Stuck on [+] STAGE 3: Remote code execution > Last step > Waiting for IPCP configure ACK... #57

pmgcosta · 2024-05-28T01:34:49Z

I have installed pppwn from https://nightly.link/xfangfang/PPPwn_cpp/workflows/ci.yaml/main?status=completed but i can't pass stage3 to stage4 on the router, if i try using a PPPwn on windows all works but that is not practical to me.

[+] PPPwn++ - PlayStation 4 PPPoE RCE by theflow
[+] args: interface=br-lan fw=1100 stage1=/ppp/stage1.bin stage2=/ppp/stage2.bin timeout=0 wait-after-pin=1 groom-delay=4 auto-retry=on no-wait-padi=off real_sleep=off

[+] STAGE 0: Initialization
[] Waiting for PADI...
[] Waiting for PADI...
[+] pppoe_softc: 0xffff954d40659800
[+] Target MAC: f8:46:1c:f4:2c:03
[+] Source MAC: 07:98:65:40:4d:95
[+] AC cookie length: 4e0
[] Sending PADO...
[] Waiting for PADR...
[] Sending PADS...
[] Sending LCP configure request...
[] Waiting for LCP configure ACK...
[] Waiting for LCP configure request...
[] Sending LCP configure ACK...
[] Sending IPCP configure request...
[] Waiting for IPCP configure ACK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure NAK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure ACK...
[] Waiting for interface to be ready...
[+] Generate target IPv6 from MAC address
[+] Target IPv6: fe80::fa46:1cff:fef4:2c03
[+] Heap grooming...done

[+] STAGE 1: Memory corruption
[+] Pinning to CPU 0...done
[] Sending malicious LCP configure request...
[] Waiting for LCP configure reject...
[] Sending LCP configure request...
[] Waiting for LCP configure ACK...
[] Waiting for LCP configure request...
[] Sending LCP configure ACK...
[] Sending IPCP configure request...
[] Waiting for IPCP configure ACK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure NAK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure ACK...
[+] Scanning for corrupted object...found fe80::0268:4141:4141:4141

[+] STAGE 2: KASLR defeat

[*] Defeating KASLR...
[+] pppoe_softc_list: 0xffffffff9be6e578
[+] kaslr_offset: 0x1798c000

[+] STAGE 3: Remote code execution
[] Sending LCP terminate request...
[] Waiting for PADI...
[+] pppoe_softc: 0xffff954d40659800
[+] Target MAC: f8:46:1c:f4:2c:03
[+] Source MAC: 97:df:83:9a:ff:ff
[+] AC cookie length: 514
[] Sending PADO...
[] Waiting for PADR...
[] Sending PADS...
[] Triggering code execution...
[] Waiting for stage1 to resume...
[] Sending PADT...
[] Waiting for PADI...
[+] pppoe_softc: 0xffff954d40659800
[+] Target MAC: f8:46:1c:f4:2c:03
[+] AC cookie length: 0
[] Sending PADO...
[] Waiting for PADR...
[] Sending PADS...
[] Sending LCP configure request...
[] Waiting for LCP configure ACK...
[] Waiting for LCP configure request...
[] Sending LCP configure ACK...
[] Sending IPCP configure request...
[] Waiting for IPCP configure ACK...

HANG.....

I have tried with this options

[+] args: interface=br-lan fw=1100 stage1=/ppp/stage1.bin stage2=/ppp/stage2.bin timeout=0 wait-after-pin=1 groom-delay=4 auto-retry=on no-wait-padi=off real_sleep=off

and

[+] PPPwn++ - PlayStation 4 PPPoE RCE by theflow
[+] args: interface=br-lan fw=1100 stage1=/ppp/stage1.bin stage2=/ppp/stage2.bin timeout=0 wait-after-pin=1 groom-delay=4 auto-retry=on no-wait-padi=on real_sleep=on

I'm trying to install tcpdump on the router but i don't figure how.

pmgcosta · 2024-05-28T18:36:03Z

I'm strugle with the capture,

It's possible to start a tcpdump before the pppwn without the -a option and stop the dump after ?

I'm strugle with the sintaxe.

I have tried both methods

#28
https://forum.openwrt.org/t/tcpdump-sniffing-piped-directly-to-wireshark/99729

without success, i will keep trying but someone can help

So far i have tried in this way

tcpdump -i br-lan -w /ps4/br-lan.pcap
pppwn ............
kill $(ps -e | pgrep tcpdump);

But i got an empty file

xfangfang · 2024-05-28T23:04:52Z

If your router has enough space, you can indeed only use tcpdump on the router and then pass the dump content back to the PC.

