{"id":663,"date":"2020-08-16T21:50:56","date_gmt":"2020-08-16T20:50:56","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=663"},"modified":"2020-09-07T21:26:16","modified_gmt":"2020-09-07T20:26:16","slug":"analyzing-router-firmware-p1","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=663","title":{"rendered":"Analyzing Router Firmware P1"},"content":{"rendered":"

Challenge 1 – find network backdoor
\n<\/strong><\/p>\n

\n

You have received a firmware image for forensic analysis. The network administrator uncovered this backdoor while monitoring the network. The Wi-Fi router only had port 22 and 80 open when they had installed it. However, the firewall seems to be picking up traffic on port 4763 as well. They did some preliminary analysis but to no avail. The attacker seems to have hidden the firmware well.<\/p>\n<\/blockquote>\n

Firmware analysis is the process of recovering, extracting, and analyzing the contents of a firmware. A firmware here refers to a software (or operating system) running on an embedded device like a router, camera, refrigerator etc.<\/p>\n

For this challenge I’ll use binwalk. binwalk is a solid and popular tool for working with firmware for devices which run some kind of OS. It is written in python. At a high-level, by default, binwalk iterates through all the bytes in a binary, looking for magic bytes<\/a>. If finds one, it will report it on a table it prints to stdout.<\/p>\n

It can also \u201ccarve\u201d out (\/extract) each segment it finds, so you can look at it in isolation. Use the -e flag<\/strong> to specify that it should extract files<\/strong> rather than print everything it finds to stdout. Extracted files all go into a directory called _filename.extracted<\/strong> (or _filename-[int].extracted, if that folder already exists), based on the filename of the file you\u2019ve run binwalk against.<\/p>\n

\"\"<\/a><\/p>\n

Let’s check the extracted content and browse in the squashfs root directory:<\/p>\n

\"\"<\/a><\/p>\n

In the \/etc directory I’ll have a closer look for the rc.local file which is a well-known file used to start processes or perform a task on boot up.<\/p>\n

\"\"<\/a><\/p>\n

We can observe that FIREWALL_INIT is point to another file, probably a shell script. Let’s open that and see what it does<\/p>\n

\"\"<\/a><\/p>\n

The script is running a suspicious command. The command is encoded as base64 and is decoding during execution.<\/p>\n

I use the following command to decode, which reveals a netcat listener on port 4763<\/p>\n

echo \u201cbmMgLWwgNDc2Mw==\u201d | base64 -d<\/strong><\/p><\/blockquote>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Challenge 1 – find network backdoor You have received a firmware image for forensic analysis. The network administrator uncovered this backdoor while monitoring the network. […]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":664,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,4,17,16],"tags":[],"class_list":["post-663","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forensic","category-hacking","category-iot-stuff","category-linux"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=663"}],"version-history":[{"count":12,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/663\/revisions"}],"predecessor-version":[{"id":695,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/663\/revisions\/695"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/664"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}