Scenario: You telnet in, you double tab and find these are the available commands.

IPv6-relay             ipaddr                 preinit
acl_logd               iplink                 ps
acos_init              iproute                pwd
acos_service           iprule                 radvd
ash                    iptunnel               rc
autoconfig_wan_down    ipv6-conntab           read_bd
autoconfig_wan_up      kill                   reboot
automount              killall                reset_no_reboot
bd                     l2tpd                  restart_all_processes
bftpd                  lcli                   ripd
brctl                  leddown                rm
burn5gpass             ledup                  rmdir
burn5gssid             lld2d                  rmmod
burnboardid            ln                     route
burnethermac           ls                     routef
burnpass               lsmod                  routel
burnpin                mattrib                routerinfo
burnrf                 mbadblocks             rtmon
burnsku                mcat                   rtpr
burnsn                 mcd                    rtsol
burnssid               mclasserase            scheact
busybox                mcopy                  sh
calcheck               mdel                   showconfig
cat                    mdeltree               sort
chmod                  mdir                   strings
cp                     mdu                    swresetd
cut                    mformat                sysctl
date                   minfo                  tail
ddnsd                  mkdir                  tc
df                     mknod                  tee
dhcp6c                 mlabel                 telnetd
dhcp6c_down            mld                    telnetenabled
dhcp6c_up              mmd                    tfmeter
dhcp6s                 mmount                 tftp
dnsRedirectReplyd      mmove                  timesync
dnsmasq                mount                  touch
eapd                   mount.ntfs-3g          tr
echo                   mpartition             ubdcmd
email                  mrd                    udevtrigger
emf                    mren                   udhcpc
erase                  mshowfat               udhcpd
et                     mtools                 umount
free                   mtoolstest             upnp
ftpc                   mtype                  upnpd
getchksum              mzip                   uptime
gpio                   nas                    vconfig
gproxy                 netstat                version
grep                   nice                   wan_debug
gunzip                 nslookup               wandetect
gzip                   ntfs-3g                wanled
halt                   ntpclient              wget
head                   nvram                  wl
heartbeat              outputimage            wlanconfigd
hostname               phymons                wlconf
hotplug                ping                   wps_ap
hotplug2               ping6                  wps_enr
httpd                  pot                    wps_monitor
ifcfg                  poweroff               wpsd
ifconfig               pppd                   write
igs                    pppdv6                 zcat
init                   pppoecd                zebra
insmod                 pppoecdv6
ip                     pptp

Unfortunately, you don't have netcat and you don't have /dev/tcp, but maybe /proc/net/tcp would be of use?

before anyone assumes, this is my router that I bought at savers (thrift shop), I had the idea of throwing a "scenario" topic in SE.

I had couple ideas bubbling in my head, maybe a javascript reverse shell since they have httpd?

  • Have you tried busybox nc on busybox netcat? Maybe, just maybe nc is implemented but there's no symlink nc -> busybox for some reason. – Kamil Maciorowski Sep 13 '17 at 16:25
  • nothing, I tried ln -s busybox nc but I get readonly filesystem, and I tried it in /tmp directory, but no dice. – andyADD Sep 13 '17 at 16:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.