How to download Linksys firmware from router

Question

A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM. We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a learning opportunity to play with Binwalk.

All of the tutorials assume you already have a binary and I am not even sure if there is a way to non-destructively extract the firmware out of an existing router.

I ran a full port scan on it and only TCP/80 and TCP/1783 are active...so TFTP doesn't look like an option.

Any pointers would be appreciated.

Answer 1

If you are able to get a shell on your router, it is possible that a good part of the read-only filesystem is stored as a squashfs file and overlaid on boot. Obtaining that, along with NVRAM settings should be a good representation of the firmware.

Also if you have hardware access, there is a chance of a UART console in form of pads/pins on your router's PCB. Connecting that to a cheap ~$5 USB serial might allow you to pause your router early in the boot process and extract the firmware out via tftp, assuming u-boot which is very common.

http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/

(devttys0's blog is an excellent read on router-hacking)

Answer 2

The only reliable way is to use an external flasher to dump the flash chip. Anything you read from the running router itself could be intercepted and masked by the modified firmware to appear genuine (like the old-time DOS stealth viruses did).