2

Before starting my researches, i was just curious about how my router could work. I found some posts about reversing and emulating TP-LINK routers, so i bought one. First, i successfully extracted the .bin firmware, i have the rootfs and access to all files of the firmware. (i used the firmware-mod-kit to extract) I tried to modify the web server and install php on it.

Firmware : https://www.tp-link.com/en/support/download/tl-wr841n/#Firmware

So i had a lot of questions (and i'll do others posts for them) but one of them was simply : can I manually 'install' anything inside the firmware/inside the router/inside the rootfs. For example, to install php, you would do :

sudo apt install php<version>

But at the time i can't have a shell and a router don't have a package manager, can i manually install PHP, nmap or any other package. I know every packages are not installed the same way, but how can I know which i can install, and which i cannot ?

And how to know the way to install them manually ?

Thanks everyone before everything!

2
  • I have just checked and found that OpenWRT support your device. So if you want to get a shell, install OpenWRT (the easiest way I can think of). But the problem is, PHP is big and may not fit your router's internal storage. Nmap might be OK
    – raspiduino
    Jun 8, 2022 at 2:00
  • Commercial router firmware usually don't come with apt or dpkg support so you won't find a package manager there because they are not designed to be changed at run-time. Embedded devices are usually shipped with a firmware that does not change, if you get an update then this update updates the whole firmware. If you want to install something you have to do it manually by replacing binaries and dependent files.
    – Robert
    Jun 8, 2022 at 7:23

1 Answer 1

2

If and when you can get shell on the device, you will probably not be able to use apt to install software. apt is a package manger that several Linux distributions include, namely Debian and its derivatives like Ubuntu. apt has a configuration file that points to servers that contain software built for your distribution. For example, Ubuntu uses the file /etc/apt/sources.list to find the servers containing software that will work on specifically your version of Ubuntu.

Dynamically linked software must be linked against your existing (on your machine) libraries in order to work properly. There's a team of people behind the scenes making this happen. Many of them them are doing it just for the love of the sport.

apt is simply a package manager. It looks at some servers you've told it to look at, then downloads and attempts to install some software you ask it to. On most common distributions like Debian or Ubuntu, that list of servers has been preconfigured. If you run apt with the same configuration on a different distribution, the software downloaded will fail to run because that machine doesn't have the same libraries (or architecture).

There may be some exceptions.

Maybe a source that you can configure that downloads and installs static builds of software. Static builds don't require you to have a specific library, only a specific architecture. This requires that you install a static build of apt or another package manager and are actually able to find one of these sources. I'm personally not aware of any, but haven't looked.

DD-WRT and friends (completely custom firmware for routers -- none of the original firmware remains) have their own package managers. These can be used to install a limited range of software. This is not what you are asking about, but I thought it was good to include.

All of the above is informational. Take it in, but ignore it in regards to your main question.

can I manually 'install' anything inside the firmware/inside the router/inside the rootfs.

There are 2 ways I can think of to "install" or run a program on your router.

1: Get a shell, upload to /tmp/ or external storage

Get a shell. Preferably a root shell.

Maybe there's an existing vulnerability that will help you get a shell.

Maybe you can crack open the router and discover a serial connection that prompts you with a login or a straight up shell?

If you can get a shell on the router, you can probably download some statically linked software to /tmp/. A tool like curl, wget, an ssh server supporting scp, tftp, ftp, or a mechanism present on the web interface to upload a file may help you.

Once you get a file on the system, you can hope the tool that helped you get it there made it executable. See chmod. The command ls -la will help you determine if your file is executable. If you can run chmod +x YOUR_FILE, you're in business. Run the program.

This approach has the limitation that you must store your file in RAM. Statically linked binaries are large. SOHO routers don't have much RAM beyond what they need. If your router has a USB port, put your binary (program) on a flash drive and plug it in. With the right formatting, your router should see it. You may need to do some more research to figure out where it is or how to mount it. Even this way, you may run in to RAM limitations. It probably won't be obvious if this is the case. There typically isn't a simply massage stating as much.

2: Modify and flash the firmware

This is a very big rabbit hole.

It usually involves rebuilding the filesystem archive format. Sometimes companies use custom variations of squashfs. sasquatch in conjunction with binwalk is often used to extract from these filesystems. You'll have a harder time putting the filesystems back together. After that You'll have to repackage in to the (most likely) proprietary firmware format. This will be at a minimum checksummed and possibly signed. In its most simplistic form, signing means that the vendor can prove that they provided the firmware and that you didn't.

If you can modify the firmware, you either have to upload it through some interface (web server, tftp, etc), or flash it directly. The former presents a high risk of bricking your device.

3: Conclusion

  • Compile a static binary for the router's architecture
  • Try to get a shell
  • Figure our how to upload a binary
    • Hope there's enough RAM for it
      • A simple "Hello World" would be a good start
    • Make it executable
    • Execute your binary
      • If you have a shell, you might even be able to see it

Future Askings (asked or researched)

  • How does one search for existing vulnerabilities that provide shell on a platform?
    • What mechanisms prevent one from downgrading firmware on a router?
  • How is it possible to determine the architecture of my machine?
  • How can a program be statically linked in Linux?
    • Can statically linked programs be reduced in size?
5
  • Hello Matthew, first of all thanks for taking your time to answer me. I tried to inject a reverse shell inside the firmware by modifying it and it did not work and now, thanks to you, i know why. I just checked and they were all dynamically linked. And i'm sure at 70% that one of the lib could be missing. I'll now look for static linked binaries.
    – le_pabo
    Jun 9, 2022 at 1:12
  • How did you inject the reverse shell? It's possible that this may have failed for additional reasons. I'm interested to know the model of the device you're working on to better help. Jun 9, 2022 at 7:56
  • I did not really injected it, I added it to the /bin/ folder and rebuilt the firmware to upload it. I use a TL WR841N, you can find the firmware [here](tp-link.com/en/support/download/tl-wr841n/#Firmware). I downloaded netcat from this repo. After adding netcat, I edited the 'rcS' script in '/etc/init.d/' folder and added a netcat command, but bot listener (-lvnp) and reverse shell (connect to my listener) seems to be ignored. I'll try to check if my command are executed by using echo or something else
    – le_pabo
    Jun 9, 2022 at 23:53
  • I think we're far apart on our mutual understanding of how the firmware was rebuilt and re-flashed. My biggest concern is that your code isn't actually running. Maybe you flashed through the web interface. It could have given you a success message but actually failed. IPTables rules could be standing in your way. Maybe an exercise for you is figuring out how to write a program that will discard all IPTables rules. I don't think that's your problem but its a start. Jun 13, 2022 at 0:25
  • 1
    Try to find a simple success indicator for your reflash. Change a letter in a static HTML page. Verify that it changes. Jun 13, 2022 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.