3Com SuperStack II RAS 1500 » History » Version 5
xent, 08/16/2024 09:44 PM
1 | 1 | xent | h1. 3Com SuperStack II RAS 1500 |
---|---|---|---|
2 | |||
3 | @xent acquired a 3Com SuperStack II Remote Access System 1500 equipped with 2 x 2-Port ISDN BRI I/O Card |
||
4 | |||
5 | 5 | xent | h2. Photos |
6 | 1 | xent | |
7 | 5 | xent | !ras1500_front.png! |
8 | !ras1500.png! |
||
9 | !ras1500_proc.png! |
||
10 | !isdn_front.png! |
||
11 | !isdn_back.png! |
||
12 | 1 | xent | |
13 | h2. Documentation |
||
14 | |||
15 | 2 | xent | * attachment:3Com_RAS_1500_Getting_Started.pdf |
16 | 1 | xent | * attachment:3Com_RAS_1500_System_Management.pdf |
17 | |||
18 | h2. Security |
||
19 | |||
20 | The system doesn't really seems to be particularly secure, the serial console doesn't ask for any password and we found quickly exploit for the platform. (https://isec.pl/en/vulnerabilities/isec-0009-3com-ras.txt) |
||
21 | 3 | xent | |
22 | h2. Web Interface |
||
23 | 4 | xent | |
24 | 3 | xent | !3com_ras1500_web.png! |
25 | |||
26 | 1 | xent | |
27 | h2. Boot Log |
||
28 | |||
29 | <pre> |
||
30 | |||
31 | |||
32 | Initializing.... |
||
33 | |||
34 | |||
35 | |||
36 | Running Power On Diagnostics Version 2.5.0 (B 159) |
||
37 | |||
38 | 2 Percent Complete |
||
39 | 4 Percent Complete |
||
40 | 6 Percent Complete |
||
41 | 8 Percent Complete |
||
42 | 10 Percent Complete |
||
43 | 12 Percent Complete |
||
44 | 14 Percent Complete |
||
45 | 16 Percent Complete |
||
46 | 18 Percent Complete |
||
47 | 21 Percent Complete |
||
48 | 23 Percent Complete |
||
49 | 25 Percent Complete |
||
50 | 27 Percent Complete |
||
51 | 29 Percent Complete |
||
52 | 31 Percent Complete |
||
53 | 33 Percent Complete |
||
54 | 35 Percent Complete |
||
55 | 37 Percent Complete |
||
56 | |||
57 | ERROR ! |
||
58 | |||
59 | |||
60 | . Error Code -> 07102000..Port FG LRT Type EC1 EC2 EC3 |
||
61 | |||
62 | Expected Data -> 00000080..[00] [07][01 00][02] [00 00 00] |
||
63 | |||
64 | Received Data -> 00000000..LRT = 36, Error Type = 2, Port = 0. |
||
65 | |||
66 | Mask -> 000000FF |
||
67 | |||
68 | Address of Failure -> F07A0034 |
||
69 | |||
70 | Text Message -> RTC Access Failure - Reg D - Cell exhausted |
||
71 | |||
72 | |||
73 | Test # Test Name Port Time Status |
||
74 | |||
75 | -------+----------------------------------------------+------+------+-------- |
||
76 | |||
77 | 701.RTC Reset ------------------------------------- (1) - FAILED |
||
78 | |||
79 | |||
80 | |||
81 | Enter.'C' to Continue with POST |
||
82 | |||
83 | .'B' to Reboot |
||
84 | |||
85 | .'Q' Quit and Load Operational Software |
||
86 | |||
87 | Starting Operational Software |
||
88 | |||
89 | |||
90 | ** RAS 1500 Boot-Loader Ver. 2.5.0 (B 159), Built on 2000-6-3, 10:56:7 ** |
||
91 | |||
92 | SDL2 is initializing the FLASH file system. Please wait.... |
||
93 | |||
94 | SDL2 has completed initializing the FLASH file system. |
||
95 | |||
96 | Current contents of the FLASH file system: |
||
97 | |||
98 | .mmsram.bin;............................size: 196608 bytes. |
||
99 | |||
100 | .mmboot.bin;............................size: 65536 bytes. |
||
101 | |||
102 | .pilgrim.bin.z;.........................size: 1611888 bytes. |
||
103 | |||
104 | .hdmplus.bin.z;.........................size: 801512 bytes. |
||
105 | |||
106 | .PilgrimStrings.ind.gz;.................size: 72585 bytes. |
||
107 | |||
108 | .PilgrimStrings.str.gz;.................size: 82516 bytes. |
