3Com SuperStack II RAS 1500 » History » Revision 8
Revision 7 (xent, 08/16/2024 09:46 PM) → Revision 8/9 (xent, 08/16/2024 09:46 PM)
h1. 3Com SuperStack II RAS 1500
@xent acquired a 3Com SuperStack II Remote Access System 1500 equipped with 2 x 2-Port ISDN BRI I/O Card
h2. Photos
{{thumbnail(ras1500_front.png)}}
{{thumbnail(ras1500.png)}}
{{thumbnail(ras1500_proc.png)}}
{{thumbnail(isdn_front.png)}}
{{thumbnail(isdn_back.png)}}
h2. Documentation
* attachment:3Com_RAS_1500_Getting_Started.pdf
* attachment:3Com_RAS_1500_System_Management.pdf
h2. Security
The system doesn't really seems to be particularly secure, the serial console doesn't ask for any password and we found quickly exploit for the platform. (https://isec.pl/en/vulnerabilities/isec-0009-3com-ras.txt)
h2. Web Interface
{{thumbnail(3com_ras1500_web.png)}} {{3com_ras1500_web.png)}}
h2. Boot Log
<pre>
Initializing....
Running Power On Diagnostics Version 2.5.0 (B 159)
2 Percent Complete
4 Percent Complete
6 Percent Complete
8 Percent Complete
10 Percent Complete
12 Percent Complete
14 Percent Complete
16 Percent Complete
18 Percent Complete
21 Percent Complete
23 Percent Complete
25 Percent Complete
27 Percent Complete
29 Percent Complete
31 Percent Complete
33 Percent Complete
35 Percent Complete
37 Percent Complete
ERROR !
. Error Code -> 07102000..Port FG LRT Type EC1 EC2 EC3
Expected Data -> 00000080..[00] [07][01 00][02] [00 00 00]
Received Data -> 00000000..LRT = 36, Error Type = 2, Port = 0.
Mask -> 000000FF
Address of Failure -> F07A0034
Text Message -> RTC Access Failure - Reg D - Cell exhausted
Test # Test Name Port Time Status
-------+----------------------------------------------+------+------+--------
701.RTC Reset ------------------------------------- (1) - FAILED
Enter.'C' to Continue with POST
.'B' to Reboot
.'Q' Quit and Load Operational Software
Starting Operational Software
** RAS 1500 Boot-Loader Ver. 2.5.0 (B 159), Built on 2000-6-3, 10:56:7 **
SDL2 is initializing the FLASH file system. Please wait....
SDL2 has completed initializing the FLASH file system.
Current contents of the FLASH file system:
.mmsram.bin;............................size: 196608 bytes.
.mmboot.bin;............................size: 65536 bytes.
.pilgrim.bin.z;.........................size: 1611888 bytes.
.hdmplus.bin.z;.........................size: 801512 bytes.
.PilgrimStrings.ind.gz;.................size: 72585 bytes.
.PilgrimStrings.str.gz;.................size: 82516 bytes.
.update1.bin.z;.........................size: 3529 bytes.
.RoboString.ind;........................size: 10612 bytes.
.RoboString.str;........................size: 8621 bytes.
.QuickSetup.cfg;........................size: 729 bytes.
.EventHandler.cfg;......................size: 0 bytes.
.CLI.cfg;...............................size: 42 bytes.
.TermProt.cfg;..........................size: 39 bytes.
.SnmpProcess.cfg;.......................size: 16 bytes.
.BridgeProcess.cfg;.....................size: 68 bytes.
.TftpProcess.cfg;.......................size: 27 bytes.
.Appletalk.cfg;.........................size: 88 bytes.
.PppProcess.cfg;........................size: 44 bytes.
.FilterMgr.cfg;.........................size: 24 bytes.
.DialOutProcess.cfg;....................size: 29 bytes.
.RemotePingProcess.cfg;.................size: 21 bytes.
.TcpProcess.cfg;........................size: 19 bytes.
.DNMSProcess.cfg;.......................size: 133 bytes.
.DNS.cfg;...............................size: 174 bytes.
.IpxProcess.cfg;........................size: 133 bytes.
.DHCP.cfg;..............................size: 208 bytes.
