IoT基础学习

binwalk -Me *.bin

zip -r -q -o pack.zip test/
cp ./pack.zip /mnt/hgfs/share

# binwalk ROM/wifi_firmware_c91ea_1.0.50.bin

DECIMAL       HEXADECIMAL     DESCRIPTION

--------------------------------------------------------------------------------

684           0x2AC           UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

$ sudo apt-get install liblzo2-dev
$ sudo pip install python-lzo
$ git clone <https://github.com/jrspruitt/ubi_reader>
$ cd ubi_reader
$ sudo python setup.py install

def decompress_firmware(data):

	flen = len(data)
	sigstart = data.find('\\xA5\\xA5\\xA5\\x5A\\xA5\\x5A')
	if sigstart <= 0:
		sigstart = data.find('\\x5A\\x5A\\xA5\\x5A\\xA5\\x5A')
	if sigstart > 0:
		if draytools.verbose:
			print 'Signature found at [0x%08X]' % sigstart
		lzosizestart = sigstart + 6
		lzostart = lzosizestart + 4
		lzosize = unpack('>L', data[lzosizestart:lzostart])[0]
		return data[0x100:sigstart+2] \\
			+ pydelzo.decompress('\\xF0' + pack(">L",0x1000000) \\
				+ data[lzostart:lzostart+lzosize])

# mv rootfs/sbin/xxxd sbin/xxxdd
# touch rootfs/sbin/xxxd
# chmod +x rootfs/sbin/xxxd

 #!/bin/sh

/usr/sbin/telnetd -F -l /bin/sh -p 1234 &
/sbin/xxxdd &

# For ubuntu

$ sudo apt-get install git build-essential zlib1g-dev liblzma-dev python-magic bsdmainutils autoconf

# For redhat/centos

$ yum groupinstall "Development Tools"
$ yum install git zlib1g-dev xz-devel python-magic zlib-devel util-linux

# 使用

$ ./extract-firmware.sh firmware.bin //解包
$ cp new-telnetd fmk/rootfs/usr/sbin/telnetd //按需修改
$ ./build-firmware.sh //打包

import os, socket, sys, threading
sys.path.append("..")
from qiling import *

def patcher(ql):
    ...

def nvram_listener():
    ...

def my_sandbox(path, rootfs):
    ql = Qiling(path, rootfs, output = "debug")
    ql.add_fs_mapper("/dev/urandom","/dev/urandom")
    ql.hook_address(patcher ,ql.loader.elf_entry)
    ql.run()

if __name__ == "__main__":

    nvram_listener_therad =  threading.Thread(target=nvram_listener, daemon=True)

    nvram_listener_therad.start()
    my_sandbox(["rootfs/bin/httpd"], "rootfs")

git clone --recursive https://github.com/pr0v3rbs/FirmAE
./download.sh
./install.sh

./init.sh

# 举例：
wget https://github.com/pr0v3rbs/FirmAE/releases/download/v1.0/DIR-868L_fw_revB_2-05b02_eu_multi_20161117.zip

sudo ./run.sh -c <brand> <firmware>

sudo ./run.sh -a <brand> <firmware>

sudo ./run.sh -r <brand> <firmware>

git clone https://github.com/attify/firmware-analysis-toolkit
cd firmware-analysis-toolkit
./setup.sh

# fat.config
[DEFAULT]
sudo_password=attify123
firmadyne_path=/home/attify/firmadyne

./fat.py <firmware file>

$ ./fat.py DIR-601_REVB_FIRMWARE_2.01.BIN 

                               __           _   
                              / _|         | |  
                             | |_    __ _  | |_ 
                             |  _|  / _` | | __|
                             | |   | (_| | | |_ 
                             |_|    \__,_|  \__|                    
                    
                Welcome to the Firmware Analysis Toolkit - v0.3
    Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation
                  By Attify - https://attify.com  | @attifyme
    
[+] Firmware: DIR-601_REVB_FIRMWARE_2.01.BIN
[+] Extracting the firmware...
[+] Image ID: 1
[+] Identifying architecture...
[+] Architecture: mipseb
[+] Building QEMU disk image...
[+] Setting up the network connection, please standby...
[+] Network interfaces: [('br0', '192.168.0.1')]
[+] All set! Press ENTER to run the firmware...
[+] When running, press Ctrl + A X to terminate qemu

# 编译用户模式
cd ./FirmAFL/user_mode/
sed -i '40s/static //' util/memfd.c
./configure --target-list=mipsel-linux-user,mips-linux-user,arm-linux-user --static --disable-werror
make

# 编译系统模式
cd ../qemu_mode/DECAF_qemu_2.10/
sed -i '40s/static //' util/memfd.c
./configure --target-list=mipsel-softmmu,mips-softmmu,arm-softmmu --disable-werror
make