||
109 | |||
110 | .update1.bin.z;.........................size: 3529 bytes. |
||
111 | |||
112 | .RoboString.ind;........................size: 10612 bytes. |
||
113 | |||
114 | .RoboString.str;........................size: 8621 bytes. |
||
115 | |||
116 | .QuickSetup.cfg;........................size: 729 bytes. |
||
117 | |||
118 | .EventHandler.cfg;......................size: 0 bytes. |
||
119 | |||
120 | .CLI.cfg;...............................size: 42 bytes. |
||
121 | |||
122 | .TermProt.cfg;..........................size: 39 bytes. |
||
123 | |||
124 | .SnmpProcess.cfg;.......................size: 16 bytes. |
||
125 | |||
126 | .BridgeProcess.cfg;.....................size: 68 bytes. |
||
127 | |||
128 | .TftpProcess.cfg;.......................size: 27 bytes. |
||
129 | |||
130 | .Appletalk.cfg;.........................size: 88 bytes. |
||
131 | |||
132 | .PppProcess.cfg;........................size: 44 bytes. |
||
133 | |||
134 | .FilterMgr.cfg;.........................size: 24 bytes. |
||
135 | |||
136 | .DialOutProcess.cfg;....................size: 29 bytes. |
||
137 | |||
138 | .RemotePingProcess.cfg;.................size: 21 bytes. |
||
139 | |||
140 | .TcpProcess.cfg;........................size: 19 bytes. |
||
141 | |||
142 | .DNMSProcess.cfg;.......................size: 133 bytes. |
||
143 | |||
144 | .DNS.cfg;...............................size: 174 bytes. |
||
145 | |||
146 | .IpxProcess.cfg;........................size: 133 bytes. |
||
147 | |||
148 | .DHCP.cfg;..............................size: 208 bytes. |
||
149 | |||
150 | .RoboExecNMProcess.cfg;.................size: 1844 bytes. |
||
151 | |||
152 | .dhcpProxy.cfg;.........................size: 288 bytes. |
||
153 | |||
154 | .IPForwarder.cfg;.......................size: 503 bytes. |
||
155 | |||
156 | .CallInitProcess.cfg;...................size: 1827 bytes. |
||
157 | |||
158 | .ConfigProcess.cfg;.....................size: 2867 bytes. |
||
159 | |||
160 | .Robo.stats;............................size: 788 bytes. |
||
161 | |||
162 | .user_settings.cfg;.....................size: 15521 bytes. |
||
163 | |||
164 | Total of 33 files in the file system. |
||
165 | |||
166 | |||
167 | |||
168 | SDL2 is ready. |
||
169 | |||
170 | AT{B} <filename> .. To execute a file type |
||
171 | AT{C} ............. To continue boot sequence |
||
172 | AT{D} <filename> .. To delete a file type |
||
173 | AT{E} ............. To erase all flash files |
||
174 | AT{H} ............. To halt boot sequence |
||
175 | AT{L} ............. To list all files |
||
176 | AT{P} ............. To prepare system for download |
||
177 | AT{Z} ............. To download a file type |
||
178 | AT{?} ............. To get help |
||
179 | |||
180 | |||
181 | |||
182 | |||
183 | . RAS 1500 Boot-Loader RM Manager |
||
184 | |||
185 | Slave Image Load Address 0x80000000 |
||
186 | Master Image Load Address 0x80000000 |
||
187 | Slave Image File Name: hdmplus.bin.z |
||
188 | Master Image File Name: pilgrim.bin.z |
||
189 | |||
190 | Master: Initialization {ldrInitializeMaster} : .PASS |
||
191 | |||
192 | Master: Load Slave {ldrLoadSlaveProcess} : .PASS |
||
193 | |||
194 | Master: Synchronization {ldrSyncMasterToSlave} : .PASS |
||
195 | |||
196 | Master: Load Slave OpCode Image {ldrLoadApplicationImage} : |
||
197 | Reinitializing LZH module. |
||
198 | In : 1900024 bytes |
||
199 | --10--20--30--40--50--60--70--80--90--100 |
||
