{"id":128,"date":"2018-03-22T15:14:24","date_gmt":"2018-03-22T14:14:24","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=128"},"modified":"2018-03-22T15:21:39","modified_gmt":"2018-03-22T14:21:39","slug":"setup-a-vm-for-iot-and-firmware-analysis","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=128","title":{"rendered":"Setup a VM for IoT and Firmware Analysis"},"content":{"rendered":"<p style=\"text-align: justify;\"><strong>IoT stands for the Internet of Things<\/strong>. It&#8217;s a term that we will hear and be confronted more and more in the future. There are progrnosis that we will have up to 50 billion IoT devices\u00a0 connected over the internet by the year 2020.\u00a0 I&#8217;d say that&#8217;s definitive a good time to start making some thoughts about the security. This article will just give a little introduction to the topic and be a possible guide how to setup a virtual machine with some necessary tools to analyze and hack IoT devices.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-139\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_dev_2020.jpg\" alt=\"\" width=\"580\" height=\"296\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_dev_2020.jpg 580w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_dev_2020-300x153.jpg 300w\" sizes=\"auto, (max-width: 580px) 100vw, 580px\" \/><\/p>\n<p style=\"text-align: justify;\">Below you\u2019ll see some examples like a wireless blood pressure monitor or a smart light bulp, but the <a href=\"http:\/\/iotlist.co\/\" target=\"_blank\" rel=\"noopener\">list<\/a> of devices is large. I plan to write more articles in the future howto play with the &#171;bluetooth low energy protocol&#187; to analyze and hack IoT devices. Another interessting part will be the extraction and emulation of firmware binaries. But first let&#8217;s setup a VM based on Kali Linux.<\/p>\n<table>\n<tbody>\n<tr>\n<td><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-132\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_5-300x226.jpg\" alt=\"\" width=\"300\" height=\"226\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_5-300x226.jpg 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_5-300x226-80x60.jpg 80w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/td>\n<td><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-130\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/iot_2-300x249.jpg\" alt=\"\" width=\"300\" height=\"249\" \/><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You can use any version of Kali Linux or setup a fresh one. I&#8217;ll use the light version virtual box image:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-141\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/kali_1.jpg\" alt=\"\" width=\"886\" height=\"436\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/kali_1.jpg 886w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/kali_1-300x148.jpg 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/kali_1-768x378.jpg 768w\" sizes=\"auto, (max-width: 886px) 100vw, 886px\" \/><\/p>\n<p>After importing the VM into Virtualbox, check the ethernet settings and that you&#8217;ve a connection to the internet.<\/p>\n<p>Tools we want to install:<\/p>\n<table style=\"width: 795px;\">\n<tbody>\n<tr>\n<td style=\"width: 387px;\">\n<ul>\n<li>binwalk<\/li>\n<li>FAT (Firmadyne,QEMU, Firmware mod kit,firmwalker,mitm proxy)<\/li>\n<li>Kdiff3<\/li>\n<li>Radare2<\/li>\n<li>OpenOCD<\/li>\n<li>Flashrom<\/li>\n<\/ul>\n<\/td>\n<td style=\"width: 392px;\">\n<ul>\n<li>Buidroot<\/li>\n<li>GDB-Multiarch<\/li>\n<li>GNU radio companion \/GQRX<\/li>\n<li>RTL-SDR Tools<\/li>\n<li>Ubertooth, HackRF Tools<\/li>\n<li>Zigbee Tools (Killerbee)<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Install binwalk:<\/strong><\/p>\n<pre><code>git clone https:\/\/github.com\/devttys0\/binwalk.git\r\ncd binwalk\r\nsudo .\/deps.sh\r\nsudo python .\/setup.py install\r\nsudo apt-get install python-lzma  :: (for Python 2.x) \r\nsudo -H pip install git+https:\/\/github.com\/ahupp\/python-magic<\/code><\/pre>\n<p><strong>Install Firmadyne:<\/strong><\/p>\n<pre>sudo apt-get install busybox-static fakeroot git kpartx \r\nnetcat-openbsd nmap python-psycopg2 python3-psycopg2 snmp uml-utilities \r\nutil-linux vlan qemu-system-arm qemu-system-mips qemu-system-x86 \r\nqemu-utils\r\n\r\ngit clone --recursive https:\/\/github.com\/firmadyne\/firmadyne.git\r\n\r\ncd .\/firmadyne; .\/download.sh<\/pre>\n<p>Edit <code>firmadyne.config<\/code> and make the <code>FIRMWARE_DIR<\/code> point to the current location of Firmadyne folder<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-146\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmadyne.jpg\" alt=\"\" width=\"696\" height=\"275\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmadyne.jpg 696w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmadyne-300x119.jpg 300w\" sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/p>\n<p><strong>Install Firmwareanalyse Toolkit:<\/strong><\/p>\n<pre><code>pip install pexpect<\/code><\/pre>\n<pre><code>git clone https:\/\/github.com\/attify\/firmware-analysis-toolkit\r\nmv firmware-analysis-toolkit\/fat.py .