Initiating UART Shell

• USB serial adapter to connect the board and the computer
• From logic analyser, we get information about the bootup page and the baud rate
• Do not need to connect the Vcc since they both be powered up, but the common ground is required
• Use lsusb to log USB devices
• Serial devices are listed in /dev/serial/by-id
• Open serial connection with sudo screen /dev/ttyUSB1 9600
  • Here we use 9600 as baud rate

Boot logs and boot loader

• U-boot is a common bootloader

• Boot sequence

  

• Build root → opensource tool to build linux

• Dropbear → SSH

• While analysing the logs, we look for interesting things like an ssh key location

• Sometimes we can enter a command at boot to directly interact with RAM, with TP-link we need to mash tpl while booting (easier to reboot with reboot then start spamming)

Using TFTP to Exfil Files

• Often miss a lot of tools in embedded systems
  • See the available ones ls /bin or ls /sbin
  • We may want to reverse engineer some uncommon files like init binary
• Often find busybox, a tool that combines multiple binaries into one
  • Offers much more files like tftp
  • If even busybox isn't complete, we can bring the complete one to the target
• Then we’ll try to communicate using atftpd (sudo apt-get install atftp)
  • The default directory used can be found in cat /etc/default/atftpd
  • /srv/tftp
  • sudo atftpd --deamon
  • Setup the served folder to sudo chmod 777 -R /srv/tftp and sudo chown nobody -R /etc/tftp (replace nobody with another service account if necessary)
• Then, on the target, run tftp like tftp -l init -p 192.168.0.0
  • Note that there are higher success rate for transferring file from the folder rather than providing the full path

Using TFTP to Transfer Tools onto Devices