3

I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'm not very good at reading MIPS disassembly.

I have problem with two statements from article

As you can see in the following image if the url contains the string ( BRS_netgear_success.html ) it moves to an interesting piece of code which sets two variables in the nvram to 0 (need_not_login and start_in_blankstate)

As far as I can tell the nvram_set function sets the first variable "need_not_login" to '0' (ascii) taken from asc_40B7A8, but I think the second one "start_in_blankstate" is set to '1'. Because the $a1 is set to value from aGate_interf+0x18. I think this is some sort of compiler optimization. aGate_interf starts at 0x40BCA8 when we add 0x18 we get 0x40BCC0 which points to char '1'. Here is the disassembly that shows this:

nvram_set for start_in_blankstate
and aGate_interf+0x18: aGate_interf+0x18

The second mistake is also related to this. The author claims that when value of 'start_in_blankstate' is different from '1' then login is bypassed.

If yes, we find a reference to start_in_blankstate where it's compared to be different to 1 and if yes the login is bypassed:

But that doesn't make sense to me. As I understand it nvram_get loads the value of 'start_in_blankstate' to $v0 then it's copied to $v1 and $v0 is loaded with '1'. They are compared at 0x403940. There is bne instruction so if they don't equal it's true (take green) if they equal it's false (take red) and bypass authentication. It can be seen here: auth bypass

Also this rather fits the variable name "start_in_blankstate" that when this is set to 1 the router was not started yet and is in blank state, so bypass login and user can set his password. Is my understanding of this correct or was the author right?

1

As far as I can see given the data you provided you're right on both accounts, If I understand you correctly.

Two things to note, though:

  • The value in aGate_interf+0x18 is indeed the value set to start_in_blankstate`, but it's not too clear what's the value there, given the second image.

  • If start_in_blankstate equals "1" the branch is not taken, and execution continues to the strcmp` call (which might be a password validation?).

This might be a patched version, or some error in the article. It does look a bit like it was copied from someplace else or that the link to the firmware download was added later on without validation.

  • It should be the vulnerable version. To make it clearer aGate_interf starts at 0x40BCA8 IDA correctly identified it as ascii string. I undefined it to clearly see what char is on 0x40BCA8+0x18. It's '1'. (Don't know why it's used like this) Don't know what those strcmp checks do (not password that is checked elsewhere I believe). strcmp returns 0 if strings match and there is beqz instruction. So I assume it's more likely that whatever is compared there won't match so the syslog branch is executed. And that bypasses the login. – J91321 Apr 27 '17 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.