{"id":718,"date":"2020-08-26T21:36:52","date_gmt":"2020-08-26T20:36:52","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=718"},"modified":"2020-09-07T21:25:28","modified_gmt":"2020-09-07T20:25:28","slug":"analyzing-router-firmware-p5","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=718","title":{"rendered":"Analyzing Router Firmware P5"},"content":{"rendered":"<blockquote><p>You receive a <a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/Dlink_firmware.zip\">Dlink_firmware<\/a>. Somewhere inside this binary there are telnet credentials stored. Your task is to analyze the file and find the credentials&#8230;<\/p><\/blockquote>\n<p>This time I&#8217;ll use the <a href=\"https:\/\/cybercop-training.ch\/?p=157\" target=\"_blank\" rel=\"noopener noreferrer\">Attify OS<\/a> VMWare Image to solve this task.<\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-721\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15-1024x530.png\" alt=\"\" width=\"1024\" height=\"530\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15-1024x530.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15-300x155.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15-768x397.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk15.png 1399w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>After extraction I&#8217;ll first browse to the \/etc directory.<\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-724\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16-1024x394.png\" alt=\"\" width=\"1024\" height=\"394\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16-1024x394.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16-300x115.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16-768x295.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk16.png 1404w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>There is a directory called scripts with a bunch of shell scripts inside. I can check each of them manually, but a much efficienter way is to use the tool grep for that&#8230;<\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-725\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17-1024x390.png\" alt=\"\" width=\"1024\" height=\"390\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17-1024x390.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17-300x114.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17-768x292.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk17.png 1393w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p><code>grep -irn 'telnet' .<\/code><\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-726\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18-1024x341.png\" alt=\"\" width=\"1024\" height=\"341\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18-1024x341.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18-300x100.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18-768x256.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk18.png 1391w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>From the output we get, I&#8217;ll have a closer look on the shellscript telnetd.sh<\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-728\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19-1024x467.png\" alt=\"\" width=\"1024\" height=\"467\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19-1024x467.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19-300x137.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19-768x350.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk19.png 1413w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>The login name is: Alphanetworks and the password is stored in a variable called <strong>$image_sign<\/strong><\/p>\n<p>image_sign= <code>cat \/etc\/config\/image_sign<\/code><\/p>\n<p>password: <strong>wrgn23_dlwbr_dir300b<\/strong><\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-729\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20-1024x236.png\" alt=\"\" width=\"1024\" height=\"236\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20-1024x236.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20-300x69.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20-768x177.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2020\/08\/binwalk20.png 1399w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>You receive a Dlink_firmware. Somewhere inside this binary there are telnet credentials stored. Your task is to analyze the file and find the credentials&#8230; This <a class=\"mh-excerpt-more\" href=\"https:\/\/cybercop-training.ch\/?p=718\" title=\"Analyzing Router Firmware P5\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":709,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,2,17,16],"tags":[],"class_list":["post-718","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-hardware","category-iot-stuff","category-linux"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=718"}],"version-history":[{"count":6,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/718\/revisions"}],"predecessor-version":[{"id":731,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/718\/revisions\/731"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/709"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}