How to properly escape ash input?

Installing and Using OpenWrt
21

That is actually beauty of internet, it was never a safe place, never should be and it should be anonymous. I don't like the dangers, but I also see where regulations and restriction by the government go, it finally always only affects the good people. We are the ones who should secure our devices, starting by replacing original firmware with lede :wink:
Btw. is it possible to allow more IP adresses on a specific port in a single firewall rule? I mean something like list src_ip 'ip1,ip2,ip3'

22

Yes, please stop considering exposing insecure and non-robust services

1 Like
23

/etc/services defines the ports

Use a private port

24

@mbo2o thank you, I will have to read something about that. I had no idea this is possible in openwrt.
@jeff Well, that is why I asked before doing something stupid. As long as you correctly trim the input and properly escape, nothing should go wrong. I'm quite disappointed to see, that sh seems to be insecure for this task.

25

That is, regrettably, a very poor assumption, no matter what port you are running on, registered or otherwise.

As just one reference
https://engineering.purdue.edu/ResearchGroups/SmashGuard/BoF.html

And for something more current, start with https://www.us-cert.gov/ncas/current-activity

Here you go https://www.us-cert.gov/ncas/bulletins/SB18-064 -- just one week of "nothing should go wrong"

26

Thank you, I actually remeber some of the attacks from first link :slight_smile:
So better to sit home and watch TV, right? Not me. But I got your message, I believe even hello world.c can be exploited, if it relies on vulnerable library or vulnerable system.

27

My car can be stolen, but I don't leave the keys inside and the doors unlocked.

1 Like
28

You don't even require a script you could call etherwake with its arguments directly from inted.

Also use the wait option instead of nowait.

29

root@LEDE:~# cd /etc
root@LEDE:/etc# passwd
Changing password for root
New password:

Pwnd...

(Sound of car being driven away)

30

@jwoods, I have only used initd on internal networks so I haven't explored the security issues.

@nozombian, You can probably do a penetration test on your own network to see what fails.

31

etherwake must be run as root.

wakeonlan can be run as non-root user.

1 Like
32

wakeonlan could be useful, if it would not require ton of perl dependencies and like 5MB of flash :open_mouth:
@mbo2o any tip for (free) penetration test?

33

Place the IPs in an ipset foo, them edit the iptables rule to block by SRC IPs in set foo.

34

Yes. Either specify a range (option src_ip 10.0.0.1-10.0.0.100) or a uci list of ips:

config rule
  ...
  list src_ip 10.0.0.1
  list src_ip 10.0.0.2
  list src_ip 10.0.0.3
  ...
2 Likes