[转帖]中兴ZTE 831 ADSL Modem中的秘密
今天闲得无聊，便在宿舍里面找书看，看到一本中兴831的用户手册，上面介绍了可以通过web界面升级软件，结果找了半天也没有发现用什么地址登陆web，便gooooooooogle起来，结果找到很多关于设置ADSL Modem的
PPPoE+NAT的例子，设置好了之后，用nmap扫了一下网关（也就是ADSL Modem）的地址，提示使用的是Linux，
并且开放了8080，80和23，觉得有点意思，便登陆上去。经过一番测试，发现运行的是精简过了的ucLinux,并
且使用的是定制的busybox，将cd和ls等工具都精简掉了，编辑器也没有：（，并且使用了iptables的模块，下
面的是系统输出,可以发现除了默认的ZXDSL用户和密码之外，还有一个用户user:user可以登陆web界面，不过
不具有修改权限。
> cat /proc/cpuinfo CPU信息
system type : RTA230
processor : 0
cpu model : BCM6345 V0.0
BogoMIPS : 92.97
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector: no
hardware watchpoint : no
VCED exceptions : not available
VCEI exceptions : not available
> cat /proc/devices 设备信息
Character devices:
1 mem
2 pty
3 ttyp
4 ttyS
5 cua
10 misc
108 ppp
162 raw
205 atmapi
206 bcrmboard
208 adsl
212 bcm
Block devices:
31 mtdblock
> cat /proc/iomem 内存信息
00000000-000007bf : System RAM
> cat /proc/loadavg 系统负载
0.07 0.09 0.09 2/19 626
> cat /proc/locks 锁
1: POSIXADVISORYREAD130 00:07:297 4 4 802ef180 80198998 80198998 00000000
802ef18c
> cat /proc/filesystems 文件系统信息
nodev rootfs
nodev bdev
nodev proc
nodev sockfs
nodev tmpfs
nodev shm
nodev pipefs
squashfs
> cat /proc/meminfo 内存信息
total: used: free:shared: buffers:cached:
Mem: 61972485885952 311296 0 2990081118208
Swap: 0 0 0
MemTotal: 6052 kB
MemFree: 304 kB
MemShared: 0 kB
Buffers: 292 kB
Cached: 1092 kB
SwapCached: 0 kB
Active: 1892 kB
Inactive: 696 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 6052 kB
LowFree: 304 kB
SwapTotal: 0 kB
SwapFree: 0 kB
> cat /proc/modules 模块信息
ipt_TCPMSS 2492 2
ipt_LOG 3532 2
ipt_REDIRECT 708 6
ipt_MASQUERADE 1364 1
ipt_MARK 668 0 (unused)
ipt_state 552 2
ipt_tos 364 0 (unused)
iptable_mangle 1884 0 (unused)
iptable_filter 1708 0 (unused)
ip_nat_pptp 1644 0 (unused)
ip_nat_ftp 3112 0 (unused)
ip_conntrack_pptp 3180 0 (unused)
ip_conntrack_ftp 3772 0 (unused)
ip_nat_wm 1208 0 (unused)
ip_conntrack_wm 1212 0 (unused)
ip_nat_dtx8 1288 0 (unused)
ip_conntrack_dtx8 1228 0 (unused)
ip_nat_irc 2280 0 (unused)
ip_conntrack_irc 2684 0 (unused)
ip_nat_h323 2608 0 (unused)
ip_conntrack_h323 2012 0 (unused)
iptable_nat 17528 7 [ipt_REDIRECT ipt_MASQUERADE ip_nat_pptp ip_nat
_ftp ip_nat_wm ip_nat_dtx8 ip_nat_irc ip_nat_h323]
ip_conntrack 19168 8 [ipt_REDIRECT ipt_MASQUERADE ipt_state ip_nat_f
tp ip_conntrack_pptp ip_conntrack_ftp ip_nat_wm ip_conntrack_wm ip_nat_dtx8 ip_c
onntrack_dtx8 ip_nat_irc ip_conntrack_irc ip_nat_h323 ip_conntrack_h323 iptable_
nat]
ip_tables 1446412 [ipt_TCPMSS ipt_LOG ipt_REDIRECT ipt_MASQUERADE
ipt_MARK ipt_state ipt_tos iptable_mangle iptable_filter iptable_nat]
bcm6345net 14680 2
bcmprocfs 8680 0
> cat /proc/slabinfo
slabinfo - version: 1.1
kmem_cache 56 72 108 2 2 1
ip_conntrack 470 828 320 69 69 1
ip_mrt_cache 0 0 96 0 0 1
tcp_tw_bucket 0 0 96 0 0 1
tcp_bind_bucket 9 113 32 1 1 1
tcp_open_request 0 0 64 0 0 1
inet_peer_cache 1 59 64 1 1 1
ip_fib_hash 15 113 32 1 1 1
ip_dst_cache 1698 2400 160100100 1
arp_cache 5 40 96 1 1 1
blkdev_requests 64 80 96 2 2 1
dnotify cache 0 0 20 0 0 1
file lock cache 1 40 96 1 1 1
fasync cache 0 0 16 0 0 1
uid_cache 0 0 32 0 0 1
skbuff_head_cache 475 480 160 20 20 1
sock 24 25 768 5 5 1
sigqueue 0 29 132 0 1 1
cdev_cache 5 59 64 1 1 1
bdev_cache 1 59 64 1 1 1
mnt_cache 9 59 64 1 1 1
inode_cache 88 128 480 16 16 1
dentry_cache 84 210 128 7 7 1
filp 83 90 128 3 3 1
names_cache 0 2 4096 0 2 1
buffer_head 384 640 96 16 16 1
mm_struct 13 30 128 1 1 1