\r\nmv firmware-analysis-toolkit\/reset.py .\r\nchmod +x fat.py \r\nchmod +x reset.py<\/code><code><\/code> Adjust the paths to firmadyne and binwalk in <code>fat.py<\/code> and <code>reset.py<\/code>. Additionally, provide the root password. Firmadyne requires root privileges for some of its operations. The root password is provided in the script itself to automate the process.<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-147\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/py_config.jpg\" alt=\"\" width=\"658\" height=\"262\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/py_config.jpg 658w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/py_config-300x119.jpg 300w\" sizes=\"auto, (max-width: 658px) 100vw, 658px\" \/><\/p>\n<p><strong>Setup Firmwaremodkit:<\/strong><\/p>\n<pre><code>sudo apt-get install git build-essential zlib1g-dev liblzma-dev python-magic<\/code><code>\r\ngit clone https:\/\/github.com\/brianpow\/firmware-mod-kit.git<\/code><\/pre>\n<p>Find the location of binwalk using <code>which binwalk<\/code>. Modify the file <code>shared-ng.inc<\/code> to change the value of variable <code>BINWALK<\/code> to the value of <code>\/usr\/local\/bin\/binwalk<\/code> (if that is where your binwalk is installed).<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-150\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmware_mod_kit.jpg\" alt=\"\" width=\"803\" height=\"260\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmware_mod_kit.jpg 803w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmware_mod_kit-300x97.jpg 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/firmware_mod_kit-768x249.jpg 768w\" sizes=\"auto, (max-width: 803px) 100vw, 803px\" \/><\/p>\n<p>Setup Mitm Proxy<\/p>\n<p><code>pip install mitmproxy<\/code> or <code>apt-get install mitmproxy<\/code><\/p>\n<p>Setup Firmwalker<\/p>\n<p><code>git clone https:\/\/github.com\/craigz28\/firmwalker.git<\/code><\/p>\n<p><code>sudo apt-get install git build-essential zlib1g-dev liblzma-dev python-magic<br \/>\ngit clone https:\/\/github.com\/brianpow\/firmware-mod-kit.git<\/code><\/p>\n<p><strong>Install Flashrom 0.99<\/strong><\/p>\n<p><code>wget apt-get http:\/\/download.flashrom.org\/releases\/flashrom-0.9.9.tar.bz2<br \/>\n.\/configure<br \/>\nmake &amp;&amp; make install<\/code><\/p>\n<p><strong>Install Radar2<\/strong><\/p>\n<p><code>sudo apt-get install radar2<\/code><\/p>\n<p><strong>Install OpenOCD<\/strong><\/p>\n<p><code>sudo apt-get install openocd<\/code><\/p>\n<p><strong>Install gdb-multiarch<\/strong><\/p>\n<p><code>sudo apt-get install gdb-multiarch<\/code><\/p>\n<p><strong>Install gnu-radio \/ gqrx \/ rtl-sdr<\/strong><\/p>\n<p><code>sudo apt-get install gnuradio gqrx rtl-sdr<\/code><\/p>\n<p><strong>Install hackrf \/ ubertooth<\/strong><\/p>\n<p><code>sudo apt-get install hackrf ubertooth<\/code><\/p>\n<p><strong>Install Killerbee<\/strong><\/p>\n<pre><code>apt-get install python-gtk2 python-cairo python-usb python-crypto\r\npython-serial python-dev libgcrypt-dev\r\nsudo apt-get install mercurial\r\nhg clone https:\/\/bitbucket.org\/secdev\/scapy-com\r\ncd scapy-com\r\nchmod +x reset.sh\r\npython setup.py install\r\ncd ..\r\ngit clone https:\/\/github.com\/riverloopsec\/killerbee.git\r\ncd killerbee\r\npython setup.py install\r\ncd tools\/\r\nchmode +x *\r\n<\/code><\/pre>\n<p><strong>Additional Tools (Arduino and XTCU)<\/strong><\/p>\n<p><code>sudo apt-get install arduino arduino-core<\/code><\/p>\n<p>For XTCU go to the following URL and download the linux binary:<\/p>\n<p><a href=\"https:\/\/www.digi.com\/xctu-linux-x64\" target=\"_blank\" rel=\"noopener\">https:\/\/www.digi.com\/xctu-linux-x64<\/a><\/p>\n<p><code>chmod +x 40002881_J.run<\/code><\/p>\n<p><code>.\/40002881_J.run<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>IoT stands for the Internet of Things. It&#8217;s a term that we will hear and be confronted more and more in the future. There are <a class=\"mh-excerpt-more\" href=\"https:\/\/cybercop-training.ch\/?p=128\" title=\"Setup a VM for IoT and Firmware Analysis\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":135,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,17,16],"tags":[19,18],"class_list":["post-128","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-iot-stuff","category-linux","tag-iot","tag-virtual-machine"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128"}],"version-history":[{"count":16,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/128\/revisions"}],"predecessor-version":[{"id":156,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/128\/revisions\/156"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/135"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}