3Com SuperStack II RAS 1500 » History » Version 2
xent, 08/16/2024 09:15 PM
1 | 1 | xent | h1. 3Com SuperStack II RAS 1500 |
---|---|---|---|
2 | |||
3 | @xent acquired a 3Com SuperStack II Remote Access System 1500 equipped with 2 x 2-Port ISDN BRI I/O Card |
||
4 | |||
5 | |||
6 | |||
7 | h2. Documentation |
||
8 | |||
9 | 2 | xent | * attachment:3Com_RAS_1500_Getting_Started.pdf |
10 | * attachment:3Com_RAS_1500_System_Management.pdf |
||
11 | 1 | xent | |
12 | h2. Security |
||
13 | |||
14 | The system doesn't really seems to be particularly secure, the serial console doesn't ask for any password and we found quickly exploit for the platform. (https://isec.pl/en/vulnerabilities/isec-0009-3com-ras.txt) |
||
15 | |||
16 | |||
17 | |||
18 | h2. Boot Log |
||
19 | |||
20 | <pre> |
||
21 | |||
22 | |||
23 | Initializing.... |
||
24 | |||
25 | |||
26 | |||
27 | Running Power On Diagnostics Version 2.5.0 (B 159) |
||
28 | |||
29 | 2 Percent Complete |
||
30 | 4 Percent Complete |
||
31 | 6 Percent Complete |
||
32 | 8 Percent Complete |
||
33 | 10 Percent Complete |
||
34 | 12 Percent Complete |
||
35 | 14 Percent Complete |
||
36 | 16 Percent Complete |
||
37 | 18 Percent Complete |
||
38 | 21 Percent Complete |
||
39 | 23 Percent Complete |
||
40 | 25 Percent Complete |
||
41 | 27 Percent Complete |
||
42 | 29 Percent Complete |
||
43 | 31 Percent Complete |
||
44 | 33 Percent Complete |
||
45 | 35 Percent Complete |
||
46 | 37 Percent Complete |
||
47 | |||
48 | ERROR ! |
||
49 | |||
50 | |||
51 | . Error Code -> 07102000..Port FG LRT Type EC1 EC2 EC3 |
||
52 | |||
53 | Expected Data -> 00000080..[00] [07][01 00][02] [00 00 00] |
||
54 | |||
55 | Received Data -> 00000000..LRT = 36, Error Type = 2, Port = 0. |
||
56 | |||
57 | Mask -> 000000FF |
||
58 | |||
59 | Address of Failure -> F07A0034 |
||
60 | |||
61 | Text Message -> RTC Access Failure - Reg D - Cell exhausted |
||
62 | |||
63 | |||
64 | Test # Test Name Port Time Status |
||
65 | |||
66 | -------+----------------------------------------------+------+------+-------- |
||
67 | |||
68 | 701.RTC Reset ------------------------------------- (1) - FAILED |
||
69 | |||
70 | |||
71 | |||
72 | Enter.'C' to Continue with POST |
||
73 | |||
74 | .'B' to Reboot |
||
75 | |||
76 | .'Q' Quit and Load Operational Software |
||
77 | |||
78 | Starting Operational Software |
||
79 | |||
80 | |||
81 | ** RAS 1500 Boot-Loader Ver. 2.5.0 (B 159), Built on 2000-6-3, 10:56:7 ** |
||
82 | |||
83 | SDL2 is initializing the FLASH file system. Please wait.... |
||
84 | |||
85 | SDL2 has completed initializing the FLASH file system. |
||
86 | |||
87 | Current contents of the FLASH file system: |
||
88 | |||
89 | .mmsram.bin;............................size: 196608 bytes. |
||
90 | |||
91 | .mmboot.bin;............................size: 65536 bytes. |
||
92 | |||
93 | .pilgrim.bin.z;.........................size: 1611888 bytes. |
||
94 | |||
95 | .hdmplus.bin.z;.........................size: 801512 bytes. |
||
96 | |||
97 | .PilgrimStrings.ind.gz;.................size: 72585 bytes. |
||
98 | |||
99 | .PilgrimStrings.str.gz;.................size: 82516 bytes. |
||
100 | |||
101 | .update1.bin.z;.........................size: 3529 bytes. |
||
102 | |||
103 | .RoboString.ind;........................size: 10612 bytes. |
||
104 | |||
