Run Unleashed 200.14 on the Ruckus R730

The R730 has similar hardware to the R850, so can be converted to run Unleashed versions up to 200.14.

DANGER

Ruckus 200.15+ releases aren't compatible with the R730, so they will rollback your upgrade.
Please don't try to upgrade past the 200.14.6.1.203 release.

NOTE

The steps below assume the AP is plugged directly into your computer.
If your AP is plugged into a switch and is picking up an IP address via DHCP then you will have to substitute its assigned IP address anywhere the text 192.168.0.1 appears below.

Download and extract vulnerable R730 firmware

Download the ZoneDirector 10.1.2.0.120 Software Release, which contains a vulnerable R730 AP image.

Your internet browser can extract the R730 AP Image from the ZoneDirector Software Image.

Manual Extraction Steps

Decrypt the image, then use an archive tool like 7-Zip to extract the firmwares/ap-patch/patch000/ap-arm-11ax/10.1.2.0.120/rcks_fw.bl7.main AP image file.

Install the vulnerable firmware

Login to the AP's web administration interface.

TIP

You may need to do a factory reset (by sticking a pin in the reset hole for a few seconds) if you don't know the username & password.

The default username is "super", password is "sp-admin".

TIP

Your browser will show a security warning. This is normal and you should choose Advanced and then click through to the website by pressing Accept the Risk and Continue or Continue to 192.168.0.1 (unsafe) (the exact wording will vary depending on your browser).

Upgrade the firmware

Navigate to Maintenance > Upgrade.
Choose Upgrade Method: Local and press the Local File Name: Browse... button and select the R730_10.1.2.0.120.bl7 or rcks_fw.bl7.main firmware file you extracted above.
Choose Perform Upgrade.

TIP

The upgrade will take a few minutes.

SSH to the AP

$ ssh -oHostKeyAlgorithms=+ssh-rsa 192.168.0.1

Perform command injection

rkscli: Ruckus

Now type ";/bin/sh;" including the quotes and hit enter (you won't be able to see what you're typing)

grrrr

TIP

Instead of grrrr, another dog noise could be printed to the screen.

Escape to shell

rkscli: !v54!
What's your chow:

Now hit enter

BusyBox v1.15.2 (2015-07-21 22:07:19 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#

You now have a root shell.

TIP

If you don't see a BusyBox shell prompt, and instead see just the rkscli: prompt then the injection hasn't worked.
Repeat the command injection step, ensuring you type ";/bin/sh;" including the quotes.

Store R850 model information

# bsp set name R850
# bsp set model R850
# bsp commit

You will see something like this:-

Saving flash .....
bdSave: sizeof(bd)=0x7c, sizeof(rbd)=0xd0
  caching flash data from /dev/mtd3 [ 0x00000000 - 0x00010000 ]
  updating flash data [0x00000000 - 0x0000007c] from [0x7f8a7ac8 - 0x7f8a7b44]
  updating flash data [0x00008000 - 0x000080d0] from [0x7f8a7b44 - 0x7f8a7c14]
_erase_flash: offset=0x0 count=1
Erase Total 1 Units
Performing Flash Erase of length 262144 at offset 0x0 done
  caching flash data from /dev/mtd3 [ 0x00000000 - 0x00010000 ]
  verifying flash data [0x00000000 - 0x0000007c] from [0x7f8a7ac8 - 0x7f8a7b44]
  verifying flash data [0x00008000 - 0x000080d0] from [0x7f8a7b44 - 0x7f8a7c14]
... Changes saved to flash

You should now immediately install Unleashed.

WARNING

Especially do not factory reset the AP until you've installed the Unleashed firmware.

Install Unleashed 200.14

Login to the AP's web administration interface.

TIP

Your browser will show a security warning. This is normal and you should choose Advanced and then click through to the website by pressing Accept the Risk and Continue or Continue to 192.168.0.1 (unsafe) (the exact wording will vary depending on your browser).

Upgrade to Ruckus Unleashed

I assume you have downloaded Ruckus R850 Unleashed 200.14 firmware.

Navigate to Maintenance > Upgrade.
Choose Upgrade Method: Local and press the Local File Name: Browse... button and select your Ruckus R850 Unleashed firmware file.
Choose Perform Upgrade.

TIP

The upgrade will take several minutes. You probably won't be able to reconnect for a few minutes after the web administration interface says the upgrade is finished.

Notes

• The R730 reportedly has issues with 160Mhz wide channels, so it's best to limit channel width to 80Mhz or less.

• If your AP is broadcasting an extra Technical.Support-xxxx SSID after you've finished setting up Unleashed, then you can try enabling Unleashed Multi-Site Manager (Admin & Services >Administration > Network Management > Unleashed Multi-Site Manager) with an unreachable IP, then immediately disabling it again.

Reverting to R730 fimware

• Install vulnerable Unleashed firmware.
• Escape to a root shell.
• Store R730 model information:-

  # bsp set name R730
  # bsp set model R730
  # bsp commit

• Immediately install the latest R730 Solo firmware.