Waraxe IT Security Portal

tinman · Active user

BIOS PASSWORDS;
BIOS PW: 322232 32232 BCNDK1 ADMINBN99
DEFAULT PASSWORD (GUI) admin or adminbn99 (Listens on port 8000)
RAID PASSWORD 0000

Barracuda Spam & Virus Firewall Notes - How to get full root access;

Log in using single users mode - to do this;
a. Power On/reboot
b. At lilo prompt (barracuda splash) quickly hit the tab key
c. Type: Barracuda init=/bin/bash
d. The password is: bimg

You are now booted into single user mode with full root access. Whist this is limited it will still allow you to remove the barracuda root password easily. This is done by simply removing it from the /etc/shadow file for the root user. It can easily be changed afterwards. Be aware that the Barracuda has a 'recovery' partion (3) and it will make sense to clear the password on this partion too.

Starting with partion 1 (the main 'running' partition). In single user mode it may not mount properly. It can often end up as read only yet mount -l it states rw. This causes all sorts of wiredness when writing files, so save any heartache and remount it rw like this;

mount -o remount, -rw /dev/ide/host0/bus0/target0/lun0 /
{if you are using SATA drives they are probably going to be under /dev/scsi/host0/bus0/target0/lun0/ or software raid /md}

The main /etc/shadow file gives write issues the file system is not properly mounted, so the root user is not able to force overwrite of the file. The above remount command fixes that. You can now edit it and force the writing with the ! operator.

Here is how to edit it;

vim /etc/shadow

move cursor to first line for the root user.

Switch to insert mode by pressing the [i] key

Put cursor at start of password and use the delete key to remove the encrypted password between the first and second colon - typically looking like this- $1$2NVlp7G0$EoDgfwGBkSb/LOe7VgfQP/

Make sure you leave the the two colons in place, so the line looks similar to this- root::12277:0:99999:7:::

Switch VIM to command mode by pressing [ESC]

Write the file with the override option by typing

:w!

Then quit

:q

If you cant do this, check you remounted the file system correctly as detailed above.

Next we do the same for the recovery partition 3 /etc/shadow password file. Mount partition 3 so we can edit the file. The mount directory /mnt/hd should already exist from the building of the appliance (ls -l /mnt to check - if not mkdir /mnt/hd)

Mount it (again assuming IDE here - modify you path accordingly)
mount /dev/ide/host0/bus0/target0/lun0/part3 /mnt/hd

Repeat the editing on this file /mnt/hd/etc/shadow

When you are done you can unmount it;
umount /dev/ide/host0/bus0/target0/lun0/part3

Finally, stop the barracuda with this command:

halt -fp

When you reboot the unit normally you will be able to log in with username 'root' and no password at the Barracuda log-in prompt. To set a fresh root password after logging in as root, just issue the 'passwd' command and set it to something suitable. Upgrading firmware does not currenlty overwrite this hack so it's a set and forget (tested up to version 4.0.0.31)

Your Barracuda is now fully open an unlocked for root access. What follows is a list of changes you can make and some security notifcations:
--------------------------------------------------------------------------------------
First of all Barracuda and the 'port 25' redirect. Old versions of the Barracuda left a nice back door open for support. Port 25 was redirected to port 22 SSH and 8000 for a Barracuda ranges. As you are not really likely to have port 25 closed it was a serious back door to leave open. This has been removed (other back doors may be open) but check by looking at this file:

/etc/sysconfig/iptables
You don't want to see this;
-A PREROUTING -s 205.158.110.61 -p tcp -m tcp --dport 25 -j REDIRECT --to-ports 22
-A PREROUTING -s 205.158.107.65 -p tcp -m tcp --dport 25 -j REDIRECT --to-ports 8000
If you do comment them out with a #

Whilst in this file you can block all port 22 access from Barracuda by commenting (#) out:
-A INPUT -s 205.158.110.0/255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 205.158.110.0/255.255.255.0 -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

You can also alter the ranges to allow *you* port 22 ssh access from your local or remote network, just edit one of these line to suit or add your own;

-A INPUT -s 192.168.200.0/255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.200.0/255.255.255.0 -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

When updating firmware these changes are *lost* so don't forget to put them back if you don't want strangers poking aroung in your Barracuda.

To restart IP tables on the barracuda, just do this;
/etc/init.d/iptables stop; /etc/init.d/iptables start;
--------------------------------------------------------------------------------------
To read or reset the GUI password
READ:
config_read system_password
CHANGE:
config_change system_password chosen_new_password
--------------------------------------------------------------------------------------
To add features to a lower spec machine GUI just 'touch' ' any of these files; This will add the feature.
EXAMPLE;
touch /etc/barracuda/multiple_ip

/etc/barracuda/syslog (Advanced -> Syslog tab)
/etc/barracuda/explicit_user_config (Advanced -> Explicit Users tab)
/etc/barracuda/exchange_accelerator (MS Exchange Accelerator)
/etc/barracuda/trusted_relays (Advanced -> Rate Control tab)
/etc/barracuda/multiple_ip (Advanced -> Advance IP Configuration tab)
// static routes etc
/etc/barracuda/clustering (Advanced -> Clustering tab)
/etc/barracuda/auth (Advanced -> Single Sign-On)
/etc/barracuda/api (Basic -> Administration -> API/SNMP section)
/etc/barracuda/plugin (Basic -> Bayesian/Fingerprinting -> Mail plug-in)
/etc/barracuda/per_domain (Domains tab)
/etc/barracuda/per_user_scores (Per-User scoring)
/etc/barracuda/ldap_routing (Advanced -> LDAP Routing) (3.5.11 and
above only) (600s and above only)
--------------------------------------------------------------------------------------
To change the serial number / identity.
The backend Barracuda system is really lame at this time. Almost like it was written by a couple of dickheads in their dens. This means you can pretty much try random five and six figure serial numbers and get free updates when you hit a good one. TIP; keep a lookout on eBay for people stupid enough to sell them showing the serial number and advertising them with a remaining subscription. Forget matching up the MAC address to the system - they managed to screw that notion up. The PHYSICAL MAC is never properly recorded (and at Jan of 2009 still was not). This is read from a text file that can be set to anything you like. The only real restriction comes from a simple geo lookup on your IP when you connect to Barracuda. Domestic US units being used outside of the USA will fail with CODE -4 (you can always try an HTTP proxy or another serial number). Changing the password involves changing a few files and a couple of database entries. This is easy to script with this tested perl script that also backs up the current settings:

dmacd007 · Beginner

Any one managed to get " full " root access to the Virutal appliance,
almost the same as the physical Barracuda 300.
However things have changed, I can hit " edit " on the boot screen, add init=/bin/bash,

It boots but no single user mode.

I confirmed that edit works by removing " quiet " on the end of the line, it boots showing a linux like boot process, but no single user mode.

Any experts managed to get to single user on the VM?

Thanks

dmacd007

goofy · Beginner

Hi,

Is anybody have an HDD image of a barracuda spam firewall 300? Mine is 6 years old and I can’t go higher than 5.1.
If you have an image, contact me at nicomicro@gmail.com

Thanks