Google now is testing out the rewarding of web application security research and (responsible) disclosure of certain of their websites, which a good and encouraging step taken in the webappsec realm for sure 🙂
Would love to see this continued, and other sites following this lead!
My internet connection goes down periodically, and I used to have to power cycle the router in order to fix that. When it started to become too frequent it posed a problem, since I’m too lazy to keep going to the room (my wife too) to restart it. There’s also the option of restarting the router via the web admin interface, but it required me to login, click to the page for restarting, and click “restart”! Very complicated indeed for lazy people.
Inspired by this hack (Hack a Day) where the guy automated the physical power cycling process, I decided to automate mine too. Since I have a Tonido plug which is almost always on, and I’ve just learnt Python too, I decided to go the scripting method. As they say: to a man with a hammer, everything looks like a nail 😉
A couple of lessons learnt
I was caught by surprise by when reproducing the login and restart sequence exactly didn’t work, and I went so far as to reproduce ALL the requests made by a “normal human”. It turned out (after 2 hours and a shower break) that things worked just fine when I simply converted the minimally needed POST parameters to GET parameters. Nice classic web application hacking trick learnt from my old job as a web application ethical hacker I’d say.
Also, the restart sequence for my router turned out to not only need the form “POST” to request a restart, but also a subsequent request for the “restarting now” status page, interesting…
Note that before you use this, some reverse engineering of the web application calls is needed, and some Python coding too. You have been forewarned! Also, I’m not responsible for this script causing you direct/indirect damage in any way, so don’t come crying when your lawnmower starts to act crazy because you installed this script. The script is released under the GPL, and can be downloaded here.
How to install/use
Edit ‘router_host’: ‘10.0.0.1’, in line 8
Reverse engineer the web admin login and restart sequence, see what you need. I used tools like a transparent proxy (Burp Suite), notepad and some brain grease.
Hack the restart_router() (lines 43-73) function in the python script according to your needs (you’re on your own here… Alternatively you could offer me a good amount of Coke/chips for me to help you with the reverse engineering/coding somehow 😉 )
Copy into the Tonido plug’s /root directory (assume running as root, for simplicity’s sake)
SSH into the Tonido plug as root
# chmod 400 /root/internet_connection_monitor.py
# crontab -e
Add in this line: (makes the script run in the background, 4 minutes after every tonido plug reboot to give the router time to start up) @reboot sleep 4m && /usr/bin/python /root/internet_connection_monitor.py &
Press Alt-X, then “y” to save the new crontab
Reboot the Tonido plug
What are the risks to note
The script basically is a hardcoded piece of info revealing the password and sequence to your login/router’s workings! Make sure the script is chmod’ed properly, and isn’t accessible via Tonido’s interfaces. For me I don’t have this problem, since I don’t allow connecting to my Tonido from outside anyway, and people will have to brute force ssh public keys to get in…