In this demo,
we'll build on the dumping of a serial exercise and
access the root file system from MTD,
but instead of extracting it over a slow serial connection,
we'll use FTP.
We know from our initial investigation of the device
that we have access to a TFTP client,
so all we have to do is spin up a TFTP server on our lab
machine to receive the transferred file.
The setup for this demo is similar to the dumping of a
serial demo so we'll still connect to UART and send
commands through a serial console.
However, this time,
we need to connect an Ethernet cable between the router and our lab machine.
The network interface of the lab machine is configured to
be in the same subnet as the router.
If we review the contents for nearly a PuTTY log file,
we remind ourselves of the structure of the 5 MTD partitions
that are created at boot time together with their relative
start and endpoints in memory.
If we return to the command line on the router,
we can confirm the presence of the MTD blocks by
inspecting the contents of proc/mtd.
We can extract each and every one of these partitions,
but at the moment,
we're most interested in accessing the root file system so
we can look for sensitive information.
To do this,
we call TFTP with the ‑l option to specify the name
of the file to be transferred, ‑r to specify the remote file name,
and ‑p to specify the IP address of the receiving TFTP server.
And we can see that takes just a few seconds.
Returning to our lab machine,
we can see that the file called rootfs.img has been created.
This should be a binary image of the router's root file system.
Let's confirm that with Binwalk.
And sure enough, we have a 3 MB Squashfs file system.
In a later demo,
we'll use Binwalk to examine the file's entropy and
extract the contents of the file system.
Now that we've looked at different ways of obtaining a device's firmware,
let's take a look at how we can analyze it to find interesting
information and to identify weaknesses and vulnerabilities.