I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'm not very good at reading MIPS disassembly.
I have problem with two statements from article
As you can see in the following image if the url contains the string ( BRS_netgear_success.html ) it moves to an interesting piece of code which sets two variables in the nvram to 0 (need_not_login and start_in_blankstate)
As far as I can tell the nvram_set function sets the first variable "need_not_login" to '0' (ascii) taken from asc_40B7A8, but I think the second one "start_in_blankstate" is set to '1'. Because the $a1 is set to value from aGate_interf+0x18. I think this is some sort of compiler optimization. aGate_interf starts at 0x40BCA8 when we add 0x18 we get 0x40BCC0 which points to char '1'. Here is the disassembly that shows this:
The second mistake is also related to this. The author claims that when value of 'start_in_blankstate' is different from '1' then login is bypassed.
If yes, we find a reference to start_in_blankstate where it's compared to be different to 1 and if yes the login is bypassed:
But that doesn't make sense to me. As I understand it nvram_get loads the value of 'start_in_blankstate' to $v0 then it's copied to $v1 and $v0 is loaded with '1'. They are compared at 0x403940. There is bne instruction so if they don't equal it's true (take green) if they equal it's false (take red) and bypass authentication. It can be seen here:
Also this rather fits the variable name "start_in_blankstate" that when this is set to 1 the router was not started yet and is in blank state, so bypass login and user can set his password. Is my understanding of this correct or was the author right?