Autor
Necesito vuestra ayuda. Como muchos sabréis, el router Livebox 6+ de Orange creado por Arcadyan en concreto el modelo es el ERV33AX349B-LT es uno de los más limitados de la historia. Incluso los registros están capados, lo que es una violación de la privacidad del usuario. La empresa Orange, que distribuye el dispositivo, no me ha proporcionado ningún dato para acceder a mi dispositivo. He intentado todas las vías que he encontrado en línea, pero me faltan conocimientos para recuperar los registros de mi router y por eso acudo a los grandes hackers que tenemos aquí y espero que me ayudeis a recuperar lo que es mio y de privacidad...
He probado a soldar los pines UART en la placa para conectar el dispositivo a través de un USB-TTL y comprobando los voltajes para saber cual pin era el TX, RX Y GND finalmente conseguí ver en consola el puerto serial COMX, sin embargo, resultó ser el inicio de algún tipo memoria RAM o similar del sistema embebido, lo que me impide conseguir una shell por conexión serial y tira al traste esa vía o almenos esos pines por los que intenté acceder. Al final del post os pegare todo lo que consigo ver en el inicio del router a través de esta consola junto con los datos técnicos que he conseguido obtener del router.
Mis preguntas son, dadas las circunstancias, las siguientes:
- ¿Existe alguna manera más simple de conseguir los registros o el volcado de memoria?
- ¿Es posible conseguir una shell y entrar al sistema para recuperar los registros mediante la consola serial?
- ¿Es posible analizar las memorias sin extraerlas o crear algún tipo de puente que me permita entrar al sistema Linux que posee?
- ¿Cuáles pueden ser los puertos JTAG y las frecuencias que debo comprobar para conectarme al router mediante JTAG, y cuál es la diferencia entre JTAG y UART en términos de tipos de pines?
- ¿Pueden recomendarme algún software o herramienta para activar el acceso SSH o similar para poder conseguir mis registros?
- ¿Alguien conoce algún exploit infalible para la explotación local?
- ¿Teniendo USB 3.0 es posible crearle la shell a traves de este mediante código autoejecutable?
Agradezco cualquier ayuda que podáis proporcionar. ¡Gracias de antemano!
Datos técnicos router
PLACA P/N: 14133AX20016J R02
- FABRICANTE: ARLT //**SEGUN LA INTERFAZ WEB**// PIENSO QUE EN REALIDAD ES ARCADYAN
- MODELO: ARLTLBPLU6 //**SEGUN LA INTERFAZ WEB**// PIENSO QUE EN REALIDAD ES ERV33AX349B-LT
- VERSIÓN MIDDLEWARE: ARPLUS6-sp-03.03.01.027c
- VERSION BOOTLOADER: SAHBL_20.55.14
- VERSIÓN DE HARDWARE: ARLTLBPLU61
FOTOS DEL ROUTER:
Inicio de sesión en el puerto Serial UART
PS C:\Users\?????\Desktop\router> python route.py
----
BTRM
V1.0
R1.0
L1CD
MMUI
MMU9
DATA
ZBBS
MAIN
OTP?
REF?
REFP
RTF?
RTFP
OTPP
FSBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
AHD?
ROT?
ROTA
MID?
MIDP
AHDP
SBI?
SBIA
SID?