vm_area_struct 180 200 96 5 5 1
fs_cache 12 113 32 1 1 1
files_cache 12 18 416 2 2 1
signal_act 14 18 672 3 3 1
size-131072(DMA) 0 0 131072 0 0 32
size-131072 0 0 131072 0 0 32
size-65536(DMA) 0 065536 0 0 16
size-65536 0 065536 0 0 16
size-32768(DMA) 0 032768 0 0 8
size-32768 2 232768 2 2 8
size-16384(DMA) 0 016384 0 0 4
size-16384 1 116384 1 1 4
size-8192(DMA) 0 0 8192 0 0 2
size-8192 8 8 8192 8 8 2
size-4096(DMA) 0 0 4096 0 0 1
size-4096 22 22 4096 22 22 1
size-2048(DMA) 0 0 2048 0 0 1
size-2048 224 246 2048114123 1
size-1024(DMA) 0 0 1024 0 0 1
size-1024 14 16 1024 4 4 1
size-512(DMA) 0 0 512 0 0 1
size-512 14 24 512 2 3 1
size-256(DMA) 0 0 256 0 0 1
size-256 8 15 256 1 1 1
size-128(DMA) 0 0 128 0 0 1
size-128 575 600 128 20 20 1
size-64(DMA) 0 0 64 0 0 1
size-64 245 295 64 5 5 1
size-32(DMA) 0 0 32 0 0 1
size-32 263 339 32 3 3 1
> cat /proc/stat 状态信息
cpu4489 0 224978 1400908
cpu0 4489 0 224978 1400908
page 803 0
swap 0 0
intr 3514234 0 0 0 0 0 0 0 1629684 0 0 0 3753 1289450 0 0 0 0 0 0 0 0 0 591347 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
disk_io:
ctxt 1483732
btime 0
processes 646
> cat /proc/uptime 系统启动时间
8182.10 7997.91
> cat /proc/version 系统版本信息
Linux version 2.4.17 (leon_zhou@localhost.localdomain) (gcc version 3.1) #2 Mon
Mar 28 17:43:16 CST 2005
> iptables -L FILTER表内存
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all--anywhere anywhere state RELATED,ESTABL
ISHED
ACCEPT tcp--anywhere anywhere tcp dpt:webcache
ACCEPT tcp--anywhere anywhere tcp dpt:telnet
ACCEPT icmp --anywhere anywhere icmp echo-request
ACCEPT udp--anywhere anywhere udp dpt:snmp
LOG tcp--anywhere anywhere tcp flags:SYN,RST,ACK/SYN LOG level
alert prefix `Intrusion -> ';
ACCEPT tcp--anywhere anywhere tcp dpts:1863:1864
ACCEPT tcp--anywhere anywhere tcp dpt:4443
ACCEPT tcp--anywhere anywhere tcp dpt:5566
ACCEPT tcp--anywhere anywhere tcp dpts:40000:40099
DROP all--anywhere anywhere
ACCEPT all--anywhere anywhere state RELATED,ESTABL
ISHED
LOG tcp--anywhere anywhere tcp flags:SYN,RST,ACK/SYN LOG level
alert prefix `Intrusion -> ';
ACCEPT tcp--anywhere anywhere tcp dpts:1863:1864
ACCEPT tcp--anywhere anywhere tcp dpt:4443
ACCEPT tcp--anywhere anywhere tcp dpt:5566
ACCEPT tcp--anywhere anywhere tcp dpts:40000:40099
DROP all--anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
TCPMSS tcp--anywhere anywhere tcp flags:SYN,RST/SY
N TCPMSS clamp to PMTU
TCPMSS tcp--anywhere anywhere tcp flags:SYN,RST/SY
N TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain AskeyChain (0 references)
target prot opt source destination
> iptables -t nat -L NAT表内存
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp--anywhere anywhere tcp dpt:5190 redir p
orts 5190
REDIRECT tcp--anywhere anywhere tcp dpt:1863 redir p
orts 1863
REDIRECT icmp --anywhere 192.168.2.1
REDIRECT tcp--anywhere anywhere tcp dpt:www redir po
rts 8080
DROP tcp--anywhere anywhere tcp dpt:webcache
REDIRECT tcp--anywhere anywhere tcp dpt:2323 redir p
orts 23
REDIRECT udp--anywhere anywhere udp dpt:snmp redir p
orts 161
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADEall--anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
> iptables -t mangle -L MANGLE表内存
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
> cat /proc/self/status CAT进程的信息
Name: cat
State:R (running)
Tgid: 719
Pid: 719
PPid: 718
TracerPid: 0
Uid: 0 0 0 0
Gid: 0 0 0 0
FDSize: 32
Groups:
VmSize: 1220 kB
VmLck: 0 kB
VmRSS: 248 kB
