Recent content on The Shadow File
A few weeks ago Forrester Research, who would not normally be on my radar, posted a very concise “Project Glasswing: The 10 Consequences Nobody’s Writing About Yet.” Short version: the infosec industry is about to be turned upside down over the next 2–5 years, and in many ways the transition is well underway. This is one of the most important things I’ve read this year, and it…
What follows is a writeup of the kernel bugs NSO Group’s Pegasus spyware exploited in iOS 9, specifically versions 9.3.4 and earlier. The spyware was discovered and the vulnerabilities patched roughly six years ago. Why now? Well, “now” isn’t exactly the right word; I wrote this up just over four years ago. At the time, my intent wasn’t to publish. Rather it was to…
Whether you’re developing a kernel extension, doing vulnerability research, or you have some other need to spelunk into the macOS/iOS kernel, XNU, sometimes you need to attach a debugger. And when you do that, doing it with source code is really nice when possible. Damien DeVille , Snare and probably others have written about this process. Here are some of their articles: Debugging the Mac…
In previous posts, I described some advanced uses of the macOS defaults(1) command, including adding arbitrarily complex data structures to defaults dictionaries. I also described less than obvious locations where system and applicaton preferences get recorded. Those were all background for this article. It can be difficult know what plist file on disk stores a given setting, or exactly what the…
I wrote a tool that sniffs changes to macOS defaults as they change and autogenerates the defaults incantation to set those preferences. I have a post in the wings about this. For that to be useful, though, I need to establish a bit more groundwork about defaults. In particular, the various locations where the backing plist files can exist. Most are intuitive, but many are not. Here’s a…
Want to change Finder’s preferred view to column view from the command line? There’s a defaults command for that. Want to alter trackpad behavior from a shell script? Yep, defaults can do it. Lots of (most?) macOS and iOS settings manifest in the defaults subsystem (see Apple’s Preferences Programming Topics for Core Foundation and UserDefaults ). What this means for you, the…
In the previous post , we walked through building a stage 1 firmware image that can be flashed to the Netgear R6200 by exploiting the hidden SetFirmware SOAP action in upnpd . Due to an undersized memory allocation, we aren’t able to flash a full sized image using this exploit. Whereas a stock firmware is nearly 9MB, the buffer upnpd base64 decodes into is 4MB, leading to a crash. As a…
In the first twelve parts of this series , we identified an unauthenticated firmware update feature in the Netgear R6200 wireless router. Unfortunately, this feature was broken and only partially implemented, making exploitation less that straightforward. We reverse engineered the timing requirements and structure of the SOAP request required to exploit this vulnerability. We also reverse…
In the previous part , I described how to strip out all but the most essential services and libraries in the stock firmware in order to get the firmware image down to under 4MB. This avoids crashing upnpd , which allocates less than half enough memory to base64 decode a stock-sized firmware image. In this part, we’ll walk through a crasher you might encounter (or might not, depending how you…
In the previous part, we moved away from emulation to working with physical hardware. We identified a UART header inside the Netgear R6200 that can be used for console access. I demonstrated how to access the CFE bootloader’s recovery mode to reflash a working firmware over TFTP. This makes it possible to iteratively modify and test firmware images that will be used in the SetFirmware UPnP…
Debugging and De-bricking the Netgear R6200 via UART Update: I forgot to credit my former colleague, Tim ( @bjt2n3904 ), for helping me locate the UART header. This project would have been way more challenging without the serial connection. It would have involved desoldering the flash memory chip, probably replacing it with a ZIF socket, and then removing and reprogramming the chip for each…
In the previous part , we switched gears back to the Netgear R6200 upnpd after spending some time analyzing httpd . The HTTP daemon provided an understanding of how the firmware header is supposed to be constructed. We found a header parsing function in upnpd that was similar to its httpd counterpart. So similar that it has the same memcpy() buffer overflow. This overflow was more interesting this…