You may need to use two ssh, you don't need to limit your requirements to only enabling one ssh connection.

If your router doesn't have enough space, as I mentioned in the comment, sending traffic directly back to your PC through SSH. Wireshark is not necessary, but it can allow you to see content in real-time.

xfangfang · 2024-05-28T23:09:30Z

https://forum.openwrt.org/t/tcpdump-sniffing-piped-directly-to-wireshark/99729/6

I haven't done it yet, but this method looks very simple

pmgcosta · 2024-05-29T18:46:16Z

dump.zip

Dump done using:

echo > /tmp/dump
exec tcpdump -i eth0.1 -w /tmp/dump & /ps4/pppwn -i eth0.1 --fw 1100 -s1 /ps4/stage1.bin -s2 /ps4/stage2.bin -t 4 -wap 1 -gd 4 -bs 0 -nw -rs
kill $(ps -e | pgrep tcpdump);

xfangfang · 2024-05-30T00:39:09Z

@pmgcosta
I looked at this dump and the problem lies in:

PPPwn_cpp/src/exploit.cpp

Line 967 in ae5c324

std::cout << "[*] Sending PADT..." << std::endl;

After pppwn_cpp sends the PADT, the previous PPP session should end immediately, but your PS4 has not ended yet.

I don't know the specific reason, but maybe you can check if stage1.bin is correct ?

your ps4:

correct behavior:

pmgcosta · 2024-05-30T10:10:58Z

i got them from:

https://github.com/MODDEDWARFARE/PPPwn_WRT/blob/main/stage1_1100.bin
https://github.com/MODDEDWARFARE/PPPwn_WRT/blob/main/stage2_1100.bin

xfangfang · 2024-05-30T10:13:44Z

What I mean is to use tools like sha256sum or md5sum to confirm that stage1.bin on the router is correct

pmgcosta · 2024-05-30T12:32:54Z

Yes they are. checked via md5sum

xfangfang · 2024-05-30T13:44:39Z

Then I don't know why, but you can check if there is any firewall filtering or other differences. This doesn't seem like a problem with pppwn_cpp.

heryandp · 2024-06-04T15:37:17Z

i have same problem here. I use Bolt BL201

kusokpnz · 2024-06-05T15:32:06Z

Similar problem on nexx3020. Tried different versions of openwrt (14,19,21,23), different versions of suitable pppwn bins. Exact same behaviour = Stage(3): [*] Waiting for IPCP configure ACK.... .
I'm trying for version 10.01 (on a PC with the right versions of stage the hack happens immediately and without problems)

Maybe needs to install some packages on openwrt, for example libpcap or other packages ?

kusokpnz · 2024-06-06T21:17:08Z

I managed with some settings on nexx3020 to get it to stage4 (didn't fix the settings, but it's something like multicast enable). But the result is as follows:
After receiving the log:
[+] STAGE 4: Arbitrary payload execution
[*] Sending stage2 payload...
[+] Done!
PS4 reboots and goes into memory recovery mode. It always does this

I tried another router, which has no problems with all stages. It also reaches Stage4-done and restarts the PS4.
There is a suspicion that the implementation of the MIPSEL binary (MIPS does not run on my routers) with some error. At the same time if I take x86_64-macos or linux binaries (from mac or PC) (release or nightly) my PS4 hacks without any problems or restarts

Please check releases (and nightly) for MIPSEL implementation
My hardware that reboots my PS4 on stage4:

MediaTek MT7621 SoC MIPS 1004Kc V2.15
MediaTek MT7620n MIPS 24KEc V5.0 (ramips)

xfangfang · 2024-06-06T21:27:59Z

@kusokpnz I have a router with an MT7621A, and pppwn_cpp can run normally on it

kusokpnz · 2024-06-11T13:24:57Z

@pmgcosta, NEXX WT3020F for openwrt 21+:
Options must be enabled:

Enable IGMP snoping
Enable promiscuous mode
Accept local
in the device settings: br-lan and use interface br-lan for pppwn
And then Stage 3 goes perfectly

@xfangfang Mipsel binary works on MediaTek MT7621 and MediaTek MT7620n. Above I in a lot of tests and made looping stupid mistakes

bambizlu · 2024-06-27T05:17:50Z

I carefully read the message above,then I learned how to use Wireshark. I save Wireshark log and screenshot here：

Wireshark ssh log.zip

I don't know if these are useful or not.