.RoboExecNMProcess.cfg;.................size: 1844 bytes.
.dhcpProxy.cfg;.........................size: 288 bytes.
.IPForwarder.cfg;.......................size: 503 bytes.
.CallInitProcess.cfg;...................size: 1827 bytes.
.ConfigProcess.cfg;.....................size: 2867 bytes.
.Robo.stats;............................size: 788 bytes.
.user_settings.cfg;.....................size: 15521 bytes.
Total of 33 files in the file system.
SDL2 is ready.
AT{B} <filename> .. To execute a file type
AT{C} ............. To continue boot sequence
AT{D} <filename> .. To delete a file type
AT{E} ............. To erase all flash files
AT{H} ............. To halt boot sequence
AT{L} ............. To list all files
AT{P} ............. To prepare system for download
AT{Z} ............. To download a file type
AT{?} ............. To get help
. RAS 1500 Boot-Loader RM Manager
Slave Image Load Address 0x80000000
Master Image Load Address 0x80000000
Slave Image File Name: hdmplus.bin.z
Master Image File Name: pilgrim.bin.z
Master: Initialization {ldrInitializeMaster} : .PASS
Master: Load Slave {ldrLoadSlaveProcess} : .PASS
Master: Synchronization {ldrSyncMasterToSlave} : .PASS
Master: Load Slave OpCode Image {ldrLoadApplicationImage} :
Reinitializing LZH module.
In : 1900024 bytes
--10--20--30--40--50--60--70--80--90--100
.........................................
Restored
.PASS
Master: Load Master OpCode Image {ldrLoadApplicationImage} :
Reinitializing LZH module.
In : 3766556 bytes
--10--20--30--40--50--60--70--80--90--100
.........................................
Restored
.PASS
Master: Start Slave OpCode Image {ldrExecuteApplication} : .PASS
Master: Start Master OpCode Image {ldrExecuteApplication} :
-------------------------------------------------------------------------------
IPX/IP Dial-out networking software Copyright (c)1985-1996,
Network Products Corporation Pasadena, CA All rights reserved
AppleTalk-compatible networking software Copyright 1993-1995,
Quiotix Corporation Menlo Park, CA All rights reserved
TCP/IP networking software Copyright 1988-1995,
Epilogue Corporation Albuquerque, NM All rights reserved
IP routing software Copyright 1993-1995,
RainbowBridge Communication. Inc. Rockville, MD All rights reserved
IPX networking software Copyright 1994-1995,
RouterWare Inc. Newport Beach, CA Unpublished -
Rights reserved under the Copyright Laws of the United States.
VJ TCP Header Compression software Copyright (c) 1989, 1991, 1992, 1993,
Regents of the University of California. All rights reserved.
-------------------------------------------------------------------------------
RAS1500, V2.5.0
------3Com CORPORATION------Santa Clara, CA---------
Software contained in this product is Copyright 1998-1999
----------------ALL RIGHTS RESERVED-----------------
Starting up the RAS1500 system Executive...
Segment sizes:
Control area = 11580 bytes
HDM To Be Freed segment = 6260 bytes
HDM Free Pool segment = 6260 bytes
Inbound segment = 1620 bytes
Outbound segment =
1620 bytes
Buffer segment = 218400 bytes (1560 buffers)
Starting up RAS1500Initializing Firewire Device ....
Initialized the Firewire Device
Configuration process...
RAS1500 Configuration Process starting......
RAS1500 Initializing Network Management Processes...
RAS1500 starting RoboExec NetMan process......
RAS1500 starting Event Handler process......
RAS1500 configuring interfaces......
### SLot1 Type: 0 1 0 2 ff ff ff ff
### SLot2 Type: 0 1 0 2 ff ff ff ff
Adding BRD device
Adding firewire device
RAS1500 starting required processes......
RAS1500 starting Call Initiator process (CIP)......
RAS1500 configuring devices in CIP......
RAS1500 configuring networks......
RAS1500 Adding networks to LAN interfaces....
RAS1500 enabling networks on LAN interfaces....
Configuring Network Services.....
Starting the CLI......
Please Wait for Prompt...
ras1500>
</pre>
