New Xiaomi router AC2100

Gaojianli · April 9, 2020, 6:09am

My ax3600 arrived now, maybe i can do the check. But i have no idea what should i do

namidairo · April 9, 2020, 6:45am

You don't really need a physical one to extract the image, but I have the feeling that Xiaomi would have patched it since the image listed on the site is dated 4 days after the pppd vuln became public knowledge. (That and the Qualcomm SDK that they built off of... probably has mitigation in place.)

I can't be bothered checking since it's a little out of my price range and I can't get the ubifs extracted anyway.

As for RM2100 owners, here you go:

gist.github.com

https://gist.github.com/namidairo/1e3fb3404c9f148474c06ae6616962f3

pppd-cve.py

# Based off https://github.com/WinMin/CVE-2020-8597
from scapy.all import *
from socket import *

interface = "enp0s31f6"

def mysend(pay,interface = interface):
    # time.sleep(0.5)
    #s = socket(AF_PACKET, SOCK_RAW)
    #s.bind((interface, 0))

This file has been truncated. show original

Replace the source/destination mac addresses and the interface, setup pppoe-server, and run when you see an active pppoe session between the router and your pc.

I think there's a watchdog that kills off pppd (and thus your shell) after a while, so I'd only probably use this to get your foot in the door and curl over a busybox binary to secure you proper access. (Ie. DO NOT DIRECTLY MTD WRITE YOUR OPENWRT IMAGES FROM THIS)

Should work on the black cylinder AC2100 (and anything older...) if you adjust the addresses of the rop gadgets and stuff.

Gaojianli · April 9, 2020, 11:35am

Ok, here is the ubifs for ax3600, you can easily extracted with binwalk:

Otherwise, do you have a ARM version payload?

thorsten97 · April 9, 2020, 2:35pm

Anyone here who knows how I can get back to stock?
I want to test the exploit! I guess I can just flash the original kernel via tftp, boot it and send the original firmware via tftp. ???

Anyone willing to share the stock kernel.bin?

for your information: I am currently compiling a new OpenWrt version with kernel 5.4., will upload it as soon as I have tested it ...

Gaojianli · April 9, 2020, 2:44pm

http://www1.miwifi.com/miwifi_download.html

thorsten97 · April 9, 2020, 2:49pm

thanks, but I think I need the kernel partition first. Is there an easy way of extracting it from the firmware image?

Sensegsm · April 9, 2020, 3:48pm

Here is kernel for Redmi AC2100: https://drive.google.com/open?id=1QBcKs6aIUWlMJ0Ngx1hg1d7iYuEaPJxe

What exploit you want to test? I can help you with this? Please give a solution, i have a Redmi AC2100 router.

thorsten97 · April 9, 2020, 4:09pm

thanks! I mean the one from @namidairo New Xiaomi Router AC2100

thorsten97 · April 9, 2020, 4:14pm

Great!
How can I get the values necessary from my ac2100 (rop gadgets addresses etc.)

frozeus · April 9, 2020, 5:39pm

Hi,

Did someone test if the BootRom DL Mode is disabled ?

namidairo · April 9, 2020, 8:29pm

The pppd binary, the libuclibc.so (Not strictly necessary but nice to have), and the memory map that gets spit out to messages when you crash it with a normal payload of all 'A' in the registers. (Assuming the mappings are different)

First two you can extract from the squashfs ín the ubifs image (assuming you can get ubireader to work, I never could and just used Percy's dumps), last one you can get from the device logs (192.168.31.1/....blahblahstok=something/api/misystem/sys_log)

There might be a little bit of messing around as I guessed the stack address by just going down by 0x200 until it landed somewhere in the nop sled.

I shouldn't have called it the AC2100 either, it's really the R2100 isn't it. Confusing model naming all round.

