Firmware Reverse Engineering & Exploitation

What is Firmware
Analysis Firmware
How to get firmware from any device
Extracting Firmware
Firmware scanning Tool

Transcript

1. @VaibhavXX95/NullHumla
   

   View Slide

2. View Slide

3.  What is Firmware
    Analysis Firmware
    How to get firmware from any device
    Extracting Firmware
    Firmware scanning Tool
   

   View Slide

4. • Binwalk
   • Attify OS
   • Firmware Analysis Toolkit
   • Fimware Scanning Tool
   • Qemu
   • Firmwalker
   

   View Slide

5. Firmware is nothing but just a piece of code
   residing on the non-volatile section of the
   device to perform different tasks required for
   the functioning of the device.
   Components
   • Kernel
   • Boot loader
   • File System
   

   View Slide

6. Most popular attack on IoT devices:
   • Mirai Botnet infects
   

   View Slide

7. File system in the Embedded or IoT device can be of different types, depending on
   the manufacturer’s requirements and the device functionality. Each of the different
   file system types have their own unique signature headers which we will later use to
   identify the location where file system starts in the entire firmware binary. The
   common file systems which we typically encounter in IoT devices:
   1. Squashfs
   2. Cramfs
   3. JFFS2
   4. YAFFS2
   5. ext2
   

   View Slide

8. • Getting it online
   • Extracting from the device
   • Sniffing OTA
   • Reversing applications
   

   View Slide

9. View Slide

10. Damn Vulnerable Router Firmware
    

    View Slide

11. View Slide

12. View Slide

13. View Slide

14. View Slide

15. View Slide

16. View Slide

17. View Slide

18. View Slide

19. readelf –h bin/busybox
    

    View Slide

20. Reference :https://idafchev.github.io/crypto/2017/04/13/crypto_part1.html
    

    View Slide

21. View Slide

22. View Slide

23. • It’s used to access the device remotely. Example like baby
    monitor having telnet access enabled with a hard-coded password.
    • Now we have to find the word telenet in the entire firmware
    folder.
    

    View Slide

24. View Slide

25. View Slide

26. View Slide

27. View Slide

28. View Slide