# 安装Firmadyne并设置数据库
cd ../../
sudo apt-get install busybox-static fakeroot git dmsetup kpartx netcat-openbsd nmap python-psycopg2 python3-psycopg2 snmp uml-utilities util-linux vlan
git clone --recursive <https://github.com/firmadyne/firmadyne.git>
cd ../FirmAFL/firmadyne
sudo apt-get install postgresql
sudo apt-get install libpq-dev
dropdb -U firmadyne -h 127.0.0.1 firmware
sudo -u postgres createuser -P firmadyne
sudo -u postgres createdb -O firmadyne firmware
cd database
cp /home/churchkm/Downloads/data.xz ./
xz -d data.xz
mv data schema
chmod +x schema
sudo -u postgres psql -d firmware < ./schema

# 使用Firmadyne仿真固件
cd ../
sudo ./download.sh
sed -i '4s/#//' firmadyne.config
cp ../firmadyne_modify/makeImage.sh ./scripts/
sudo ./sources/extractor/extractor.py -b dlink -sql 127.0.0.1 -np -nk "../firmware/DIR-815_FIRMWARE_1.01.ZIP" images
sudo ./scripts/getArch.sh ./images/9050.tar.gz
sudo ./scripts/makeImage.sh 9050
sudo ./scripts/inferNetwork.sh 9050

# 使用FirmAFL进行Fuzzing
cd ../
python3 FirmAFL_setup.py 9050 mipsel
cp ./FirmAFL_config/9050/run.sh ./image_9050/  #即用FirmAFL_config中的run.sh替换image_9050中的run.sh
cd image_9050
sudo ./run.sh
# 固件启动后，新终端下执行
python3 test.py
sudo user.sh

git clone https://github.com/fuzzware-fuzzer/fuzzware.git

sudo ./build_docker.sh

sudo ./run_docker.sh examples fuzzware pipeline --skip-afl-cpufreq pw-recovery/ARCH_PRO
sudo ./run_docker.sh test fuzzware pipeline --skip-afl-cpufreq .

sudo apt-get update

sudo apt-get install -y build-essential python3-dev automake git flex bison libglib2.0-dev libpixman-1-dev python3-setuptools

sudo apt-get install -y lld-11 llvm-11 llvm-11-dev clang-11 || sudo apt-get install -y lld llvm llvm-dev clang

sudo apt-get install -y gcc-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-plugin-dev libstdc++-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-dev

cd $HOME

git clone https://github.com/AFLplusplus/AFLplusplus && cd AFLplusplus

export LLVM_CONFIG="llvm-config-11"

make distrib

sudo make install

# export CC=/home/closure/AFLplusplus/afl-clang-fast
# export CXX=/home/closure/AFLplusplus/afl-clang-fast++
# export LLVM_CONFIG="llvm-config-11"

afl-gcc test.c -o test_file
gcc test.c -o test_gcc

afl-fuzz -i ./fuzz_in -o ./fuzz_out ./test_file -f

afl-gcc ./hello.c -o hello

/home/iot/test/tools/AFLplusplus/afl-gcc ./hello.c -o hello

afl-fuzz -i inputs/ -o out/  -- ./hello

/home/iot/test/tools/AFLplusplus/afl-fuzz -i ./fuzz_in -o ./fuzz_out -- ./hello @@

sudo apt-get install libtool-bin libgtk2.0-dev -y
cd /home/iot/test/tools/AFLplusplus/qemu_mode
./build_qemu_support.sh
cd ..
sudo make install

afl-fuzz -Q -m none -i in -o out ./pwn_file @@

/home/iot/test/tools/AFLplusplus/afl-fuzz -i fuzz_in -o ./fuzz_out -Q ./pwn

# 进入SaTC代码目录
cd SaTC 

# 构建Docker镜像
docker build . -t satc

# 进入Dokcer环境, 自行添加目录映射
docker run -it satc

# 从docker hun拉去image
docker pull smile0304/satc:V1.0

# 进入Dokcer环境, 自行添加目录映射
docker run -it smile0304/satc:V1.0

usage: satc.py [-h] -d /root/path/_ac18.extracted -o /root/output
               [--ghidra_script {ref2sink_cmdi,ref2sink_bof,share2sink,ref2share,all}]
               [--save_ghidra_project] --taint_check
               [-b /var/ac18/bin/httpd | -l 3]

