PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reverse Engineering a VxWorks OS Based Router

blog.quarkslab.com | research | #reverse-engineering | #firmware | #router | #vxworks | #tp-link | #mips
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A reverse engineering walkthrough of a TP-Link TL-WR543G router running VxWorks: firmware extraction, binary analysis, memory layout and the pitfalls encountered along the way.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: 1-days analysis after story. (CVE-2022-43636 & CVE-2022-43635)
Analysis of TP-Link TL-WR940N (CVE-2022-43636/43635): AuthPass() in the RSA/AES-protected login flow always returns success, letting attackers reuse stale session IDs to bypass authentication.
vulnerability · blog.viettelcybersecurity.com
1day to 0day(CVE-2022-30024) on TP-Link TL-WR841N
Studying TP-Link TL-WR841N firmware, the author revisits CVE-2020-8423 and finds 0-day CVE-2022-30024: stringModify() miscounts escaped characters, overflowing a stack buffer via the survey page.
vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: Analysis of a 1day (CVE-2022-24355) Buffer Overflow RCE Vulnerability
The author reverse-engineers CVE-2022-24355 on TP-Link TL-WR940N: the flaw sits in the Content-Type detection routine sub_5299E0, overflowing a stack buffer via file extensions for pre-auth root RCE.
research · blog.quarkslab.com
Our Pwn2Own journey against time and randomness (part 2)
Part two of Quarkslab's Pwn2Own Toronto journey: LAN-side vulnerabilities in the Netgear RAX30 — a soap_serverd buffer overflow (CVE-2023-27368), a DoS flaw and a firmware signature bypass.
research · blog.quarkslab.com
Our Pwn2Own journey against time and randomness (part 1)
Part one of Quarkslab's Pwn2Own Toronto 2022 journey: how the team picked targets for the router category, and its vulnerability research on the Netgear RAX30's WAN interface.
research · blog.quarkslab.com
TCP backdoor 32764 or how we could patch the Internet (or part of it ;))
The 32764 router backdoor: unauthenticated remote shell and credential dumping, a scan finding it open on about a million IPv4 hosts, and a way to permanently remove it from Linksys WAG200G routers.
Back