Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
The manufacturer's original 2.00.08 firmware has shown to be flaky,
particularly in regards to the (Atheros) wireless driver. That said,
the upgrade procedure has been tested with high likelihood (> 98%) of success.
Testing showed that in > 98% of test runs, the upgrade was successful. In some
cases, the device would reboot, but an error or kernel panic (usually related
to the wireless driver) would occur. In all cases where an error occurred
during the reboot process, an additional power-cycle would resolve the
problem.
During testing, the most common action leading to a failure was not setting
the device back to the manufacturer's original firmware AND performing an
additional power-cycle after the device fully rebooted (steps 1 and 2 of the
TEST PROCEDURE section).
If the cisc0wn-2.00.08.pl script returns "Failed", the most common cause is
running against a CB firmware (instead of original manufacturer's
firmware). This puts the device in a state whereby even if the original
manufacturer's firmware is restored, upon reboot the device's web page will
always report "500 Internal Error". To recover the unit, do the following:
1. Hold the reset button while powering the router on. Continue holding it
until the power LED begins alternating between green and orange.
2. Connect a laptop to one of the four LAN ports of the device.
3. Statically assign an IP address such as 192.168.0.7 to the laptop. Note
that the router will have the address 192.168.0.10, which should be
pingable.
4. telnet to 192.168.0.10, port 9000:
telnet 192.168.0.10 9000
When the telnet program connects, hit CTRL-C twice very quickly.
A "RedBoot>" prompt should appear.
5. From the Redboot prompt, execute (exactly and carefully):
mfill -b 0x70000 -l 128 -1
fis write -f 0x503b0000 -b 0x70000 -l 128
(the fis write command will have you verify 'y' to continue)
6. Once the fis write command completes, type "reset", and the router
should reboot.
63