full-disclosure - [FD] Broken, Abandoned, and Forgotten Code, Part 7

Open Source and information security mailing list archives

Message-ID: <CACxx4MRXGK1+Ka+wpPtLm0qz0CO41NYJ+msug4LgLXJsVH5Nng@mail.gmail.com>
Date: Thu, 4 Jun 2015 11:33:06 -0700
From: Zach C <uid000@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Broken, Abandoned, and Forgotten Code, Part 7

Part 7 is up! We further refine the undocumented firmware header for
the Netgear R6200 SOHO router. A couple of additional checksum and
size fields are added as well as a packed version string field.

http://shadow-file.blogspot.com/2015/06/abandoned-part-07.html

Only 5 bytes in the 58 byte header remain unidentified, which is
sufficient for the web interface to happily accept our custom firmware
image.

Of course we haven't started customizing the contents of the firmware
yet; that will come in a later post. We'll need to generate customized
firmware for use as a payload when exploiting the SetFirmware SOAP
action described in parts 1-4.

If you missed my post to Full Disclosure where I introduced the
series, here's that:
http://seclists.org/fulldisclosure/2015/May/44

As always I welcome feedback via email or Twitter. I'm @zcutlip.

I hope you enjoy it!

Cheers,
Zach

-- 
:wq!

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives