Drive By ONT Botnet with IRC C&C
The ONT Alcatel-Lucent I-240W-Q are vulnerable to arbitrary code execution in the administrative web interface and also contain a backdoor which enables remote access to the administrative interface. It is possible to combine these two vulnerabilities to take remote control of these devices.
Authentication is not required for successful exploitation. By simply having the user visit a malicious website through any device connected on the network, the confidentiality of the transmitted information by the device is at risk.
El drive-by exploit consists of three stages:
1. Authenticate using the backdoor account.
2. Download the netcat for MIPS and IRC bot.sh
(bot is incomplete - it is just for demonstration purposes)
3. Run the files you downloaded.