IoT Firmware Analysis - Revision history

Craig Smith at 16:29, 12 February 2016

2016-02-12T16:29:13Z

2016-02-10T23:17:47Z

2016-02-10T23:13:04Z

2016-02-10T22:51:58Z

2016-02-10T22:51:37Z

2016-02-10T22:42:48Z

2016-02-03T21:05:54Z

2016-02-03T21:03:48Z

2016-02-03T21:02:19Z

2016-02-03T20:54:25Z

@@ Line 85: / Line 85: @@
 * grep -rnw '/path/to/somewhere/' -e "pattern" like password, admin, root, etc.
 * find . -name '*.conf' and other file types like *.pem, *.crt, *.cfg, .sh, .bin, etc.
 === Dynamic testing of a web admin interface without the device ===
 * See the example video (https://craigsmith.net/episode-12-1-firmware-emulation-with-qemu/)

← Older revision		Revision as of 23:17, 10 February 2016
Line 85:		Line 85:
	* grep -rnw '/path/to/somewhere/' -e "pattern" like password, admin, root, etc.		* grep -rnw '/path/to/somewhere/' -e "pattern" like password, admin, root, etc.
	* find . -name '.conf' and other file types like .pem, .crt, .cfg, .sh, .bin, etc.		* find . -name '.conf' and other file types like .pem, .crt, .cfg, .sh, .bin, etc.
		+
		+	=== Dynamic testing of a web admin interface without the device ===
		+	* See the example video (https://craigsmith.net/episode-12-1-firmware-emulation-with-qemu/)

@@ Line 66: / Line 66: @@
 === Extracting a jffs2 file system ===
 * Use the "unjffs2" batch file which is part of the firmware modification kit. "/firmware-mod-kit/src/jffs2/unjffs2"
 === Extracting from a CPIO archive file ===
@@ Line 74: / Line 75: @@
 * Ensure UBI Reader is installed (https://github.com/jrspruitt/ubi_reader)
 * Run binwalk -e {filename}
 === Things to check for once the file system is mounted or extracted ===

@@ Line 65: / Line 65: @@
 === Extracting a jffs2 file system ===
-* Use the "unjffs2" batch file which is part of the firmware modification kit. "/opt/firmware-mod-kit/src/jffs2/unjffs2"
+* Use the "unjffs2" batch file which is part of the firmware modification kit. "/firmware-mod-kit/src/jffs2/unjffs2"
 === Extracting from a CPIO archive file ===

@@ Line 64: / Line 64: @@
 * QEMU emulation is also another way to examine binaries
-=== Mounting jffs2 file system ===
+=== Extracting a jffs2 file system ===
 * Use the "unjffs2" batch file which is part of the firmware modification kit. "/opt/firmware-mod-kit/src/jffs2/unjffs2"

@@ Line 47: / Line 47: @@
   * /etc/passwd
   * /etc/shadow
-  * /etc/ssh/authorized_keys
+  * .ssh/authorized_keys
 === Using the Firmware Modification Kit ===

@@ Line 44: / Line 44: @@
   * "cd" into "squash-root" and have a look around for interesting things
   * Some examples include:
-  * /etc/banner
+  * /etc/ssl
-  * /etc/openwrt_version
+  * /etc/passwd
-  * /etc/openwrt_release
+  * /etc/shadow
-  * /etc/dropbear/authorized_keys
+  * /etc/ssh/authorized_keys
 === Using the Firmware Modification Kit ===

@@ Line 57: / Line 57: @@
   * ex. "unsquashfs_all.sh xyz.bin"
   * Assuming that works, you can view the file system at "fmk/rootfs"
 === Extracting and Running Binaries ===

@@ Line 39: / Line 39: @@
   * ex. "dd if=xyz.bin bs=1 skip=922460 count=2522318 of=xyz.squashfs"
   * Note: skip and count values will vary depending on your specific bin file
 * Following extraction of the filesystem assuming it is squashfs, we can expand the contents by running "sasquatch"