Gaojianli · April 10, 2020, 12:34am

Yes, that's confusing. My ax3600 is also called R
3600. Could you please tell me how to confirm if this exploit is fixed in R3600? Unfortunately this is the only way which may get ssh access on 3600 now, because of the high price of a tosp-48 programer

namidairo · April 10, 2020, 3:32am

Opening up the pppd binary and uclibc one in a disassembler.
Checking that this hasn't been implemented yet https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426#diff-b7f5f2404cf3f5c09b1f8ad9364bb340
Checking that bcopy/memcpy/memmove does not call a FORTIFY_SOURCE version
Checking that they are not position independent executables.
Crying if you find out they actually did do it properly by virtue of using Qualcomm's BSP?

Gaojianli · April 10, 2020, 5:53am

That's strange. I can't find this eap_request function, also the string:EAP: trimming really long peer name down

image817×796 37.7 KB
Moreover, R3600 use musl not uclibc, i don't know how to check FORTIFY_SOURCE calling
Sadly, it is PIE.

Maybe i can ready to cry??

The `pppd` and `libc.so` file: https://send.firefox.com/download/e042bee0081e2b04/#TTMmbHbGE9YUCZaJcAfwHw

namidairo · April 10, 2020, 7:30am

Yeah, they have stack guards on in there too.

At least Qualcomm have shown to have their BSP up to date on their flagship chipsets... (The only reason it works on the ramips hardware is because they have pretty much every single mitigation turned off, no stack guards, no pie, rwx stacks, etc.)

thorsten97 · April 10, 2020, 11:08am

current master compiled for ac2100:
https://gofile.io/?c=LWjyIx

namidairo · April 10, 2020, 12:17pm

There are a couple things that I see in your patch that would probably need to be changed before doing a pull request and getting it supported properly.

Most of it should be covered here https://openwrt.org/submitting-patches

The stuff I spotted:
Do we need to rename the device? I'm not sure if we need a different DTS for the two devices since they're so very similar hardware wise. Probably just call the white one the RM2100 and the cylinder one R2100 like Xiaomi do? Check with one of the devs I guess

You have a duplicate DTS file that does nothing

Remember to preserve alphabetical order when you add the device to lists

memory@0 { device_type = "memory"; /*reg = <0x0 0x10000000>;256Mbyte*/ reg = <0x0 0x8000000>; };

I don't think this is needed anymore after https://github.com/openwrt/openwrt/commit/a2c19f1d2f658367e6d62a6bdcfc72f12f23e43e

`
lan3_amber {
label = "ac2100:amber:lan3";
gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
};

            lan2_amber {
                    label = "ac2100:amber:lan2";
                    gpios = <&gpio0 16 GPIO_ACTIVE_LOW>;
            };

            lan1_amber {
                    label = "ac2100:amber:lan1";
                    gpios = <&gpio0 15 GPIO_ACTIVE_LOW>;
            };`

I think these may require updates for DSA?

Eg. https://github.com/openwrt/openwrt/blob/master/target/linux/ramips/dts/mt7621_xiaomi_mir3p.dts#L46 and https://github.com/openwrt/openwrt/commit/30644bc579e771e4b6dcc165ca966124e0259e1e

License needs to be added to the top of the dts

The comments in the dts might need to be moved to the commit message?

And uhh, instructions to flash for those who manage to get root on stock?

Edit: I wrote "the white one and the white one", that makes no sense. Derp.

Sensegsm · April 10, 2020, 12:29pm

Have you managed to test exploit from @namidairo ? If yes, what is the result? I would like to try but do not know where to start... @namidairo, can you help me to test exploit?

thorsten97 · April 10, 2020, 4:18pm

Nope and I don't think I can test it in the near future as I need the router ...

thorsten97 · April 10, 2020, 4:22pm

I changed the necessary parts for DSA. I will post the patches later. Timewise I am quite restricted in the next days. In case somebody wants to take care of an PR feel free to do with my patches as I don't know when I will be able to do it ...