# Getting a Shell on the LAU-G150-C Optical Network Terminal

Undocumented Link-All LAU-G150-C ONT yields root shell via UART and exposes /etc/passwd through Boa web server rooted at /etc.

- Payout: Research
- Severity: medium
- Program: Link-All LAU-G150-C
- Write-up by: Eugene Lim
- Disclosed: 2025-07-27
- Write-up quality: 6/10
- Original: https://spaceraccoon.dev/getting-shell-lau-g150-c-optical-network-terminal/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-lau-g150-c-optical-network-terminal
- Tags: area:devices domain:iot domain:network impact:data-leak impact:privesc kind:research platform:research sev:medium technique:reverse-engineering technique:source-review vuln:info-disclosure vuln:misconfiguration

**Target:** Optical Network Terminal (RTL9601D, Boa web server)
**Root cause:** UART debug console left enabled with autoboot interruptible, dropping to a root BusyBox shell; the Boa web server's document root is set to /etc, exposing sensitive files like /etc/passwd.
**Steps:**
1. Open case (check hidden screw under sticker), locate GND/RX/TX pads
2. Connect UART with GND and RX simultaneously at 115200 baud
3. Power on, interrupt autoboot to reach U-Boot, or let it boot to BusyBox root shell
4. `ebtables -F; iptables -F` to flush L2/L3 filters blocking eth0
5. `ip addr add 192.168.100.1/24 dev br0; ip link set br0 up`
6. Find web port via `/proc/572/net/tcp` (0x9CC3 = 40131)
7. Browse to `http://<ont>:40131/../etc/passwd` (server root is /etc) to read files
**How found:** Initial network recon failed (no DHCP, no pingable IP); pivoted to hardware, found unlabeled UART pads, initially got gibberish until realizing GND and RX must be probed together; then traced why ICMP failed to ebtables `-i eth0+ -j DROP`; identified web port by decoding /proc/net/tcp hex; traced 403 string in Ghidra to discover /etc document root.
**Exploitation:** Physical access required: UART gives root shell; web server on port 40131 serves files from /etc, allowing unauthenticated read of /etc/passwd and other config files over the network once filters are flushed.
**Insight:** When serial probing yields gibberish, connect ground and RX simultaneously rather than probing pins in isolation; and when a device is unreachable over Ethernet despite link, check ebtables (L2) not just iptables, since bridge filters can silently drop all host-directed traffic.