105 | .RoboString.str;........................size: 8621 bytes. |
||
106 | |||
107 | .QuickSetup.cfg;........................size: 729 bytes. |
||
108 | |||
109 | .EventHandler.cfg;......................size: 0 bytes. |
||
110 | |||
111 | .CLI.cfg;...............................size: 42 bytes. |
||
112 | |||
113 | .TermProt.cfg;..........................size: 39 bytes. |
||
114 | |||
115 | .SnmpProcess.cfg;.......................size: 16 bytes. |
||
116 | |||
117 | .BridgeProcess.cfg;.....................size: 68 bytes. |
||
118 | |||
119 | .TftpProcess.cfg;.......................size: 27 bytes. |
||
120 | |||
121 | .Appletalk.cfg;.........................size: 88 bytes. |
||
122 | |||
123 | .PppProcess.cfg;........................size: 44 bytes. |
||
124 | |||
125 | .FilterMgr.cfg;.........................size: 24 bytes. |
||
126 | |||
127 | .DialOutProcess.cfg;....................size: 29 bytes. |
||
128 | |||
129 | .RemotePingProcess.cfg;.................size: 21 bytes. |
||
130 | |||
131 | .TcpProcess.cfg;........................size: 19 bytes. |
||
132 | |||
133 | .DNMSProcess.cfg;.......................size: 133 bytes. |
||
134 | |||
135 | .DNS.cfg;...............................size: 174 bytes. |
||
136 | |||
137 | .IpxProcess.cfg;........................size: 133 bytes. |
||
138 | |||
139 | .DHCP.cfg;..............................size: 208 bytes. |
||
140 | |||
141 | .RoboExecNMProcess.cfg;.................size: 1844 bytes. |
||
142 | |||
143 | .dhcpProxy.cfg;.........................size: 288 bytes. |
||
144 | |||
145 | .IPForwarder.cfg;.......................size: 503 bytes. |
||
146 | |||
147 | .CallInitProcess.cfg;...................size: 1827 bytes. |
||
148 | |||
149 | .ConfigProcess.cfg;.....................size: 2867 bytes. |
||
150 | |||
151 | .Robo.stats;............................size: 788 bytes. |
||
152 | |||
153 | .user_settings.cfg;.....................size: 15521 bytes. |
||
154 | |||
155 | Total of 33 files in the file system. |
||
156 | |||
157 | |||
158 | |||
159 | SDL2 is ready. |
||
160 | |||
161 | AT{B} <filename> .. To execute a file type |
||
162 | AT{C} ............. To continue boot sequence |
||
163 | AT{D} <filename> .. To delete a file type |
||
164 | AT{E} ............. To erase all flash files |
||
165 | AT{H} ............. To halt boot sequence |
||
166 | AT{L} ............. To list all files |
||
167 | AT{P} ............. To prepare system for download |
||
168 | AT{Z} ............. To download a file type |
||
169 | AT{?} ............. To get help |
||
170 | |||
171 | |||
172 | |||
173 | |||
174 | . RAS 1500 Boot-Loader RM Manager |
||
175 | |||
176 | Slave Image Load Address 0x80000000 |
||
177 | Master Image Load Address 0x80000000 |
||
178 | Slave Image File Name: hdmplus.bin.z |
||
179 | Master Image File Name: pilgrim.bin.z |
||
180 | |||
181 | Master: Initialization {ldrInitializeMaster} : .PASS |
||
182 | |||
183 | Master: Load Slave {ldrLoadSlaveProcess} : .PASS |
||
184 | |||
185 | Master: Synchronization {ldrSyncMasterToSlave} : .PASS |
||
186 | |||
187 | Master: Load Slave OpCode Image {ldrLoadApplicationImage} : |
||
188 | Reinitializing LZH module. |
||
189 | In : 1900024 bytes |
||
190 | --10--20--30--40--50--60--70--80--90--100 |
||
191 | ......................................... |
||
192 | Restored |
||
193 | .PASS |
||
194 | |||
