We've looked at multiple ways to obtain firmware and we've
analyzed it and reversed engineered it to find sensitive
information and potential vulnerabilities.
So we're done, right?
Not nearly.
There is so much more to do.
We need to keep looking and verify our findings.
So where do we go next?
In the previous demo, we found a potential command injection vulnerability,
but we only looked at a small part of the code and didn't explore the
full function calling structure so there may have been some processing of
the input that prevented this type of attack.
The best way to confirm the vulnerability is to access
the web app and try to exploit it.
We discovered quite early on that the router was running version 2.6.36 of
the Linux kernel which is known to have vulnerabilities.
However, we don't know if any of these vulnerabilities have been patched,
and furthermore,
we don't know if there have been any proprietary modifications
made by TP link to that version of the kernel.
So whilst our initial focus was on the file system,
our next steps could be to switch across to focusing on the kernel.
Pen testers are inquisitive people.
So when we see a bootloader starting at a non‑zero address space,
we naturally think, well, what's before the bootloader?
It might be nothing or it might be something so let's take a look.
It wasn't an issue for this router,
but one to look out for on other devices is network
activity during boot and operation.
I once encountered a device that tried to resolve to Facebook,
Google, and AliExpress on boot and I still don't know why.
We only skimmed the surface of this code in Ghidra.
There is so much more to find.
We identified hundreds of calls to the OS system command and we looked
at one which identified a potential vulnerability.
How many more vulnerabilities are waiting to be found?
In this course,
we've only looked at obtaining and analyzing firmware
and we gained a lot of information,
but there is so much more to hardware product testing such as fault injection,
power analysis, exploring the web application interface,
analyzing the communication protocols,
and interfaces between the device and the gateway or the client.
And I hope you'll think of and try even more ideas
to explore the devices you test.