In the previous few posts , we spent time reversing how the Netgear R6200’s HTTP daemon parses a firmware header before writing the firmware image to flash. The goal was to work out how the 58-byte firmware header is constructed and how to generate a new one that can replace the header in a stock firmware. In the end we identified the purpose of all but 4 bytes. The regenerated header plus…
We’re about halfway through the Broken, Abandoned series, so this is a good time to pause for a minute and take stock. At this point, things have gotten pretty technical; if you’ve only joined recently, you may be wondering what this series is about. I want to take a moment to summarize where we’ve been and where we can expect to go from here. Overview This series, entitled…
In the previous post , I finished discussing the abCheckBoardID() function. I called attention to a checksum in the header generated by an unknown algorithm. I provided a python implementation of that algorithm ported from IDA disassembly. In total, I identified four fields parsed by this function, accounting for 30 bytes of the 58 byte header. In this part I’ll give an overview of the…
Note: It is assumed that the reader is debugging the processes described in this and the next several posts using emulation and IDA Pro. Those topics are outside the scope of this series and are covered in detail here and here . In the previous post , we switched gears and started looking at the web server for the Netgear R6200. That’s because the HTTP daemon’s code for upgrading the…
In previous installments I shared proof-of-concept code that would exercise the Netgear R6200’s hidden (and badly broken) SetFirmware SOAP action. It satisfied the various wonky conditions necessary to get into the sa_parseRcvCmd() function. Then I showed where in that function a firmware would be decoded from the SOAP request and written to flash. I showed how to identify a code path that…
In the last post , I described how upnpd ’s sa_parseRcvCmd() function finds the body of a SOAP request and how it parses that SOAP request. This is a large and complicated function that processes many types of SOAP requests. I demonstrated how to work out the desired path of execution to decode and write firmware. At the end I made an educated guess as to how the SOAP request should be…
In the previous posts , I talked about the hidden “SetFirmware” SOAP action in the Netgear R6200’s UPnP daemon, and the weird timing games we have play to deal with UPnP daemon’s broken networking code. I also discussed the haphazard parsing of the HTTP headers across multiple functions. I made a guess at what headers might get our SetFirmware SOAP request passed to the…
In the part 1 , I showed how the Netgear R6200’s upnpd binary contains what appears to be a hidden SOAP action related to the string “ SetFirmware ”. I also showed how we can get into the upnp_receive_firmware_packets() function if we play timing games and send our request in multiple parts. In this part I’ll describe additional timing considerations needed to avoid hanging…
Introduction This series of posts describes how abandoned, partially implemented functionality can be exploited to gain complete, persistent control of Netgear wireless routers. I’ll describe a hidden SOAP method in the UPnP stack that, at first glance, appeared to allow unauthenticated remote firmware upload to the router. After some reverse engineering, it became apparent this…
A Secret Passage to Persistant SOHO Router Pwnage Almost two years ago plus a house selling, a cross-country move, a house buying, a job change, and a wedding, I downloaded and unpacked the firmware for Netgear’s then-new R6200 wireless router . This was one of Netgear’s first entries into the nascent 802.11ac market. At around US$200 at the time, this device was at the high end of the…
Need to reverse engineer or exploit a file upload vulnerability in an embedded web server? I added a multipart/form-data class to Bowcaster to help with that. You can have a look here: https://github.com/zcutlip/bowcaster/blob/master/src/bowcaster/clients/http.py Here’s some background: I’ve been reverse engineering how the Netgear R6200 web server parses a new firmware image when you…
Previously I posted about running and remotely debugging a Netgear UPnP daemon using QEMU and IDA Pro. This time we’ll take on the challenge of running the built-in web server from the Netgear R6200 in emulation. The httpd daemon is responsible for so much more than the web interface. This daemon is responsible for a silly amount of system management, including configuring firewall rules, managing…
It’s often the case, when analyzing an embedded device’s firmware, that static analysis isn’t enough. You need to actually execute a binary you’re analyzing in order to see how it behaves. In the world of embedded Linux devices, it’s often fairly easy to put a debugger on the target hardware for debugging. However it’s a lot more convenient if you can run the…