195 | Master: Load Master OpCode Image {ldrLoadApplicationImage} : |
||
196 | Reinitializing LZH module. |
||
197 | In : 3766556 bytes |
||
198 | --10--20--30--40--50--60--70--80--90--100 |
||
199 | ......................................... |
||
200 | Restored |
||
201 | .PASS |
||
202 | |||
203 | Master: Start Slave OpCode Image {ldrExecuteApplication} : .PASS |
||
204 | |||
205 | Master: Start Master OpCode Image {ldrExecuteApplication} : |
||
206 | ------------------------------------------------------------------------------- |
||
207 | IPX/IP Dial-out networking software Copyright (c)1985-1996, |
||
208 | Network Products Corporation Pasadena, CA All rights reserved |
||
209 | AppleTalk-compatible networking software Copyright 1993-1995, |
||
210 | Quiotix Corporation Menlo Park, CA All rights reserved |
||
211 | TCP/IP networking software Copyright 1988-1995, |
||
212 | Epilogue Corporation Albuquerque, NM All rights reserved |
||
213 | IP routing software Copyright 1993-1995, |
||
214 | RainbowBridge Communication. Inc. Rockville, MD All rights reserved |
||
215 | IPX networking software Copyright 1994-1995, |
||
216 | RouterWare Inc. Newport Beach, CA Unpublished - |
||
217 | Rights reserved under the Copyright Laws of the United States. |
||
218 | VJ TCP Header Compression software Copyright (c) 1989, 1991, 1992, 1993, |
||
219 | Regents of the University of California. All rights reserved. |
||
220 | ------------------------------------------------------------------------------- |
||
221 | |||
222 | |||
223 | RAS1500, V2.5.0 |
||
224 | |||
225 | |||
226 | ------3Com CORPORATION------Santa Clara, CA--------- |
||
227 | Software contained in this product is Copyright 1998-1999 |
||
228 | ----------------ALL RIGHTS RESERVED----------------- |
||
229 | |||
230 | |||
231 | Starting up the RAS1500 system Executive... |
||
232 | Segment sizes: |
||
233 | Control area = 11580 bytes |
||
234 | HDM To Be Freed segment = 6260 bytes |
||
235 | HDM Free Pool segment = 6260 bytes |
||
236 | Inbound segment = 1620 bytes |
||
237 | Outbound segment = |
||
238 | 1620 bytes |
||
239 | Buffer segment = 218400 bytes (1560 buffers) |
||
240 | Starting up RAS1500Initializing Firewire Device .... |
||
241 | Initialized the Firewire Device |
||
242 | Configuration process... |
||
243 | |||
244 | RAS1500 Configuration Process starting...... |
||
245 | |||
246 | RAS1500 Initializing Network Management Processes... |
||
247 | |||
248 | RAS1500 starting RoboExec NetMan process...... |
||
249 | |||
250 | RAS1500 starting Event Handler process...... |
||
251 | |||
252 | RAS1500 configuring interfaces...... |
||
253 | ### SLot1 Type: 0 1 0 2 ff ff ff ff |
||
254 | ### SLot2 Type: 0 1 0 2 ff ff ff ff |
||
255 | Adding BRD device |
||
256 | Adding firewire device |
||
257 | |||
258 | RAS1500 starting required processes...... |
||
259 | |||
260 | RAS1500 starting Call Initiator process (CIP)...... |
||
261 | |||
262 | RAS1500 configuring devices in CIP...... |
||
263 | |||
264 | RAS1500 configuring networks...... |
||
265 | |||
266 | RAS1500 Adding networks to LAN interfaces.... |
||
267 | |||
268 | RAS1500 enabling networks on LAN interfaces.... |
||
269 | |||
270 | Configuring Network Services..... |
||
271 | |||
272 | Starting the CLI...... |
||
273 | Please Wait for Prompt... |
||
274 | ras1500> |
||
275 | </pre> |