3Com SuperStack II RAS 1500¶

xent acquired a 3Com SuperStack II Remote Access System 1500 equipped with 2 x 2-Port ISDN BRI I/O Card

Photos¶

Documentation¶

• 3Com_RAS_1500_Getting_Started.pdf
• 3Com_RAS_1500_System_Management.pdf

Security¶

The system doesn't really seems to be particularly secure, the serial console doesn't ask for any password and we found quickly exploit for the platform. (https://isec.pl/en/vulnerabilities/isec-0009-3com-ras.txt)

Web Interface¶

{{3com_ras1500_web.png)}}

Boot Log¶

Initializing....

Running Power On Diagnostics Version 2.5.0 (B 159)

2 Percent Complete
4 Percent Complete
6 Percent Complete
8 Percent Complete
10 Percent Complete
12 Percent Complete
14 Percent Complete
16 Percent Complete
18 Percent Complete
21 Percent Complete
23 Percent Complete
25 Percent Complete
27 Percent Complete
29 Percent Complete
31 Percent Complete
33 Percent Complete
35 Percent Complete
37 Percent Complete

ERROR !   

.         Error Code -> 07102000..Port FG  LRT    Type EC1 EC2 EC3

      Expected Data -> 00000080..[00] [07][01 00][02] [00  00  00]   

      Received Data -> 00000000..LRT = 36, Error Type = 2, Port = 0.

               Mask -> 000000FF

 Address of Failure -> F07A0034

       Text Message -> RTC Access Failure - Reg D - Cell exhausted

Test #  Test Name                                       Port   Time   Status

-------+----------------------------------------------+------+------+--------

701.RTC Reset -------------------------------------       (1) - FAILED

Enter.'C' to Continue with POST

.'B' to Reboot

.'Q' Quit and Load Operational Software

Starting Operational Software

** RAS 1500 Boot-Loader Ver. 2.5.0 (B 159), Built on 2000-6-3, 10:56:7 **

SDL2 is initializing the FLASH file system. Please wait....

SDL2 has completed initializing the FLASH file system.

Current contents of the FLASH file system:

.mmsram.bin;............................size:  196608 bytes.

.mmboot.bin;............................size:   65536 bytes.

.pilgrim.bin.z;.........................size: 1611888 bytes.

.hdmplus.bin.z;.........................size:  801512 bytes.

.PilgrimStrings.ind.gz;.................size:   72585 bytes.

.PilgrimStrings.str.gz;.................size:   82516 bytes.

.update1.bin.z;.........................size:    3529 bytes.

.RoboString.ind;........................size:   10612 bytes.

.RoboString.str;........................size:    8621 bytes.

.QuickSetup.cfg;........................size:     729 bytes.

.EventHandler.cfg;......................size:       0 bytes.

.CLI.cfg;...............................size:      42 bytes.

.TermProt.cfg;..........................size:      39 bytes.

.SnmpProcess.cfg;.......................size:      16 bytes.

.BridgeProcess.cfg;.....................size:      68 bytes.

.TftpProcess.cfg;.......................size:      27 bytes.

.Appletalk.cfg;.........................size:      88 bytes.

.PppProcess.cfg;........................size:      44 bytes.

.FilterMgr.cfg;.........................size:      24 bytes.

.DialOutProcess.cfg;....................size:      29 bytes.

.RemotePingProcess.cfg;.................size:      21 bytes.

.TcpProcess.cfg;........................size:      19 bytes.

.DNMSProcess.cfg;.......................size:     133 bytes.

.DNS.cfg;...............................size:     174 bytes.

.IpxProcess.cfg;........................size:     133 bytes.

.DHCP.cfg;..............................size:     208 bytes.

.RoboExecNMProcess.cfg;.................size:    1844 bytes.

.dhcpProxy.cfg;.........................size:     288 bytes.

.IPForwarder.cfg;.......................size:     503 bytes.

.CallInitProcess.cfg;...................size:    1827 bytes.

