I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-engineered a binary running on the device but skips a step in how he acquired the code:

The login action is performed via the URI /apply_sec.cgi. A quick search reveals that the apply_sec.cgi code is located at function do_ssc (0x40a210) in the /www/cgi/ssi binary.

What are some methods for acquiring these binaries (that is, the firmware)? I've been learning how to use Ghidra. Looking at vulnerable binaries from routers would be a good learning exercise.

  • 1
    The firmware? Often the manufacturer has the firmware updates available on their website for download. What device specifically are you asking about? – Daisetsu Oct 9 '19 at 21:22
  • Yes, the firmware. I edited the question to make that clearer. The device in question is a ZyXEL FR1000Z – mcgyver5 Oct 9 '19 at 22:25
  • The CenturyLink site has firmware updates for this router but I'm more interested in the old, vulnerable firmware version that exists on the device. – mcgyver5 Oct 9 '19 at 22:31

Aside from the already-mentioned option of pulling and extracting firmware updates, most routers offer a command-line admin interface, available over SSH or even Telnet. Connect to this interface, and you'll be dropped into what is supposed to be a secure, restricted shell. In practice, the shell will almost certainly have some way to do command injection (for example, on some routers, running any allowed command followed by $(command) or even ; command will work).

Once you've got command injection, verify that you're root (quite likely). At that point, you can use common Linux commands (the device will have a limited command selection but you should be able to find what you need) to get a way to copy binary files. Extract individual binaries and/or entire volume images to your PC through that, and analyze them to your heart's content.

If you aren't root, you'll need to find a local EoP vulnerability on the router; these are common enough in Linux that old firmware will almost certainly have some, though you might need to compile the exploit for your specific platform. I've yet to see a SOHO router where I needed to do this; though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.