SATC tool

optional arguments:
  -h, --help            查看帮助
  -d /root/path/_ac18.extracted, --directory /root/path/_ac18.extracted
                        指定从固件中提取出的文件系统
  -o /root/output, --output /root/output
                        指定结果输出位置
  --ghidra_script {ref2sink_cmdi,ref2sink_bof,share2sink,ref2share,all}
                        (可选) 指定要使用的 Ghidra 脚本。 如果使用`all`命令，`ref2sink_cmdi`、`ref2sink_bof`和`ref2share`三个脚本将同时运行
  --ref2share_result /root/path/ref2share_result  (可选) 运行`share2sink` Ghidra脚本时，需要使用该参数指定`ref2share`脚本的输出结果
  --save_ghidra_project (可选) 是否保存程序运行时产生的ghidra工程路径
  --taint_check         (可选) 指定是否启用污点分析
  -b /var/ac18/bin/httpd, --bin /var/ac18/bin/httpd
                        (可选) 用于指定需要分析的程序，如果不指定，SaTC将使用内置算法确认需要分析的程序
  -l 3, --len 3         (可选) 根据分析结果分析可能为边界的前N个程序，默认为3

sudo docker run -v /home/user/data:/data ...

sudo docker run -v /home/iot/test/vul:/vul ...

#启动Docker容器并进入其中的交互式终端
sudo docker run -it smile0304/satc:V1.0
sudo docker run -v /home/iot/test/vul:/vul smile0304/satc:V1.0

cd ~/SaTC/
cd ~/res/

python satc.py -d /home/satc/dlink_878 -o /home/satc/res --ghidra_script=ref2sink_cmdi --ghidra_script=ref2sink_bof --taint_check

python satc.py -d /home/satc/dlink_878 -o /home/satc/res --ghidra_script=ref2sink_cmdi --ghidra_script=ref2sink_bof --taint_check

python satc.py -d /home/satc/dlink_878 -o /home/satc/res --ghidra_script=ref2sink_cmdi -b prog.cgi --taint_check

python satc.py -d /home/satc/dlink_878 -o /home/satc/res --ghidra_script=ref2share -b prog.cgi

python satc.py -d /home/satc/dlink_878 -o /home/satc/res --ghidra_script=share2sink --ref2share_result=/home/satc/res/ghidra_extract_result/prog.cgi/prog.cgi_ref2share.result -b rc --taint_check

|-- ghidra_extract_result # ghidra寻找函数调用路径的分析结果, 启用`--ghidra_script`选项会输出该目录
|   |-- httpd # 每个被分析的bin都会生成一个同名文件夹
|       |-- httpd # 被分析的bin
|       |-- httpd_ref2sink_bof.result # 定位bof类型的sink函数路径
|       |-- httpd_ref2sink_cmdi.result # 定位cmdi类型的sink函数路径
|-- keyword_extract_result  # 关键字提取结果
|   |-- detail  # 前端关键字提取结果(详细分析结果)
|   |   |-- API_detail.result # 提取的API详细结果
|   |   |-- API_remove_detail.result # 被过滤掉的API信息
|   |   |-- api_split.result  # 模糊匹配的API结果
|   |   |-- Clustering_result_v2.result # 详细分析结果(不关心其他过程关心此文件即可)
|   |   |-- File_detail.result  # 记录了从单独文件中提取的关键字
|   |   |-- from_bin_add_para.result # 在二进制匹配过程中新增的关键字
|   |   |-- from_bin_add_para.result_v2 # 同上,V2版本
|   |   |-- Not_Analysise_JS_File.result # 未被分析的JS文件
|   |   |-- Prar_detail.result # 提取的Prar详细结果
|   |   |-- Prar_remove_detail.result # 被过滤掉的Prar结果
|   |-- info.txt  # 记录前端关键字提取时间等信息
|   |-- simple  # 前端关键字提取结果, 比较简单
|       |-- API_simple.result # 在全部二进制中出现的全部API名称
|       |-- Prar_simple.result  # 在全部二进制中出现等的全部Prar
|-- result-httpd-ref2sink_cmdi-ctW8.txt # 污点分析结果,启用`--taint-check` 和 `--ghidra_script`选项才会生成该文件

pip3 install --upgrade setuptools

git clone https://gitlab.com/invuls/iot-projects/iotsecfuzz.git

cd iotsecfuzz

python3 setup.py install

# API
from isf import core

core.init_home_directory()

# You can edit directories to load modules from
core.modules_dirs.append('.')
core.load_modules()

# Way 1: import the module directly
from isf.hardware.ttltalker import TTLTalker

talker = TTLTalker('/dev/ttyACM0', 9600, 0.1)
talker.connect()
talker.send_char('ff', False, 0)

# Way 2: get module/submodule using ISF core
send_char = core.modules['hardware/ttltalker/send_char']
send_char.run({'com_port': '/dev/ttyACM0', 'baudrate': 9600, 'timeout': 0.1,
               'char_hex': 'ff', 'output': False, 'output_length': 0})