SIDP
PASS
----
HELO
5.0207p1-1.0.38-163.243
CPU0
L1CD
MMUI
MMUC
ZBBS
MAIN
XEND
MemsysInit hpg0_generic_aarch64 3.5.1.1 20171009
DDR3
8262E7E8 80180000 801A0000 00000000 00000000 0020476E
MCB rev=0x00000501 Ref ID=0x0476E Sub Bld=0x002
Dram Timing 11-11-11
Add/Ctl Alignment
Coarse Adj=0x087 deg, cmd steps=0x0CA
reg 0x801A0090 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A0094 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A0098 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A009C set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00A0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00A4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00A8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00AC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00B0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00B4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00B8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00BC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00C0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00C4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00C8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00CC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00D0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00D4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00D8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00DC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00E0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00E4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00E8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00EC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00F0 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00F4 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00F8 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A00FC set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A0100 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A0108 set to VDL 0x04D with Fine Adj=0x01 deg
reg 0x801A010C set to VDL 0x04D with Fine Adj=0x01 deg
HP RX TRIM
itrim = 0x0
lstrim = 0x9
ZQ Cal HP PHY
R in Ohm
P: Finger=0x348 Term=0x78 Drv=0x28
N: Finger=0x300 Term=0x80 Drv=0x28
PLL Ref(Hz)=0x02FAF080 UI STEPS=0x065
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x1849 CLK_VDL=0x020
SHMOO 28nm
801A0000 80180800 00000000 00020000 00000000
Shmoo WL
One UI Steps : 0x72
auto-clk result = 00B (filter=0C steps)
initial CLK shift = 020
final CLK shift = 00B
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 S-----------------------X-----------------------------------------------------------------------------------------
01 S------------------X----------------------------------------------------------------------------------------------
Shmoo RD En
FORCED WR ODT = 0x00001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00039AB3 00079AB3
B1 00039AB3 00079AB3
B0 RISE UI=1 VDL=20 PICK UI=2 VDL=20
B1 RISE UI=1 VDL=28 PICK UI=2 VDL=28
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 --S-----------------------------X+++++++++++++++------------------------------------------------------------------
01 --S-------------------------------------X+++++++++++++++----------------------------------------------------------
Shmoo RD DQ NP
DQS :
B0 VDL=65 ok
B1 VDL=65 ok
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------
01 -------------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++-------
02 ----------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----------
03 ---------------++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------------
04 ---------------------+++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++----------
05 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------
06 ------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++---------
07 ----------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++--------------
08 ---------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++--------
09 -----------------------+++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++--------
10 --------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------
11 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------
12 ---------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------
13 --------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++-----
14 ---------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++--------
15 ---------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----
Shmoo RD DQ P
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 ------------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++--------
01 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++-------
02 ---------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++----------
03 -------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------
04 ------------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++---------
05 -----------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++-------
06 -------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++---------
07 -------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------
08 ---------------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--------
09 ---------------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--------
10 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++-------
11 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------
12 -----------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----
13 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------
14 ----------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------
15 ------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----
Shmoo RD DQ N
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------
01 -------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-----
02 -----------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++---------
03 ----------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------------
04 --------------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++----------
05 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------
06 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------
07 ----------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++--------------
08 ----------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------
09 -----------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++----
10 --------------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------
11 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------
12 ---------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------
13 --------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++-----
14 --------------------++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------
15 ---------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++---
RD DQS adjustments :
BL0: Start: 0x65 Final: 0x65
BL1: Start: 0x65 Final: 0x65
Shmoo WR DQ
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 -------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-----------------
01 --------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++----------------
02 -------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------------------
03 --+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++---------------------
04 ---------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++-----------------
05 -------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++-------------------
06 -----++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-------------------
07 -----+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++----------------------
08 ---------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----------------
09 ---------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--------------
10 -------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------------------
11 ------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++---------------
12 --------+++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------------
13 --------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++---------------
14 -------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------------
15 ----------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-------------
Shmoo WR DM
WR DM
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111
000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111
012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123
00 -----++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------
01 --------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------
DERV
RIPF
FPS0
UBIF
----
PAR1
U:01
COM0
UBI#
03E9
BT01
0004
----
PAR2
U:00
COM0
UBI#
03E8
BT00
0004
----
TRY1
NAN3
UBI!
BTLR
ATH?
PASS
DECP
NAN5
XEND
CPU1
Fuentes de información:
wrongbaud.github.io/posts/jtag-hdd
En línea
