Retronetworking

h1. 3Com SuperStack II RAS 1500

@xent acquired a 3Com SuperStack II Remote Access System 1500 equipped with 2 x 2-Port ISDN BRI I/O Card 

h2. Documentation

h2. Security

The system doesn't really seems to be particularly secure, the serial console doesn't ask for any password and we found quickly exploit for the platform. (https://isec.pl/en/vulnerabilities/isec-0009-3com-ras.txt)

h2. Boot Log

<pre>

Initializing....

Running Power On Diagnostics Version 2.5.0 (B 159)

2 Percent Complete

4 Percent Complete

6 Percent Complete

8 Percent Complete

10 Percent Complete

12 Percent Complete

14 Percent Complete

16 Percent Complete

18 Percent Complete

21 Percent Complete

23 Percent Complete

25 Percent Complete

27 Percent Complete

29 Percent Complete

31 Percent Complete

33 Percent Complete

35 Percent Complete

37 Percent Complete

ERROR !   

.         Error Code -> 07102000..Port FG  LRT    Type EC1 EC2 EC3

      Expected Data -> 00000080..[00] [07][01 00][02] [00  00  00]   

      Received Data -> 00000000..LRT = 36, Error Type = 2, Port = 0.

               Mask -> 000000FF

 Address of Failure -> F07A0034

       Text Message -> RTC Access Failure - Reg D - Cell exhausted

Test #  Test Name                                       Port   Time   Status

-------+----------------------------------------------+------+------+--------

701.RTC Reset -------------------------------------       (1) - FAILED

Enter.'C' to Continue with POST

.'B' to Reboot

.'Q' Quit and Load Operational Software

Starting Operational Software

** RAS 1500 Boot-Loader Ver. 2.5.0 (B 159), Built on 2000-6-3, 10:56:7 **

SDL2 is initializing the FLASH file system. Please wait....

SDL2 has completed initializing the FLASH file system.

Current contents of the FLASH file system:

.mmsram.bin;............................size:  196608 bytes.

.mmboot.bin;............................size:   65536 bytes.

.pilgrim.bin.z;.........................size: 1611888 bytes.

.hdmplus.bin.z;.........................size:  801512 bytes.

.PilgrimStrings.ind.gz;.................size:   72585 bytes.

.PilgrimStrings.str.gz;.................size:   82516 bytes.

.update1.bin.z;.........................size:    3529 bytes.

.RoboString.ind;........................size:   10612 bytes.

.RoboString.str;........................size:    8621 bytes.

.QuickSetup.cfg;........................size:     729 bytes.

.EventHandler.cfg;......................size:       0 bytes.

.CLI.cfg;...............................size:      42 bytes.

.TermProt.cfg;..........................size:      39 bytes.

.SnmpProcess.cfg;.......................size:      16 bytes.

.BridgeProcess.cfg;.....................size:      68 bytes.

.TftpProcess.cfg;.......................size:      27 bytes.

.Appletalk.cfg;.........................size:      88 bytes.

.PppProcess.cfg;........................size:      44 bytes.

.FilterMgr.cfg;.........................size:      24 bytes.

.DialOutProcess.cfg;....................size:      29 bytes.

.RemotePingProcess.cfg;.................size:      21 bytes.

.TcpProcess.cfg;........................size:      19 bytes.

.DNMSProcess.cfg;.......................size:     133 bytes.

.DNS.cfg;...............................size:     174 bytes.

.IpxProcess.cfg;........................size:     133 bytes.

.DHCP.cfg;..............................size:     208 bytes.

.RoboExecNMProcess.cfg;.................size:    1844 bytes.

.dhcpProxy.cfg;.........................size:     288 bytes.

.IPForwarder.cfg;.......................size:     503 bytes.

.CallInitProcess.cfg;...................size:    1827 bytes.

.ConfigProcess.cfg;.....................size:    2867 bytes.

