[--------------------------------------------------------]
Paper/Tutorial name: Router Hacking
Written by: Chroniccommand
For: CodeShock
Difficulty: Easy to Intermediate
State: Work in progress
[--------------------------------------------------------]
Table of Contents
1..........Credits
2..........Intro
3..........Basics of a router
4..........Insecurities
5..........Brute-forcing // Dictionary attacks
6..........More to come??
[-----------------------------------------------------------]
Credits
I(Chroniccommand) have written this paper/tutorial by myself. I thank Vivek for teaching me.
------------------------------------------------------------\\
Intro
Router hacking can be very useful. You can use it to gain access into a routers settings and fuck around with everything > : ) THIS IS NOT A TUTORIAL FOR CRACKING WEP.
--------------------------------------------------------------\\
Basics of a router
You should all know what a router is. A router forwards data in and out of a network.
http://upload.wikimedia.org/wikipedia/commons/f/f6/SPOF.png
The image above shows a router communicating between the computers and server. Common types of routers include:
#Cisco
#Linksys
#SMC
#Netcomm
#Belkin
#Netgear
#And a lot more
(Possibly more to come for this section)
---------------------------------------------------------\\
Insecurities
So, you may be asking yourself, what can I do in the router settings? Well you can do alot of things actually. You can forward ports, deny internet for a specific computer, disable the router etc.. Some insecurities include:
#Not changing the default password
#Weak password
#Mis-configurations
#SNMP attacks
#And more...
Generally you would log into the router by going to the address "192.168.1.1" in your browser, but it may be different. Try going into your terminal and typing "ifconfig" without the quotes. You should see something like this on the wlan0 sections(if your using Wi-Fi)

I blocked out some stuff with x's btw. See where it says "inet addr"? That is your lan IP. Mine is "192.168.1.5". So the login page should be at "192.168.1.1" From there you can login. You may want to try default passwords first. Try something like "Admin" for the username and "password" for the password. Here is a list of default passwords: http://www.phenoelit-us.org/dpl/dpl.html
--------------------------------------------------------------------------------------\\
Brute-force // Dictionary attacks
So what do we do if we do not have access to the router because we don't know the password? The answer is simple. Brute force it or use a dictionary attack. For this particular section I will be using hydra. For this demo I am running BackTrack4 (Because it comes with all the tools). Lets first do an nmap scan on the router:
'nmap -sS 192.168.1.1'
I get this type of input for my router (Keep in mind I purposely opened ports for this demo)

So we see that http, ssh, telnet and an unknown port are open. Now I'm going to try to telnet the router.
'telnet 192.168.1.1 23'
I get this output:

I try the default passwords to the router but they don't work =/ So our next option is a dictionary attack. Make sure you have hydra configured correctly on your machine. So what I'm going to do is make a file with some usernames and passwords in it like so:

This is just a quick list of defaults I got. As you can see the order goes 'username:password' separated with a ':' You may want to download a dictionary file as you will probably have more success. So now hydra comes in. Lets try 'hydra' and see the options. The option '-C' should work here. Lets try this command:
'hydra -C dictionary 192.168.1.1 23'
This will try all usernames and passwords in the file 'dictionary'. We get the output as username == vyatta, password == admin. So telnet back to the router and log in with those credentials. Great success :mrgreen: We now have access with help from a dictionary attack *thumbs up*
STILL WORKING ON THIS SECTION!. Expect it soon.
----------------------------------------------------------------------------\\
More to come??
This tutorial is still a work in progress, I will have more techniques like using Netcat to login to a router and maybe gain root ;). I will also be adding sections for SNMP attacks etc.. If anybody has any suggestions please shout out.