So, we now have a raw binary image of the firmware from our target device.
Now what?
Well that depends on the pen test objectives.
It could be to identify sensitive information such as default
credentials and encryption keys, or to identify web application and
API vulnerabilities, or perhaps to identify exploitable
vulnerabilities in the operating system.
Of course, it could be all of those things,
but before we begin to look at any of them,
we need to understand the structure of the image we've obtained.
In this demo,
we'll use Binwalk to analyze our binary image and search
for embedded files and executable code.
Binwalk has been specifically designed for identifying files
and code embedded inside firmware images and is one of the
first go‑to tools for firmware testing.
Binwalk is a pretty straightforward tool to run.
Type binwalk followed by some or no options and then
one or more files to be analyzed.
Running binwalk with the help option lists the available options.
It has a rich feature set allowing control over the scan signatures,
extraction techniques, entropy analysis,
binary diffing analysis to identify differences
between two images, and much more.
We'll limit ourselves to a few basic options in this course,
but as we'll see, there is still a lot of information that can be gathered,
but I would encourage you to obtain a firmware image from
the internet and try out some of the other Binwalk options
to explore its true potential.
The most basic use case is to analyze the image for known file structures
by simply running Binwalk against the target image.
Binwalk works by looking for specific byte sequences and comparing
them to signatures in magic files to work out what types of things
are in different regions of the binary.
What Binwalk shows us so far is that the image has a
U‑Boot bootloader starting at byte 53,536,
some LZMA compressed data starting at byte 66,048, and a
Squashfs file system starting at around 1 MB.
Whilst it's a great tool,
Binwalk isn't perfect and sometimes it gives us false positives or bad data.
For example, it tells us that the LZMA compressed data dictionary size is 8.3 MB,
but the uncompressed size is only 2.9 MB.
One of the other useful features of Binwalk is that it enables us to
visualize the information entropy of the firmware image.
We do this by adding the ‑E option when we call binwalk against our image file.
Information entropy is a measure of the randomness of data in a file.
The Y axis represents the entropy ranging from 0 to 1.
High entropy values typically greater than 0.7 tend
to suggest the data is obfuscated.
So what we're seeing here is that most of the data in this
file is obfuscated with the exception of a small region at
the beginning and end of the file.
Of the three regions of the firmware,
the Squashfs filesystem is of most interest to begin with because
Squashfs is a read‑only compressed Linux file system,
meaning that this probably contains a directory tree for Linux.
So the first thing we need to do is to extract the Squashfs
file system segment from the binary image.
Now there are a couple of ways to do this,
but for this demo, we'll use the native extraction capabilities of Binwalk.
In a later demo,
we'll use the dd command to achieve the same thing for
cases where Binwalk isn't up to the task.
For this, we call binwalk with the ‑e option.
We get a few warning messages which can safely be ignored
for this demo, and very quickly, we get an uncompressed
version of our firmware image.
Changing into the directory that was created to hold our own
compressed image and listing its contents,
we see a number of files and directories,
but the one we're interested most is squashfs‑root.
If we change into that folder and list its contents,
we see that we have a Linux file tree.
There are going to be lots of goodies to find in this file system,
and we don't have time in this course to explore them all.
By taking a sneak peek in the etc folder,
we see we have a file called passwd.bak and an xml file called default_config,
both of which we'll look at more closely in later demos.