0

I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security.

Project-based learning has always worked well for me, so I'm trying to audit a mipsel router. I've done the higher-level stuff such as vulnerable services, bad configurations, etc., but am trying to learn reverse engineering and exploitation. I've been using Ghidra to disassemble and decompile the firmware, as it seemed to be by far the best in terms of decompilation for this architecture. I'm mostly new to reverse engineering, and am struggling to find any possible vulnerabilities in the cgi-bin web interface. I know this is a bit of a specialized area, so I'm looking for resources, but am struggling to find a ton on this specific domain. Any resources on for which functions I should look, specific patterns that present issues, etc.? I've got some obvious guesses (e.g. memcpy), but can't find much of a formal reference. Devttys0 blog has been helpful (for instance this post: http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/), but there doesn't seem to be a ton of info on how to find the vulnerable functions. There are lots of nice analysis plugins for x86 and even arm, but mips doesn't have as much fancy tooling.

Any help is appreciated; apologies if I didn't provide enough information, I will be happy to add more as needed. Please let me know if you have thoughts, resources, or advice I can consult. I appreciate your time.

1

Start by looking for unsafe functions (e.g. strcat, strcpy, sprintf, etc.) that may result in memory corruption vulnerabilities. This can be done by hand by browsing xrefs to function usages in the disassembly/decompilation. There also may be plugins/scripts out there to automate this.

Also, look for other interesting functions. For example, look for calls to the exec family of functions. It's very possible that user input was concatenated at some point, resulting in a command injection vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.