The ACS is the Auto Configuration Server / Service and the service that uses the infamous TR-069 protocol. Officially it uses the port 7547 / TCP, but may vary depending on the environment. One notable aspect is the fact, that an ACS cannot push configuration to the CPE. Following the standards it can only request a callback which triggers the client to fetch / deliver information. On many devices the callback trigger is protected by some form of authentication (i.e. digest auth).

TR-069

The TR-069 protocol was defined by the broadband forum 2004. It is a simple protocol based on SOAP / XML. It offers access to all possible settings on a CPE and my be extended by the device vendor / operator.

GenieACS

Installation

Best follow the instructions in the GenieACS docs. The install from git is quick and stable. It will fully run using the default configuration.

Running

You will have to start the following binaries:

  • genieacs/bin/genieacs-cwmp
  • genieacs/bin/genieacs-fs
  • genieacs/bin/genieacs-nbi

For the GUI / webinterface you will have to run rails is the genieacs-gui folder.

Getting started

For getting started I’d recommend using an AVM FritzBox and configure it as described here. From there on one has a functioning TR-069 client which can easily be controlled from the ACS. Thus any kind of fuzzing and injection can be performed.

AVM offers the configuration of FritzBoxes using the TR-064 protocol. They offer a very detailed documentation of the interface. One of the documents there covers the TR-069 configuration.

Set ACS

import requests

url = 'http://192.168.178.1:49000'
path = '/upnp/control/mgmsrv'


service = 'ManagementServer:1'
action = 'SetManagementServerURL'
#parameters = '<NewURL>http://192.168.58.5/tr069</NewURL>'
parameters = '<NewURL>http://192.168.58.4:7547</NewURL>'

payload= '<?xml version="1.0"?>'\
        '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">'\
                '<s:Body>'\
                        '<u:' + action + ' xmlns:u="urn:dslforum-org:service:' + service + '">'\
                                '' + parameters + ''\
                        '</u:' + action + '>'\
                '</s:Body>'\
        '</s:Envelope>'

headers = {
'SOAPACTION' : 'urn:dslforum-org:service:' + service + '#' + action,
'USER-AGENT' : 'Evil Hacker',
'CONTENT-TYPE' : 'text/xml; charset="utf-8"',
}


resp = requests.post(url+path,headers=headers,data=payload)

print resp.text

Enable TR-069

import requests

url = 'http://192.168.178.1:49000'
path = '/upnp/control/mgmsrv'


service = 'ManagementServer:1'
action = 'X_SetTR069Enable'
parameters = '<NewTR069Enabled>1</NewTR069Enabled>'

payload= '<?xml version="1.0"?>'\
        '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">'\
                '<s:Body>'\
                        '<u:' + action + ' xmlns:u="urn:dslforum-org:service:' + service + '">'\
                                '' + parameters + ''\
                        '</u:' + action + '>'\
                '</s:Body>'\
        '</s:Envelope>'

headers = {
'SOAPACTION' : 'urn:dslforum-org:service:' + service + '#' + action,
'USER-AGENT' : 'Evil Hacker',
'CONTENT-TYPE' : 'text/xml; charset="utf-8"',
}


resp = requests.post(url+path,headers=headers,data=payload)

print resp.text

Disable TR-069


import requests

url = 'http://192.168.178.1:49000'
path = '/upnp/control/mgmsrv'


service = 'ManagementServer:1'
action = 'X_SetTR069Enable'
parameters = '<NewTR069Enabled>0</NewTR069Enabled>'

payload= '<?xml version="1.0"?>'\
        '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">'\
                '<s:Body>'\
                        '<u:' + action + ' xmlns:u="urn:dslforum-org:service:' + service + '">'\
                                '' + parameters + ''\
                        '</u:' + action + '>'\
                '</s:Body>'\
        '</s:Envelope>'

headers = {
'SOAPACTION' : 'urn:dslforum-org:service:' + service + '#' + action,
'USER-AGENT' : 'Evil Hacker',
'CONTENT-TYPE' : 'text/xml; charset="utf-8"',
}


resp = requests.post(url+path,headers=headers,data=payload)

print resp.text

Further Reference