/â–’â–’EXITHUPI NTQUITILLTRAPABRTBUSFPEKILLUSR1SEGVUSR2PIPEALRMTERMSTKFLTCHLDCONTSTOPTSTPTTINTTO UURGXCPUXFSZVTALRMPROFWINCHPOLLPWRSYS=:â–’â–’â–’â–’â–’â–’â–’â–’â–’
clientid-noneCvendorclassVfqdnFinterfaceinownpidfilepquitqreleaseRrequestrscript stimeoutTretriesttryagainAsyslogSrequest-optionOno-default-optionsoforegroundfba ckgroundbbroadcastB}-+?=%%%###:///not in a functiona:oncepages%4d %s
^Cillegal option %co %s%-16s%s
set %co %s
illegal option %c%c%s%s%.*s%s
np%llu%llu.%06uusage: getopts optstring var [arg]OPTARGOPTERRIllegal option -%c
No arg for -%c option
OPTINDunexpected %s (expecting %s)missing '))'unterminated quoted stringmissing '}'EOF in backquote substitutionbad for loop variablebad function name
Use "exit" to leave shell.
%s: not foundvftrap -- %s %s
%s: invalid signal specification%um%u.%03us%cexpression expectedinvalid countinv alid file descriptorinvalid timeoutp:u:rt:n:sd:IFSread: '%s': bad variable nameR EPLY%04o
illegal mode: %sunlimited%llu
%-32s(-%c) error setting limitPS1=\w \$ PPIDSHLVLHOSTNAMEp:st:facilityunknown %s name: %scs:+n:+rklogctl-command-c takes only one argument"%08.8_Ax
""%08.8_ax "8/1 "%02x "" "8/1 "%02x "" |"16/1 "%_p""|
""%07.7_ax "8/2 "%04x ""
"RTC_RD_TIMETZTZ=UTC0/etc/adjtimeUTCRTC_SET_TIME%s 0.000000 seconds
image size is too bigimage is too smallSetting up swapspace version 1, size = %l lu bytes
%s,%.*smount.%s-o%s is write-protected, mounting read-onlybad option '%s'unc=\\% s\%.*s,prefixpath=%sunc=\\%s\%.*scifs/\,ip=ip=%snfs%s%saddr=%soffset=sizelimit=/ dev/loop-control/dev/loop%ucan't setup loop devicenodevmounting %s on %s failed/ etc/fstab/proc/mountsrwno %s%s on %s type %s (%s)
swapcan't find %s in %saeaed::p:/proc/swapsdiscardnoautopri/init'%s' is not a re gular fileroot filesystem is not ramfs/tmpfserror moving rootLINENO=FUNCNAME=/et c/profile$HOME/.profileENV%s not defined in %sBASH_XTRACEFD%s%.*s%s_arithmetic s yntax errorexpression recursion loop detectedmalformed ?: operatorexponent less than 0divide by zero"%07.7_ax "16/1 "%03o ""
""%07.7_ax "16/1 "%3_c ""
""%07.7_ax "8/2 " %05u ""
""%07.7_ax "8/2 " %06o ""
""%07.7_ax "8/2 " %04x ""
"alertcritdebugemergnoticepanicwarnwarningauthauthprivcrondaemonftpkernlprmailma rknewssecuritysysloguseruucplocal0local1local2local3local4local5local6local7PS1= $ PS2=> PS4=+ EPOCHSECONDSEPOCHREALTIME3.3:2[2[[6alias2bg3break2cd0chdir2command 3continue2echo3eval3exec3exit7export2false2fg2getopts2hash0history2jobs2kill0let 7local2printf2pwd2read7readonly3return3set3shift3source2test3times3trap2true2typ e2ulimit2umask2unalias3unset2wait^+sxnu-1^lurswtf:vr--wst:w--rst:s--wrt:t--rsw:l --u:u--l^L:-1^o:*t:rwanfvsiO:?2^+c:-2nrbtfavx\01234567SWAPSPACE2"%07.7_Ax
"permission denied (are you root?)OPTIND=1/etc/filesystems/proc/filesystemsshare dsexclusivexunlockunonblocknbcdoxCe:f:n:s:vlocaltimelutcushowrhctosysssystohcwsy stztrtcfcdefilmnqrstuvxcore file size (blocks)data seg size (kb)scheduling prior ityfile size (blocks)pending signalsmax locked memory (kb)max memory size (kb)op en filesPOSIX message queues (bytes)real-time prioritystack size (kb)cpu time (s econds)max user processesvirtual memory (kb)file locksloopdefaultsnoautoswswap_n etdevnosuidsuiddevnodevexecnoexecsyncdirsyncasyncatimenoatimediratimenodiratimer elatimenorelatimestrictatimenostrictatimelazytimenolazytimenosymfollowmandnomand loudrbindbindmovemake-sharedmake-slavemakePuTTY-privatemake-unbindablemake-rshar edmake-rslavemake-rprivatemake-runbindablerorwremount<<=â–’>>=â–’<<
>>,||&&!=*<=k>=K==
|=B&="*=/=#%=C+=â–’-=â–’--3^=b++**/!0<
--~,?:$)4(ogu >+=|& */.%N+
}-+?=-HSac::d::e::f::i::l::m::n::q::r::s::t::u::v::x::
()&|;
% s busy - remounted read-onlycan't remount %s read-onlyfldnrat:cvican't unmount % s%s.%stgz%0*llo%llu+%llu records in
%llu+%llu records out
Question: Why is there a shell in the firmware kernel?