.Robo.stats;............................size:     788 bytes.

.user_settings.cfg;.....................size:   15521 bytes.

Total of 33 files in the file system.

SDL2 is ready.

AT{B} <filename> .. To execute a file type

AT{C} ............. To continue boot sequence

AT{D} <filename> .. To delete a file type

AT{E} ............. To erase all flash files

AT{H} ............. To halt boot sequence

AT{L} ............. To list all files

AT{P} ............. To prepare system for download

AT{Z} ............. To download a file type

AT{?} ............. To get help

. RAS 1500 Boot-Loader RM Manager

Slave Image Load Address 0x80000000

Master Image Load Address 0x80000000

Slave Image File Name: hdmplus.bin.z

Master Image File Name: pilgrim.bin.z

Master: Initialization {ldrInitializeMaster} : .PASS

Master: Load Slave {ldrLoadSlaveProcess} : .PASS

Master: Synchronization {ldrSyncMasterToSlave} : .PASS

Master: Load Slave OpCode Image {ldrLoadApplicationImage} : 

Reinitializing LZH module.

In : 1900024 bytes

--10--20--30--40--50--60--70--80--90--100

.........................................   

Restored

.PASS

Master: Load Master OpCode Image {ldrLoadApplicationImage} : 

Reinitializing LZH module.

In : 3766556 bytes

--10--20--30--40--50--60--70--80--90--100

.........................................   

Restored

.PASS

Master: Start Slave OpCode Image {ldrExecuteApplication} : .PASS

Master: Start Master OpCode Image {ldrExecuteApplication} : 

-------------------------------------------------------------------------------

IPX/IP Dial-out networking software      Copyright (c)1985-1996,

       Network Products Corporation      Pasadena, CA       All rights reserved

AppleTalk-compatible networking software Copyright 1993-1995,

       Quiotix Corporation               Menlo Park, CA     All rights reserved

TCP/IP networking software               Copyright 1988-1995,

       Epilogue Corporation              Albuquerque, NM    All rights reserved

IP routing software                      Copyright 1993-1995,

       RainbowBridge Communication. Inc. Rockville, MD      All rights reserved

IPX networking software                  Copyright 1994-1995,

       RouterWare Inc.                   Newport Beach, CA  Unpublished - 

       Rights reserved under the Copyright Laws of the United States.

VJ TCP Header Compression software       Copyright (c) 1989, 1991, 1992, 1993,

       Regents of the University of California.             All rights reserved.

-------------------------------------------------------------------------------

RAS1500, V2.5.0

------3Com CORPORATION------Santa Clara, CA---------

Software contained in this product is Copyright 1998-1999

----------------ALL RIGHTS RESERVED-----------------

Starting up the RAS1500 system Executive...

Segment sizes:

  Control area = 11580 bytes

  HDM To Be Freed segment = 6260 bytes

  HDM Free Pool segment = 6260 bytes

  Inbound segment = 1620 bytes

  Outbound segment =

 1620 bytes

  Buffer segment = 218400 bytes (1560 buffers)

Starting up RAS1500Initializing Firewire Device ....

Initialized the Firewire Device

 Configuration process...

RAS1500 Configuration Process starting......

RAS1500 Initializing Network Management Processes...

RAS1500 starting RoboExec NetMan process......

RAS1500 starting Event Handler process......

RAS1500 configuring interfaces......

### SLot1 Type:  0 1 0 2 ff ff ff ff 

### SLot2 Type: 0 1 0 2 ff ff ff ff 

Adding BRD device

Adding firewire device

RAS1500 starting required processes......

RAS1500 starting Call Initiator process (CIP)......

RAS1500 configuring devices in CIP......

RAS1500 configuring networks......

RAS1500 Adding networks to LAN interfaces....

RAS1500 enabling networks on LAN interfaces....

Configuring Network Services.....

Starting the CLI......

Please Wait for Prompt...

ras1500> 

</pre>