3 ms·

Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at l

Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now). But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same. These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself). [0] http://support.linksys.com/en-us/support/routers/E1000 http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png http://i.imgur.com/jWebamh.png

voltagex_ 13y ago
From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0
- cinquemb 13y ago
  I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
  - voltagex_ 13y ago
    You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.
    - cinquemb 13y ago
      That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;) [0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_brute_crack.py https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...
      - voltagex_ 13y ago
        You may also want to send a request for GPL'd sources to Linksys for this device.
      - voltagex_ 13y ago
        I have another way to extract this for you - can you please contact me?
- hawkinsw 13y ago
  Here are some of the steps that I use to unsquash the binary Commotion images to make changes: 1. Find the PARTs 2. Extract them 3. unsquash: unsquashfs -d image/ squashfs.bin 4. Make the changes. 5. squash: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mksquashfs4 image/ squashfs-made.bin -nopad -noappend -root-owned -comp xz -Xpreset 9 -Xe -Xlc 0 -Xlp 2 -Xpb 2 -b 256k 6. pad: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/padjffs2 squashfs-made.bin 64 7. mkfwimage: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mkfwimage -B XM -k kernel.img -r squashfs-made.bin -v XM.ar7240.v6.0.0-OpenWrt-r36682 -o openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory-DR2-tn.bin If you are modifying a sysugrade image: Extract 0-1048576 (bytes): that's the kernel Extract the rest: that's the squashfs Put them back together with ( dd if=vmlinux bs=1048576 conv=sync; dd if=squashfs-made.bin ) > openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-sysupgrade-DR2-custom.bin These are just my notes. Feel free to contact me if you want more information.

voltagex_ 13y ago

From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0

cinquemb 13y ago
I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
- voltagex_ 13y ago
  You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.
  - cinquemb 13y ago
    That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;) [0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_brute_crack.py https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...
    - voltagex_ 13y ago
      You may also want to send a request for GPL'd sources to Linksys for this device.
    - voltagex_ 13y ago
      I have another way to extract this for you - can you please contact me?
hawkinsw 13y ago
Here are some of the steps that I use to unsquash the binary Commotion images to make changes: 1. Find the PARTs 2. Extract them 3. unsquash: unsquashfs -d image/ squashfs.bin 4. Make the changes. 5. squash: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mksquashfs4 image/ squashfs-made.bin -nopad -noappend -root-owned -comp xz -Xpreset 9 -Xe -Xlc 0 -Xlp 2 -Xpb 2 -b 256k 6. pad: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/padjffs2 squashfs-made.bin 64 7. mkfwimage: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mkfwimage -B XM -k kernel.img -r squashfs-made.bin -v XM.ar7240.v6.0.0-OpenWrt-r36682 -o openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory-DR2-tn.bin If you are modifying a sysugrade image: Extract 0-1048576 (bytes): that's the kernel Extract the rest: that's the squashfs Put them back together with ( dd if=vmlinux bs=1048576 conv=sync; dd if=squashfs-made.bin ) > openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-sysupgrade-DR2-custom.bin These are just my notes. Feel free to contact me if you want more information.