.ConfigProcess.cfg;.....................size:    2867 bytes.

.Robo.stats;............................size:     788 bytes.

.user_settings.cfg;.....................size:   15521 bytes.

Total of 33 files in the file system.

SDL2 is ready.

AT{B} <filename> .. To execute a file type
AT{C} ............. To continue boot sequence
AT{D} <filename> .. To delete a file type
AT{E} ............. To erase all flash files
AT{H} ............. To halt boot sequence
AT{L} ............. To list all files
AT{P} ............. To prepare system for download
AT{Z} ............. To download a file type
AT{?} ............. To get help

. RAS 1500 Boot-Loader RM Manager

Slave Image Load Address 0x80000000
Master Image Load Address 0x80000000
Slave Image File Name: hdmplus.bin.z
Master Image File Name: pilgrim.bin.z

Master: Initialization {ldrInitializeMaster} : .PASS

Master: Load Slave {ldrLoadSlaveProcess} : .PASS

Master: Synchronization {ldrSyncMasterToSlave} : .PASS

Master: Load Slave OpCode Image {ldrLoadApplicationImage} : 
Reinitializing LZH module.
In : 1900024 bytes
--10--20--30--40--50--60--70--80--90--100
.........................................   
Restored
.PASS

Master: Load Master OpCode Image {ldrLoadApplicationImage} : 
Reinitializing LZH module.
In : 3766556 bytes
--10--20--30--40--50--60--70--80--90--100
.........................................   
Restored
.PASS

Master: Start Slave OpCode Image {ldrExecuteApplication} : .PASS

Master: Start Master OpCode Image {ldrExecuteApplication} : 
-------------------------------------------------------------------------------
IPX/IP Dial-out networking software      Copyright (c)1985-1996,
       Network Products Corporation      Pasadena, CA       All rights reserved
AppleTalk-compatible networking software Copyright 1993-1995,
       Quiotix Corporation               Menlo Park, CA     All rights reserved
TCP/IP networking software               Copyright 1988-1995,
       Epilogue Corporation              Albuquerque, NM    All rights reserved
IP routing software                      Copyright 1993-1995,
       RainbowBridge Communication. Inc. Rockville, MD      All rights reserved
IPX networking software                  Copyright 1994-1995,
       RouterWare Inc.                   Newport Beach, CA  Unpublished - 
       Rights reserved under the Copyright Laws of the United States.
VJ TCP Header Compression software       Copyright (c) 1989, 1991, 1992, 1993,
       Regents of the University of California.             All rights reserved.
-------------------------------------------------------------------------------

RAS1500, V2.5.0

------3Com CORPORATION------Santa Clara, CA---------
Software contained in this product is Copyright 1998-1999
----------------ALL RIGHTS RESERVED-----------------

Starting up the RAS1500 system Executive...
Segment sizes:
  Control area = 11580 bytes
  HDM To Be Freed segment = 6260 bytes
  HDM Free Pool segment = 6260 bytes
  Inbound segment = 1620 bytes
  Outbound segment =
 1620 bytes
  Buffer segment = 218400 bytes (1560 buffers)
Starting up RAS1500Initializing Firewire Device ....
Initialized the Firewire Device
 Configuration process...

RAS1500 Configuration Process starting......

RAS1500 Initializing Network Management Processes...

RAS1500 starting RoboExec NetMan process......

RAS1500 starting Event Handler process......

RAS1500 configuring interfaces......
### SLot1 Type:  0 1 0 2 ff ff ff ff 
### SLot2 Type: 0 1 0 2 ff ff ff ff 
Adding BRD device
Adding firewire device

RAS1500 starting required processes......

RAS1500 starting Call Initiator process (CIP)......

RAS1500 configuring devices in CIP......

RAS1500 configuring networks......

RAS1500 Adding networks to LAN interfaces....

RAS1500 enabling networks on LAN interfaces....

Configuring Network Services.....

Starting the CLI......
Please Wait for Prompt...
ras1500>