I recently started using a TP-Link C7 router to host a guest network at my house. I typically avoid consumer/prosumer gear for my network, sticking to either whitebox (homemade) or older enterprise gear. Alas, the price was right ($0). Every time I do encounter one of these devices I always manage to find something fun and interesting to poke…

Bad SSH server

First red flag was the sshd server running on this router.

noah@box ~ $ ssh 192.168.x.y

Unable to negotiate with UNKNOWN port 65535: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

My system runs OpenSSH_8.4p1 which is quite new, but no brand new device should ask for sha1 ciphers!!

Being stubborn, I tried to finesse the sshd just a little…

$ ssh -T -oKexAlgorithms=+diffie-hellman-group14-sha1 [email protected]
shell request failed on channel 0

D’oh. Must have the shell set to /bin/false to stop people like me from tampering with it…

Annoying discovery service

After a couple days sitting on my network I discovered some spammy logs coming from my firewall:

Oct 22 18:26:48 fw kernel: [427797.807835] IN=ens2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:47:32:a0:b2:89:08:00 SRC=x.x.x.x DST=255.255.255.255 LEN=201 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=56307 DPT=7437 LEN=181

Some service on that system is attempting to connect to UDP port 7437. Strange.

Digging in a little deeper, I ran

noah@fw:~$ sudo tcpdump -i eth2 port 7437 -vXX

18:16:58.266688 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 201)
    x.x.x.x.56307 > 255.255.255.255.7437: [udp sum ok] UDP, length 173
        0x0000:  ffff ffff ffff d847 32a0 b289 0800 4500  .......G2.....E.
        0x0010:  00c9 0000 4000 4011 1b4e 0acd 140a ffff  ....@[email protected]......
        0x0020:  ffff dbf3 1d0d 00b5 2eea 4b41 4e4e 4f55  ..........KANNOU
        0x0030:  254e 0000 0000 00d8 4732 a0b2 8941 7263  %N......G2...Arc
        0x0040:  6865 7220 4337 2020 2000 0000 0041 7263  her.C7.......Arc
        0x0050:  6865 7220 4337 2020 2000 0000 0000 0000  her.C7..........
        0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0080:  0031 2e30 322e 3639 0000 0000 0000 0000  .1.02.69........
        0x0090:  0000 0000 0000 0001 0000 0001 0000 0002  ................
        0x00a0:  0000 0002 0000 0000 0000 0000 0000 0000  ................
        0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00d0:  0000 0000 0000 00                        .......

Not sure exactly what’s going on here, but the device is broadcasting these pings every ~3 seconds.

The only info I can find on the net is that that port is registered to ‘Faximum’, notably a web service documented two decades ago: http://www.faximum.com/fms/docs/fms-ch3-46.html

It’s very likely that it’s a config assistant utility that uses this for autodiscovery. Since I can’t ssh into the box and disable things properly, I’ll just have to ignore it…

If anybody finds out how to root this device please send me the formula!