I also followed the suggestions above and modified the settings,enable IGMP snoping,enable multicast,and enable promiscuous mode,I also adjust LAN(br-lan) and WAN(eth0.2),But the result is still the same.

bambizlu · 2024-07-07T08:25:05Z

I've fixed the problem. The result is that the openwrt firmware mismatch. The openwrt official did not provide firmware for 5K-W20, so I can only find some similar models. For example, Asus N14U and Lenovo Y1、Y1S...etc. I found a lot of firmware and tested them, List below:

5K_3.4.3.9-099.trx
7620ahaizhizhu.trx
Buffalo WHR-300HP2 ddwrt.uimage
ikuai1.2.1.bin
lede-17.01.7-ramips-mt7620-y1-squashfs-sysupgrade.bin
lede-17.01.7-ramips-mt7620-y1s-squashfs-sysupgrade.bin
lianxiang xiaoyun.bin
openwrt-14.07-mtk-ramips-mt7620-5k-w20-squashfs-sysupgrade.bin
openwrt-15.05-5k-w20-hbc-zhengshi3-fix-sysupgrade.bin
openwrt-15.05-mt7620-5k-w20-hbc-16M-sysupgrade.bin
openwrt-15.05-ramips-mt7620-5k-w20-squashfs-sysupgrade.bin
openwrt-18.06.9-ramips-mt7620-y1-squashfs-sysupgrade.bin
openwrt-18.06.9-ramips-mt7620-y1s-squashfs-sysupgrade.bin
openwrt-19.07.10-ramips-mt7620-y1-initramfs-kernel.bin
openwrt-19.07.10-ramips-mt7620-y1s-initramfs-kernel.bin
openwrt-19.07.10-ramips-mt7620-y1-squashfs-sysupgrade.bin
openwrt-19.07.10-ramips-mt7620-y1s-squashfs-sysupgrade.bin
openwrt-22.03.6-ramips-mt7620-lenovo_newifi-y1-initramfs-kernel.bin
openwrt-22.03.6-ramips-mt7620-lenovo_newifi-y1-squashfs-sysupgrade.bin
openwrt-23.05.3-ramips-mt7620-lenovo_newifi-y1-squashfs-sysupgrade.bin
openwrt-23.05.3-ramips-mt7620-lenovo_newifi-y1s-squashfs-sysupgrade.bin
openwrt-19.07.10-ramips-mt7620-RT-N14U-initramfs-kernel.bin
openwrt-19.07.10-ramips-mt7620-RT-N14U-squashfs-sysupgrade.bin
openwrt-22.03.6-ramips-mt7620-RT-N14U-initramfs-kernel.bin
openwrt-22.03.6-ramips-mt7620-RT-N14U-squashfs-sysupgrade.bin
openwrt-23.05.3-ramips-mt7620-RT-N14U-initramfs-kernel.bin
openwrt-23.05.3-ramips-mt7620-RT-N14U-squashfs-sysupgrade.bin
PandoraBox 14.09 r1018.bin
PandoraBox-14.09-ralink-mt7620-mt7620a-evb-squashfs-sysupgrade-r1024-20150608.bin
RT-N14U_3.0.0.4_380_8497-g179ec32.trx

I need to test each firmware for over an hour. After many failures, I succeeded once, The firmware used this time is"openwrt-14.07-mtk-ramips-mt7620-5k-w20-squashfs-sysupgrade.bin". After I finished testing, Only two firmware can be used. List below:
openwrt-14.07-mtk-ramips-mt7620-5k-w20-squashfs-sysupgrade.bin(Memory corruption 3 to 8 times)
PandoraBox-14.09-ralink-mt7620-mt7620a-evb-squashfs-sysupgrade-r1024-20150608.bin(Memory corruption 1 to 5 times)

During the process of searching for firmware, I learned that openwrt firmware requires DTS matching. I think this may be the reason for the failure. I don't know how to make DTS(Device Tree Source) and build openwrt Image, So I can only find very old opwnwrt version mach DTS of 5K-W20.

s33k3rs · 2024-08-18T03:00:10Z

i have same problem here. I use Bolt BL201

Did you solved problem?

dddddddddddddddddd946 · 2024-10-13T19:32:51Z

@pmgcosta, NEXX WT3020F for openwrt 21+: Options must be enabled:
1. Enable IGMP snoping

2. Enable promiscuous mode

3. Accept local
   in the device settings: br-lan and use interface br-lan for pppwn
   And then Stage 3 goes perfectly
@xfangfang Mipsel binary works on MediaTek MT7621 and MediaTek MT7620n. Above I in a lot of tests and made looping stupid mistakes

