4

I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but that's coming up blank:

$ binwalk apollo_fw4_full_p_1.1.32_nand.bin 

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------

$ 

Likewise Firmware Mod Kit fails:

$ ./extract-firmware.sh ../apollo_fw4_full_p_1.1.32_nand.bin 
Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Preparing tools ...
Scanning firmware...

Scan Time:     2016-03-21 15:05:55
Signatures:    193
Target File:   /home/ob1/apollo_fw4_full_p_1.1.32_nand.bin
MD5 Checksum:  b100590cbe030628d97e6d39c6f7fde8

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------

Extracting 0 bytes of  header image at offset 0
ERROR: No supported file system found! Aborting...

Does the "nand" in the filename mean anything? Is it encrypted possibly?

Here is a link to the file for those interested: https://docs.google.com/uc?id=0B9QI-CmVjKHdekdOOU5EWk9rbTQ&export=download

I've scoured for answers and have found none, so I appreciate your input.

1 Answer 1

5

The firmware image is likely to be encrypted.

Entropy Scan

Entropy scan reveals that it is mostly comprised of random bytes which happens if the firmware is compressed and/or encrypted. Since the binary lacks common compression magic signatures, it is most likely to be encrypted.

To decrypt the firmware you need to obtain more information about the product that uses this firmware. You can refer to this blog post for some ideas.

As you say port 22 is open running a FTP service you can try connecting to it with default user/pass combos. You can try finding other open ports via nmap.

1
  • That's what I was afraid of. That blog post is a very interesting but perhaps beyond my capabilities/time. I'll have to try another method. Going to keep this open a few days to see if any other answers before I accept yours. Thanks!
    – justin
    Mar 22, 2016 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.