Skip to content

Cheetshet

Cross Compiling

Compile for MIPS

mips-linux-gnu-gcc bindshell.c -o bindshell -static
mips-linux-gnu-strip bindshell

ESP

Read Flash

esptool.py -p /dev/ttyUSB0 -b 460800 read_flash 0 0x200000 flash.bin

Check Device config

espefuse.py --port /dev/ttyUSB0 summary

Binwalk

Display information

binwalk -t -vvv example-firmware

Extract

binwalk -e -t -vvv example-firmware

Entropy Analysis (identity compression / encryption)

binwalk -E example-firmware

http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/

Repacking Firmware

./extract-firmware.sh example-firmware.bin
./build-formware.sh

https://github.com/rampageX/firmware-mod-kit/wiki

Busybox

Command Injection

  • https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2010/february/busybox-command-injection/

Bind a telnet shell to port 9999

/bin/busybox telnetd -l/bin/sh -p9999

QMUE

Run binaries inside a firmware

whereis qemu-mips-static
cp /etc/example/qemu-mips-static squashfs-root
# From squashfs-root
chroot ./ ./qemu-mips-static bin/ls