200 | ......................................... |
||
201 | Restored |
||
202 | .PASS |
||
203 | |||
204 | Master: Load Master OpCode Image {ldrLoadApplicationImage} : |
||
205 | Reinitializing LZH module. |
||
206 | In : 3766556 bytes |
||
207 | --10--20--30--40--50--60--70--80--90--100 |
||
208 | ......................................... |
||
209 | Restored |
||
210 | .PASS |
||
211 | |||
212 | Master: Start Slave OpCode Image {ldrExecuteApplication} : .PASS |
||
213 | |||
214 | Master: Start Master OpCode Image {ldrExecuteApplication} : |
||
215 | ------------------------------------------------------------------------------- |
||
216 | IPX/IP Dial-out networking software Copyright (c)1985-1996, |
||
217 | Network Products Corporation Pasadena, CA All rights reserved |
||
218 | AppleTalk-compatible networking software Copyright 1993-1995, |
||
219 | Quiotix Corporation Menlo Park, CA All rights reserved |
||
220 | TCP/IP networking software Copyright 1988-1995, |
||
221 | Epilogue Corporation Albuquerque, NM All rights reserved |
||
222 | IP routing software Copyright 1993-1995, |
||
223 | RainbowBridge Communication. Inc. Rockville, MD All rights reserved |
||
224 | IPX networking software Copyright 1994-1995, |
||
225 | RouterWare Inc. Newport Beach, CA Unpublished - |
||
226 | Rights reserved under the Copyright Laws of the United States. |
||
227 | VJ TCP Header Compression software Copyright (c) 1989, 1991, 1992, 1993, |
||
228 | Regents of the University of California. All rights reserved. |
||
229 | ------------------------------------------------------------------------------- |
||
230 | |||
231 | |||
232 | RAS1500, V2.5.0 |
||
233 | |||
234 | |||
235 | ------3Com CORPORATION------Santa Clara, CA--------- |
||
236 | Software contained in this product is Copyright 1998-1999 |
||
237 | ----------------ALL RIGHTS RESERVED----------------- |
||
238 | |||
239 | |||
240 | Starting up the RAS1500 system Executive... |
||
241 | Segment sizes: |
||
242 | Control area = 11580 bytes |
||
243 | HDM To Be Freed segment = 6260 bytes |
||
244 | HDM Free Pool segment = 6260 bytes |
||
245 | Inbound segment = 1620 bytes |
||
246 | Outbound segment = |
||
247 | 1620 bytes |
||
248 | Buffer segment = 218400 bytes (1560 buffers) |
||
249 | Starting up RAS1500Initializing Firewire Device .... |
||
250 | Initialized the Firewire Device |
||
251 | Configuration process... |
||
252 | |||
253 | RAS1500 Configuration Process starting...... |
||
254 | |||
255 | RAS1500 Initializing Network Management Processes... |
||
256 | |||
257 | RAS1500 starting RoboExec NetMan process...... |
||
258 | |||
259 | RAS1500 starting Event Handler process...... |
||
260 | |||
261 | RAS1500 configuring interfaces...... |
||
262 | ### SLot1 Type: 0 1 0 2 ff ff ff ff |
||
263 | ### SLot2 Type: 0 1 0 2 ff ff ff ff |
||
264 | Adding BRD device |
||
265 | Adding firewire device |
||
266 | |||
267 | RAS1500 starting required processes...... |
||
268 | |||
269 | RAS1500 starting Call Initiator process (CIP)...... |
||
270 | |||
271 | RAS1500 configuring devices in CIP...... |
||
272 | |||
273 | RAS1500 configuring networks...... |
||
274 | |||
275 | RAS1500 Adding networks to LAN interfaces.... |
||
276 | |||
277 | RAS1500 enabling networks on LAN interfaces.... |
||
278 | |||
279 | Configuring Network Services..... |
||
280 | |||
281 | Starting the CLI...... |
||
282 | Please Wait for Prompt... |
||
283 | ras1500> |
||
284 | </pre> |