I have tried to run this on the wt3020 and I get stuck on stage 3 IPCP config ack every time.
I have tried openwrt 19, 21 and 23 with these settings and the firewall disabled but it still gets stuck.
Did you do anything else in particular to get it to run successfully?
Using pppwn-lite it passes stage 3 every time without fail, so I feel like I am missing something obvious.
I will try on mirouter 4a gigabit later on, but would prefer to have it running on the smaller wt3020

kusokpnz · 2024-10-13T21:16:02Z

@pmgcosta, NEXX WT3020F for openwrt 21+: Options must be enabled:
1. Enable IGMP snoping

2. Enable promiscuous mode

3. Accept local
   in the device settings: br-lan and use interface br-lan for pppwn
   And then Stage 3 goes perfectly
@xfangfang Mipsel binary works on MediaTek MT7621 and MediaTek MT7620n. Above I in a lot of tests and made looping stupid mistakes
I have tried to run this on the wt3020 and I get stuck on stage 3 IPCP config ack every time. I have tried openwrt 19, 21 and 23 with these settings and the firewall disabled but it still gets stuck. Did you do anything else in particular to get it to run successfully? Using pppwn-lite it passes stage 3 every time without fail, so I feel like I am missing something obvious. I will try on mirouter 4a gigabit later on, but would prefer to have it running on the smaller wt3020

hi, i tried to do everything on versions <19 (since they load faster), but to no avail. on versions 21 and 23 (original, not forks), from a clean installation i did the above and point 3 - set the settings exclusively for br-lan and everything worked right away, without any other actions. i checked it several times before i wrote the method. (fyi i have a breed bootloader. don't think it makes any differences)

xfangfang added the help wanted Extra attention is needed label Jun 1, 2024

xfangfang mentioned this issue Jun 24, 2024

mipsel(mt7620a) router stop at STAGE 2 or STAGE3 #75

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Stuck on [+] STAGE 3: Remote code execution > Last step > Waiting for IPCP configure ACK... #57

Stuck on [+] STAGE 3: Remote code execution > Last step > Waiting for IPCP configure ACK... #57

pmgcosta commented May 28, 2024

pmgcosta commented May 28, 2024 •

edited

Loading

xfangfang commented May 28, 2024 •

edited

Loading

xfangfang commented May 28, 2024

pmgcosta commented May 29, 2024

xfangfang commented May 30, 2024 •

edited

Loading

pmgcosta commented May 30, 2024

xfangfang commented May 30, 2024

pmgcosta commented May 30, 2024

xfangfang commented May 30, 2024

heryandp commented Jun 4, 2024 •

edited

Loading

kusokpnz commented Jun 5, 2024

kusokpnz commented Jun 6, 2024 •

edited

Loading

xfangfang commented Jun 6, 2024 •

edited

Loading

kusokpnz commented Jun 11, 2024

bambizlu commented Jun 27, 2024

bambizlu commented Jul 7, 2024

s33k3rs commented Aug 18, 2024

dddddddddddddddddd946 commented Oct 13, 2024

kusokpnz commented Oct 13, 2024

Stuck on [+] STAGE 3: Remote code execution > Last step > Waiting for IPCP configure ACK... #57

Stuck on [+] STAGE 3: Remote code execution > Last step > Waiting for IPCP configure ACK... #57

Comments

pmgcosta commented May 28, 2024

pmgcosta commented May 28, 2024 • edited Loading

xfangfang commented May 28, 2024 • edited Loading

xfangfang commented May 28, 2024

pmgcosta commented May 29, 2024

xfangfang commented May 30, 2024 • edited Loading

pmgcosta commented May 30, 2024

xfangfang commented May 30, 2024

pmgcosta commented May 30, 2024

xfangfang commented May 30, 2024

heryandp commented Jun 4, 2024 • edited Loading

kusokpnz commented Jun 5, 2024

kusokpnz commented Jun 6, 2024 • edited Loading

xfangfang commented Jun 6, 2024 • edited Loading

kusokpnz commented Jun 11, 2024

bambizlu commented Jun 27, 2024

bambizlu commented Jul 7, 2024

s33k3rs commented Aug 18, 2024

dddddddddddddddddd946 commented Oct 13, 2024

kusokpnz commented Oct 13, 2024

pmgcosta commented May 28, 2024 •

edited

Loading

xfangfang commented May 28, 2024 •

edited

Loading

xfangfang commented May 30, 2024 •

edited

Loading

heryandp commented Jun 4, 2024 •

edited

Loading

kusokpnz commented Jun 6, 2024 •

edited

Loading

xfangfang commented Jun 6, 2024 •

edited

Loading