3

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work.

I downloaded the FW from D-link's website, decrypted it with the key and IV I found online.

Now I have the unencrypted image, but i cannot extract the squashfs from it. I tried binwalk, sasquatch, FMK, compiling the unsquashfs from the GPL code, nothing. This is the binwalk of the unencrypted image:

266283        0x4102B         Flattened device tree, size: 5108 bytes, version: 17
271426        0x42442         Flattened device tree, size: 5470 bytes, version: 17
625871        0x98CCF         Copyright string: "Copyright (C) 2000-2015 Broadcom Corporation."
627179        0x991EB         HTML document header
627370        0x992AA         HTML document footer
674443        0xA4A8B         SHA256 hash constants, little endian
711103        0xAD9BF         HTML document header
713942        0xAE4D6         HTML document footer
713955        0xAE4E3         HTML document header
715939        0xAECA3         HTML document footer
715951        0xAECAF         CRC32 polynomial table, little endian
717058        0xAF102         LZMA compressed data, properties: 0x6D, dictionary size: 4194304 bytes, uncompressed size: 5762720 bytes
3016720       0x2E0810        UBI volume ID header, version: 1, type: 1, volume id: 1, size: 0
3147792       0x300810        UBI volume ID header, version: 1, type: 1, volume id: 2, size: 0
3278864       0x320810        UBI volume ID header, version: 1, type: 1, volume id: 0, size: 0
3280912       0x321010        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 29888442 bytes, 2151 inodes, blocksize: 131072 bytes, created: 2020-08-25 11:23:30
33195040      0x1FA8420       xz compressed data
33223212      0x1FAF22C       xz compressed data
33234176      0x1FB1D00       xz compressed data
33253000      0x1FB6688       xz compressed data
33344792      0x1FCCD18       xz compressed data
33411784      0x1FDD2C8       xz compressed data
33837338      0x204511A       xz compressed data
33849478      0x2048086       xz compressed data
33868214      0x204C9B6       xz compressed data
33897958      0x2053DE6       xz compressed data
33959366      0x2062DC6       xz compressed data
33989914      0x206A51A       xz compressed data
34037650      0x2075F92       xz compressed data
34061970      0x207BE92       xz compressed data
34085516      0x2081A8C       xz compressed data
34087934      0x20823FE       xz compressed data
34090156      0x2082CAC       xz compressed data
34091922      0x2083392       xz compressed data
34093628      0x2083A3C       xz compressed data
34095466      0x208416A       xz compressed data
34097948      0x2084B1C       xz compressed data
34100350      0x208547E       xz compressed data
34102444      0x2085CAC       xz compressed data
34104214      0x2086396       xz compressed data
34108740      0x2087544       xz compressed data
34111974      0x20881E6       xz compressed data
34115608      0x2089018       xz compressed data
34119526      0x2089F66       xz compressed data
34123396      0x208AE84       xz compressed data
34126462      0x208BA7E       xz compressed data
34127496      0x208BE88       xz compressed data
34129518      0x208C66E       xz compressed data
34131552      0x208CE60       xz compressed data

I'm not sure that I'm dissecting the right areas in the FW. When I'm trying to unsquash, should I also include the UBI headers? or the xz data in the end?

I would highly appreciate any help or insight on this.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.