A few years ago, when I worked for my previous employer, I put together a proof-of-concept that was to be part of a client demo. I thought it was kind of cool, so I recorded a screencast of it in action. I’ve had the video sitting on my laptop ever since, not really sure what to do with it. I finally decided to post it. In the video, what you see is a custom exploit script that exploits a…
Here are some additional resources I may have mentioned in my Infiltrate 2014 presentation. White Paper: SQL Injection to MIPS Overflows - Part Deux Slides: SQL Injection to MIPS Overflows - Part Deux Original white paper from Black Hat USA 2012: SQL Injections to MIPS Overflows: Rooting SOHO Routers Proof of Concept Exploit code: Here’s my Github repository for proof-of-concept exploit…
A grad student emailed me in response to my Netgear auth bypass post . He’s working on a research project and wanted to know if I knew of any resources or techniques to use emulation for executing and debugging the net-cgi binary in the Netgear firmware. It turns out I’ve got all the resources to do just that. I replied with a description of my workspace and some links to resources I…
For my presentation at BayThreat, entitled “BT Wireless Routers: Adventures in Reversing and Exploiting”, rather than have one or two or three slides packed with hard to read URLs, I included a single slide with a link to this post. Here you’ll find links to additional resources that I may have referenced in my talk. White paper: Reverse Engineering and Exploiting the BT HomeHub…
At the end of my post on the Netgear wndr3700v4’s authentication bugs, I said to expect followup posts. Once the web interface is unlocked, any further bugs that normally require authentication become fair game. Well good news, everyone! ! Previously, I talked about the net-cgi executable in the wndr3700’s firmware. ; net-cgi is a multi-call binary, a little like busybox. As such it…
UPDATE: Turns out, Jacob Holocomb ( @rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different device, the WNDR4700. Thanks for letting me know, Jacob. Nice find. Here’s a link to that report. UPDATE 2: Because there are almost certainly fools who would go hack somebody’s router and say I told them to do it, I added a warning to not do this.…
I’ve just added a module to Bowcaster that I think is cool. Actually, I just got around to finishing a module that was there all along. It’s a basic HTTP server module, but it has some unique features that make it suitable for serving payloads to remotely exploited targets. The connect-back server modules in Bowcaster are designed to run asynchronously so that they can be used right in…
Update December 2014: 44CON has posted the videos from all 2013 talks online. Unfortunately, they don’t allow the videos to be embedded, so here’s a link . For my presentation at 44CON, entitled “Reversing and Exploiting BT CPE Devices”, rather than have one or two or three slides packed with hard to read URLs, I included a single slide with a link to this post. Here…
Note : I have a great job at a company called Tactical Network Solutions, based in Columbia, MD. I’m not looking for a new job. That’s not why I’m writing this post. I have way too much fun working with crazy smart people right where I am. I get a lot of recruiter email. Some are very thoughtful and are for companies that would be very cool to work for. I love those, and I want…
Sometimes I need a MIPS Linux system that I can use for development and testing. Maybe I need to test some shellcode or debug a binary I’m analyzing. What I wish existed was a Raspberry Pi-like MIPS device. I’d love to have a bunch of small, sub-$50 devices that I could network together as a sort of desktop exploit lab. Unfortunately I don’t know of such a device. There is MIPS…
Nothing original here, but this is a great tip, so I want to share it. Thanks to @thegrugq for cluing me into this via Twitter. For everyone running OS X 10.7 or 10.8 on their Macs (and really, EVERYONE should be on 10.8 ; the security benefits are non-trivial) and are using FileVault 2 to encrypt your filesystems (you are, right?) here’s a good tip I picked up the other day:
In previous parts of the Bowcaster tutorial, I showed how to construct your buffer overflow using the OverflowBuffer class. I also mentioned there is another class, EmptyOverflowBuffer , that I would explain later. That class is going to be the topic of this post. When I started development of Bowcaster, I created it for myself and for the way I develop exploits and think about buffer overflows.…
