Easton's stuff Geek, coding and other madness....

Remote code execution with Hitron CGNM-2250

Edit: This has been fixed in the latest firmare update 4.5.10.25

The routers that you receive from your ISP are almost always garbage: not many options to configure and pitiful wifi range. The router/modem that Shaw customers receive is the Hitron CGNM-2250 thankfully isn't completely terrible, 802.11ac plus gigabit ports. I was poking about and researching the model and came upon an exploit for a similar model version for remote code execution. The CGNM-2250 is vulnerable as well, for reference my software version is 4.5.8.20 with hardware version 1A. The input for the ping utility through the web interface isn't sanitized so you can enter arbitrary input. I discovered that it has a few basic utilities, including Dropbear.

Makefile update to SnackLinux

The Makefile for SnackLinux has been updated, I made it a bit easier to build SnackLinux from scratch. I'd like to update GCC to at least 5.x something, and add a few more packages to SnackLinux. Eventually, adding a PKGBUILD-like system to fbpkg would be preferable. Right now, it's just a bunch of instructions on the snacklinux.com.

SnackLinux update

SnackLinux now has a whopping 31 packages, which include a (somewhat) working gcc toolchain and other fun GNU utilities (vitetris included!). I was able to add Docker support as well, which is just tarballed userland. Getting a working gcc toolchain was a bit of a pain in the butt. Pain in the butt because musl doesn't play nice with every piece of software out there, since most (that I have encountered anyway) think we're using glibc. And since SnackLinux is focused on every packaging being staticly compiled, not every package plays nice with that either. For example, there is a Python 2.7.9 package in the repository that is missing quite a few modules, see below:

Tags to Pasteros.io

Tags have been added to Pasteros.io, so now pastes can be "grouped" together, making it a bit easier to manage. For example, see https://pasteros.io/tag/snacklinux. A delete URL is still on my todo list, but that shouldn't be too difficult to implement.

Pasteros.io is live!

My text storage platform project, pasteros.io is finally live! It's also on Github: https://github.com/snacsnoc/pasteros

Setup Nagios 3 with lighttpd on your VPS

There are countless tools and software stacks out there to monitor your servers out, though some are not the easiest to setup. I went with Nagios since it's straightforward to configure and easy to setup. For reference, I used Nagios 4.0.8 on Debian 7 using Debian 7 slaves. The Nagios master node already had lighttpd and PHP set up so I'll gloss over that.

Master node

Start by downloading Nagios and Nagios plugins:

 

wget http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-4.0.8.tar.gz
wget http://nagios-plugins.org/download/nagios-plugins-2.0.3.tar.gz

 

Extract, compile and install Nagios:

Nimrod language

 I have recently discovered the Nimrod programming language. I usually don't branch out on languages because, well, stuff you don't know can be scary. I'm surprised how easy it is to get going though, it reminds me quite a bit of Python. I put up a test project on Github that fetches the weather for a given location.

SnackLinux evolution

 SnackLinux finally has a domain, snacklinux.org! The source is still on Github and all the ISO images have moved as well.

Building a distro that almost works

 For the most part, SnackLinux works. I've been having problems with Busybox, so I've made packages for coreutils, binutils, sed, grep and gawk. When compiling anything, I get:

segfault at 0 ip    (null) sp bfdb1cbc error 4 in busybox[8048000+e8000]

or something along the lines of that. I used the newest Buildroot, 2013.11, to create a new toolchain and cross compile uClibc 0.9.33 for SnackLinux. I have yet to recompile Busybox yet, but I'm working on getting gcc natively working on SnackLinux. Once that is completed, I should be able to compile SnackLinux from within SnackLinux.

Subscribe to