TL;DR:
Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file.
Long Version:
- What I have:
- A cheap unpopular GPON (Fiber ONU) device, which I have root shell access to.
- A computer
- Beginner skills (binwalk, gdb, basic stackoverflow etc.)
- High enthusiasm towards hacking
- What I want:
The router runs an ancient webserver called Boa and this has several publicly available vulnerabilties. But, I have tested each and every one against the target router ; but none of it worked. The firmware is released on this year; so, I'm almost sure that the vendor has patched them. However, I have already found an vulnerability, which I've disclosed to the vendor. But, I don't want to stop there, as I am pretty sure that this webserver contains tons of other vulnerabilities. My research found out that vendor has precompiled the webserver binaries as a stripped file and all of the server side processing functions are compiled as a stripped custom library file. What I want is to dynamically analyze the library file and catch the function calls from the webserver to the library file using gdb. To do that, I have tried the following steps:
- Placed a pre-compiled gdbserver binary and tried to run it directly in the router. But, whenever I try to do this, it gets killed automatically. (Most probably due to the low ram)
- Tried to execute the webserver binary using QEMU user mode. But, failed with custom error messages. These custom error messages aren't very descriptive and has no documentation available on the whole internet
- Emulated a MIPS system via QEMU (using debian kernel image and drive image from here), copied the extraced file system from the firmware to QEMU , chrooted into the copied file system and executed BusyBox shell from the firmware file system. Even though the BusyBox shell works inside QEMU, I cannot start the webserver inside QEMU as it throws the same custom errors as before.
- Tried to statically analyze the library using Ghidra. But, since the symbols are stripped, it didn't made any sense to me at all.
- Converted the rootfs to qcow2 image and used it with debian kernel image, but QEMU couldn't boot from it, since it couldn't detect the disk image.
As far as my research went, the only option for me to dynamically analyze the web server is to make the web server run in QEMU with the kernel image and rootfs image I extracted from the firmware. So, what are my next steps? How can I perform a full system emulation with QEMU, using the squashfs image and uBoot kernel image?