VmData: 624 kB
VmStk: 12 kB
VmExe: 268 kB
VmLib: 292 kB
SigPnd: 00000000
SigBlk: 00000000
SigIgn: 00000004
SigCgt: 00000000
CapInh: 0000000000000000
CapPrm: 00000000fffffeff
CapEff: 00000000fffffeff
> cat /proc/self/maps 进程映射
00400000-00443000 r-xp 00000000 1f:00 91 /bin/busybox
10000000-10002000 rw-p 00043000 1f:00 91 /bin/busybox
10002000-1000c000 rwxp 00000000 00:00 0
2aaa8000-2aaae000 r-xp 00000000 1f:00 423 /lib/ld-uClibc.so.0
2aaae000-2aaaf000 rw-p 00000000 00:00 0
2aaed000-2aaee000 rw-p 00005000 1f:00 423 /lib/ld-uClibc.so.0
2aaee000-2aaf2000 r-xp 00000000 1f:00 440 /lib/libcrypt.so.0
2aaf2000-2ab31000 ---p 00004000 00:00 0
2ab31000-2ab32000 rw-p 00003000 1f:00 440 /lib/libcrypt.so.0
2ab32000-2ab43000 rw-p 00000000 00:00 0
2ab43000-2ab82000 r-xp 00000000 1f:00 414 /lib/libc.so.0
2ab82000-2abc1000 ---p 0003f000 00:00 0
2abc1000-2abc3000 rw-p 0003e000 1f:00 414 /lib/libc.so.0
2abc3000-2abc5000 rw-p 00000000 00:00 0
7fff5000-7fff8000 rwxp ffffe000 00:00 0
> ifconfig -a 接口信息
atm0 Link encap:UNSPECHWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-0
-00
MTU:0Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:649460112 (619.3 MiB)TX bytes:328871904 (313.6 MiB)
atm52 Link encap:Point-Point Protocol
inet addr:192.168.2.1P-t-P:192.168.2.1Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICASTMTU:9180Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 iB)TX bytes:0 (0.0 iB)
br0 Link encap:EthernetHWaddr 00:D0:D0:6C:68:F8
inet addr:192.168.1.1Bcast:192.168.1.255Mask:255.255.255.0
UP BROADCAST RUNNING MULTICASTMTU:1500Metric:1
RX packets:798977 errors:0 dropped:0 overruns:0 frame:0
TX packets:816414 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:285766301 (272.5 MiB)TX bytes:615967427 (587.4 MiB)
cpcs0 Link encap:UNSPECHWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-0
-00
MTU:65535Metric:1
RX packets:0 errors:1 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:649460160 (619.3 MiB)TX bytes:328872048 (313.6 MiB)
dsl0 Link encap:UNSPECHWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-0
-00
MTU:0Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 iB)TX bytes:0 (0.0 iB)
eth0 Link encap:EthernetHWaddr 00:D0:D0:6C:xx:xx
UP BROADCAST RUNNING MULTICASTMTU:1500Metric:1
RX packets:798984 errors:0 dropped:0 overruns:0 frame:0
TX packets:816415 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:300148747 (286.2 MiB)TX bytes:619869904 (591.1 MiB)
Interrupt:22 Base address:0x1800
lo Link encap:Local Loopback
inet addr:127.0.0.1Mask:255.0.0.0
UP LOOPBACK RUNNINGMTU:16436Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:672 (672.0 iB)TX bytes:672 (672.0 iB)
nas33 Link encap:EthernetHWaddr 02:D0:D0:6C:xx:xx
UP BROADCAST RUNNING MULTICASTMTU:1500Metric:1
RX packets:827303 errors:0 dropped:0 overruns:0 frame:0
TX packets:793562 errors:0 dropped:375 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:610618135 (582.3 MiB)TX bytes:309340781 (295.0 MiB)
ppp33 Link encap:Point-Point Protocol
inet addr:xxx.xxx.xxx.xxxP-t-P:xxx.xxx.xxx.xxxMask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICASTMTU:1492Metric:1
RX packets:555723 errors:0 dropped:0 overruns:0 frame:0
TX packets:561858 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:433347669 (413.2 MiB)TX bytes:248502991 (236.9 MiB)
转贴来自：http://www.ykzj.org/article.php?articleid=1931
[转帖]中兴ZTE 831 ADSL Modem中的秘密
鼓励一下！[转帖]中兴ZTE 831 ADSL Modem中的秘密
那能不能用TC+iptables做QOS呢 呵呵!
页:
[1]