OpenSSH password authentication bypass in OpenWRT

OpenWRT’s default SSH server daemon is dropbear which may not be vulnerable to the password authentication bypass flaw exploitable in OpenSSH.

OpenWRT openssh-server package is vulnerable because OpenWRT uses musl libc and the package is built without PAM. At least both of these two conditions are required to be exploited. Check if the package is installed apk list --installed openssh-server, if so, update it to 10.6_p2.

apk update
apk add openssh-server

If update is not available due to offline environment or end-of-life OpenWRT version, a mitigation is to disable SSH password authentication, which is highly recommended even when using dropbear. This does not affect password authentication in LuCI web portal http://192.168.1.1.

read more

Flash OpenWRT to NanoPi R5S without EFlasher

Recently bought a FriendlyARM NanoPi R5S with 4GB RAM to replace the router and firewall functions of GL.iNet GL-MT6000 (Flint 2) that has 1GB RAM only. FriendlyARM provides FriendlyWRT official image, a fork of OpenWRT. I prefer OpenWRT official image for a vanilla experience.

read more

Monitor application traffic using Proxifier and Burp Suite

Initially discovered Proxifier from a SANS article. Since then, I’ve been using it to troubleshoot connection issue in corporate proxy environment. Previously Wireshark was used for troubleshooting, but it captures the whole operating system (OS) making it challenging to discern a specific app. Similar issue with Burp Suite when using OS-wide proxy configuration, app-specific proxy requires the app to support proxy connection. By using Proxifier, I can target a specific app only, resulting in accurate traffic analysis.

read more

Framework Laptop 13 USB not working (solved)

The far left USB-C expansion card of my Framework Laptop 13 with AMD AI 300 suddenly stopped working after wake from suspend. Keyboard stopped working and couldn’t charge through that port. I took out the expansion card and plugged in to the near left USB-C expansion card (so two expansion cards) then plugged in my keyboard, that worked just fine so that expansion card was still functional. Then, I tried charging through the far left port directly without a USB-C expansion card, but the charging indicator light didn’t light up.

I searched around the web and tried this suggestion. I powered it off and unplugged charger, waited around 2 minutes and switched back on. Keyboard and charging then started to work on the far left port with expansion card again. I didn’t have to disconnect the battery

*.cdn.cloudflare.net CNAME for split DNS situation

Cloudflare offers a nifty shortcut for split DNS situation. Company may share the same domain name for their public and internal domain. In the internal domain, some subdomains can point to internal IP address that are not available on public DNS records. Due to separation of DNS nameserver, DNS admin often need to replicate any creation of public subdomains into internal nameserver including subsequent update of values.

read more