OT need to reprogram the router

Ihave a remote site were I can ssh to the node…

But someone that was trying to help debug a supposed network problem had the bright idea to put the node on dmz.

That did not fix the problem (was a bad cholink password) but he did not put it back in normal mode before leaving the site…

Now we have hacker that bang the machine like hell

I cant go back there before a few day, and wonder if I could use the node as a redirector to access the web page of the router…

I did try to enable remote management by telneting to the machine from the asterisk machine, but it did not work… (it is a dd-wrt router) .

Anyone can help me?

Pierre

VE2PF

How about using SSH port forwarding to point a port on the Asterisk
server back at the dd-wrt web interface? Something like this:

ssh -L 8000:192.168.1.1:80 user@asteriskserver

This assumes: dd-wrt is at 192.168.1.1 with web interface on port 80.
Now run that command and go to http://localhost:8000/ in your browser
to access it.

Tom KD7LXL

···

On Mon, Jul 20, 2015 at 5:33 PM, pete M <petem001@hotmail.com> wrote:

Ihave a remote site were I can ssh to the node..

But someone that was trying to help debug a supposed network problem had the
bright idea to put the node on dmz.

That did not fix the problem (was a bad cholink password) but he did not put
it back in normal mode before leaving the site..

Now we have hacker that bang the machine like hell

I cant go back there before a few day, and wonder if I could use the node as
a redirector to access the web page of the router..

I did try to enable remote management by telneting to the machine from the
asterisk machine, but it did not work.. (it is a dd-wrt router) .

Anyone can help me?

Thanks Tom

I did that from my terminal on a debian machine

pierre@debian:~$ su

Password:

root@debian:/home/pierre# ssh -L 8000:192.168.0.1 root@xxxxxx.xxxxxxx.com

Bad local forwarding specification ‘8000:192.168.0.1’

did the same on the node same answer…

looks like it is not the goodthing…

dont forget the ssh server at the node is on port 222…

···

From: tom@tomh.us
Date: Mon, 20 Jul 2015 17:44:33 -0700
Subject: Re: [App_rpt-users] OT need to reprogram the router
To: petem001@hotmail.com
CC: app_rpt-users@ohnosec.org

On Mon, Jul 20, 2015 at 5:33 PM, pete M petem001@hotmail.com wrote:

Ihave a remote site were I can ssh to the node…

But someone that was trying to help debug a supposed network problem had the
bright idea to put the node on dmz.

That did not fix the problem (was a bad cholink password) but he did not put
it back in normal mode before leaving the site…

Now we have hacker that bang the machine like hell

I cant go back there before a few day, and wonder if I could use the node as
a redirector to access the web page of the router…

I did try to enable remote management by telneting to the machine from the
asterisk machine, but it did not work… (it is a dd-wrt router) .

Anyone can help me?

How about using SSH port forwarding to point a port on the Asterisk
server back at the dd-wrt web interface? Something like this:

ssh -L 8000:192.168.1.1:80 user@asteriskserver

This assumes: dd-wrt is at 192.168.1.1 with web interface on port 80.
Now run that command and go to http://localhost:8000/ in your browser
to access it.

Tom KD7LXL

You missed some details. Try this:

ssh -L 8000:192.168.0.1:80 root@xxxxxx.xxxxxxx.com -p 222

Also, there's no need to run that as root. After running it, point the
web browser on your Debian machine to http://127.0.0.1:8000/ to access
the content at http://192.168.0.1:80/

Tom KD7LXL

···

On Mon, Jul 20, 2015 at 6:22 PM, pete M <petem001@hotmail.com> wrote:

Thanks Tom

I did that from my terminal on a debian machine

pierre@debian:~$ su
Password:
root@debian:/home/pierre# ssh -L 8000:192.168.0.1 root@xxxxxx.xxxxxxx.com
Bad local forwarding specification '8000:192.168.0.1'

did the same on the node same answer..

looks like it is not the goodthing..

dont forget the ssh server at the node is on port 222..

got it to work!! dmz gone and only the needed port ar now enabled…

the load on the machine dropped by a lot!

thanks again for your help!

···

From: tom@tomh.us
Date: Mon, 20 Jul 2015 18:38:08 -0700
Subject: Re: [App_rpt-users] OT need to reprogram the router
To: petem001@hotmail.com
CC: app_rpt-users@ohnosec.org

On Mon, Jul 20, 2015 at 6:22 PM, pete M petem001@hotmail.com wrote:

Thanks Tom

I did that from my terminal on a debian machine

pierre@debian:~$ su
Password:
root@debian:/home/pierre# ssh -L 8000:192.168.0.1 root@xxxxxx.xxxxxxx.com
Bad local forwarding specification ‘8000:192.168.0.1’

did the same on the node same answer…

looks like it is not the goodthing…

dont forget the ssh server at the node is on port 222…

You missed some details. Try this:

ssh -L 8000:192.168.0.1:80 root@xxxxxx.xxxxxxx.com -p 222

Also, there’s no need to run that as root. After running it, point the
web browser on your Debian machine to http://127.0.0.1:8000/ to access
the content at http://192.168.0.1:80/

Tom KD7LXL