In part 1 of the Bowcaster tutorial I showed how to generate an overflow string with the OverflowBuffer class. In part 2 , I showed how to populate your your overflow string with ROP gadgets. In part 3 , I showed how to add Bowcaster’s connect-back payload for MIPS Linux to your overflow string. I also showed how to encode your payload using Bowcaster’s MIPS Linux-specific XOR encoder…
Crossbow has been renamed to Bowcaster. It turns out “Crossbow” is a popular word. Who knew? A company in California has the word registered as a trademark in the US in connection with computer software. They might be cool with us using the word, since this is an open-source, noncommercial product, but we’ve decided to change the name just in case. Hopefully the new name is…
This is the third part in a multi part tutorial on using the Bowcaster exploit development framework to build a buffer overflow exploit. Here are part 1 and part 2 . In the last part, we had built an exploit buffer and added a ROP chain that would flush the MIPS CPU cache, locate the stack (which is randomized), and return into it. Now it’s time to add a payload. Bowcaster provides a few…
This is the second in a multi-part tutorial on developing a buffer overflow exploit using Bowcaster. Here’s Part 1 . In part 1, we had gotten a crash by sending a 2048-byte pattern to the vulnerable program. The saved return address had been overwritten with 0x41367241 and restored to the $ra register. That value is located at an offset of 528 in our overflow buffer. Now we need to start…
This is the first in a multi-part tutorial on developing a buffer overflow exploit using Crossbow (now called Bowcaster), which I released earlier today. For this tutorial I’ve written a simple program in C that overflows a buffer on the stack with whatever it reads from the network. I cross-compiled it for MIPS Linux and ran it using QEMU chrooted into the unpacked filesystem of the Netgear…
UPDATE: Crossbow has been renamed to Bowcaster. It turns out “Crossbow” is a popular word. Who knew? A company in California has the word registered as a trademark in the US in connection with computer software. They might be cool with us using the word, since this is an open-source noncommercial product, but we’ve decided to change the name just in case. Hopefully the new name…
I love hacking. I love vulnerability research. I love software exploitation. I love finding creative ways to subvert control of an application or system to make it do something it wasn’t intended to do. But this is research, and like any research, lots of things never pan out. It’s weird because it involves hours, often hundreds or even thousands of hours, of frustration paid off by…
With all the excitement regarding UPnP vulnerabilities lately, I though I’d write up this one I found a few weeks back. I had kind of forgotten about it. But it’s pretty straight forward, and kind of fun, so here it is. In Tactical Network Solutions’ Intro to Embedded Device Exploitation class, we use the D-Link DIR-815 for the practical exercises since there are tons of great…
Update: I received a personal communication from Mr. Flemming. He makes the case that what I believed to be a subtextual threat was not intended. Not necessarily speaking for TNS, I am inclined to take him at his word and that my initial read of the situation may have been unduly skeptical. I hope to post additional updates as things develop. I’m leaving the original text of this post…
[NOTE: This was going to be a post about how to relocate a shared library that is loaded using LD_PRELOAD such that a program’s linked libraries get loaded at their normal addresses. Sadly, the trick I thought would do that didn’t actually work for me. The library got relocated, but the other libraries weren’t restored to their natural base addresses. That said, it still is…
I decided to POP out all my Yahoo mail into my Google Apps account so I could stop paying for Yahoo’s “premium” service (WTF, it’s 2012, and POP is a paid feature–and there’s no IMAP?). I have fetchmail then download all of my messages which get post-processed by procmail and re-served by dovecot. Since a bunch of really old messages were just downloaded by…
Here are some long-form articles I’ve enjoyed this year. The Hazards of Nerd Supremacy: The Case of Wikileaks (theatlantic.com) The Octopus Conspiracy: One Woman’s Search for Her Father’s Killer (wired.com) Confessions of a Prep School College Counselor (theatlantic.com) The Great Rubber Robbery: How Julius Fromm’s Condom Empire Fell to the Nazis (berlinbooks.org) Bursting…
I was using up all of my accumulated credits on Audible.com just now, and realized I’ve listened to several great audiobooks over the last year. Here’s a list of what I’ve listened to in 2011, along with a link to the book on Audible.com. I recommend them all. Judas Unchained , Peter F. Hamilton, Part 2 of the Commonwealth Saga ( link ) The Gun , C. J. Chivers ( link ) The Windup…