从CVE到DrayTek Vigor系列企业路由器固件分析
一、引言
Trellix 公司的安全研究员发现一个严重的远程代码执行 (RCE)漏洞 (CVE-2022-32548),影响29款 DrayTek Vigor 系列企业路由器。
易受攻击的机型如下:
- Vigor3910
- Vigor1000B
- Vigor2962 系列
- Vigor2927 系列
- Vigor2927 LTE 系列
- Vigor2915 系列
- Vigor2952 / 2952P
- Vigor3220 系列
- Vigor2926 系列
- Vigor2926 LTE 系列
- Vigor2862 系列
- Vigor2862 LTE 系列
- Vigor2620 LTE 系列
- VigorLTE 200n
- Vigor2133 系列
- Vigor2762 系列
- Vigor167
- Vigor130
- VigorNIC 132
- Vigor165
- Vigor166
- Vigor2135 系列
- Vigor2765 系列
- Vigor2766 系列
- Vigor2832
- Vigor2865 系列
- Vigor2865 LTE 系列
- Vigor2866 系列
- Vigor2866 LTE 系列
由于没有实际设备,我们先挑选影响的型号Vigor 3910进行固件分析(https://fw.draytek.com.tw/Vigor3910/Firmware/):
我们下载最新的V4.3.2版本的固件,首先使用binwalk进行初步分析,发现无法解包,再使用WinHex十六进制工具查看,可以初步认为固件是某种加密方式加密的:
既然有加密的固件,那么可以查看旧版本的固件是否有不加密的固件进行“过渡”操作。
二、旧版固件分析
通过历史固件的对比分析,发现v3.9.7.2版本的固件与新版的固件有所区别,使用binwalk分析如下:
$ binwalk -Me v3910_3972.all
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
273054 0x42A9E Unix path: /home/eason_jhan/1000b/cavium/firmware/bdk/libbdk-os/bdk-rlock.c
283704 0x45438 SHA256 hash constants, little endian
469662 0x72A9E Unix path: /home/eason_jhan/1000b/cavium/firmware/bdk/libbdk-os/bdk-rlock.c
480312 0x75438 SHA256 hash constants, little endian
573012 0x8BE54 SHA256 hash constants, little endian
835156 0xCBE54 SHA256 hash constants, little endian
2032941 0x1F052D Neighborly text, "neighbor %d too different %d from average %d, picking %d.LMC%d.R%d: MAJORTY: Byte %d: picking majority of %d over average %d."
2079947 0x1FBCCB Unix path: /home/eason_jhan/1000b/cavium/firmware/bdk/libbdk-os/bdk-rlock.c
2096368 0x1FFCF0 SHA256 hash constants, little endian
2119768 0x205858 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 2285442 bytes
2886232 0x2C0A58 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 311880 bytes
3000920 0x2DCA58 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 630943 bytes
3155032 0x302458 device tree image (dtb)
3160664 0x303A58 device tree image (dtb)
3165272 0x304C58 device tree image (dtb)
3165784 0x304E58 device tree image (dtb)
3172440 0x306858 device tree image (dtb)
3180632 0x308858 device tree image (dtb)
3184728 0x309858 device tree image (dtb)
3185752 0x309C58 device tree image (dtb)
3191896 0x30B458 device tree image (dtb)
3192408 0x30B658 device tree image (dtb)
3199576 0x30D258 device tree image (dtb)
3203160 0x30E058 device tree image (dtb)
3207256 0x30F058 device tree image (dtb)
3214424 0x310C58 device tree image (dtb)
3219544 0x312058 device tree image (dtb)
3228760 0x314458 device tree image (dtb)
3233368 0x315658 device tree image (dtb)
3239000 0x316C58 device tree image (dtb)
3243096 0x317C58 device tree image (dtb)
3243608 0x317E58 device tree image (dtb)
3247704 0x318E58 device tree image (dtb)
3253336 0x31A458 device tree image (dtb)
3257432 0x31B458 device tree image (dtb)
3258456 0x31B858 device tree image (dtb)
3265112 0x31D258 device tree image (dtb)
3272280 0x31EE58 device tree image (dtb)
3276376 0x31FE58 device tree image (dtb)
3277400 0x320258 device tree image (dtb)
3284056 0x321C58 device tree image (dtb)
3287640 0x322A58 device tree image (dtb)
3288152 0x322C58 device tree image (dtb)
3295320 0x324858 device tree image (dtb)
3295832 0x324A58 device tree image (dtb)
3302488 0x326458 device tree image (dtb)
3306072 0x327258 device tree image (dtb)
3330136 0x32D058 device tree image (dtb)
3346008 0x330E58 device tree image (dtb)
3361880 0x334C58 device tree image (dtb)
3377752 0x338A58 device tree image (dtb)
3400792 0x33E458 device tree image (dtb)
3425368 0x344458 device tree image (dtb)
3442264 0x348658 device tree image (dtb)
3463768 0x34DA58 device tree image (dtb)
3478616 0x351458 device tree image (dtb)
3493976 0x355058 device tree image (dtb)
3509848 0x358E58 device tree image (dtb)
3526232 0x35CE58 device tree image (dtb)
3541592 0x360A58 device tree image (dtb)
3557526 0x364896 Copyright string: "Copyright (C) 2016, Cavium Inc."
3559079 0x364EA7 Copyright string: "copyright notice and this permission notice shall be"
3561562 0x36585A Unix path: /sys/class/gpio/gpio472) for DSL model
5052256 0x4D1760 CRC32 polynomial table, little endian
5099137 0x4DCE81 Motorola S-Record; binary data in text format, record type: header
5259312 0x504030 Microsoft executable, portable (PE)
5499456 0x53EA40 SHA256 hash constants, little endian
12693552 0xC1B030 ELF, 64-bit LSB shared object, version 1 (SYSV)
12741544 0xC26BA8 gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
12820184 0xC39ED8 Intel x86 or x64 microcode, sig 0xffffff80, pf_mask 0x00, 1DE0-08-26, size 2048
12820328 0xC39F68 Intel x86 or x64 microcode, sig 0xffffff80, pf_mask 0x00, 1DE0-08-26, size 2048
12923200 0xC53140 LZO compressed data
12925744 0xC53B30 CRC32 polynomial table, little endian
13188944 0xC93F50 Copyright string: "Copyright (c) 1999-2006 Intel Corporation."
13196536 0xC95CF8 Copyright string: "Copyright (c) 2009 - 2012 Intel Corporation."
13197320 0xC96008 Copyright string: "Copyright (c) 1999-2008 Intel Corporation."
13199736 0xC96978 Copyright string: "Copyright (c) 2013 - 2016 Intel Corporation."
13410380 0xCCA04C Certificate in DER format (x509 v3), header length: 4, sequence length: 14848
14404968 0xDBCD68 Unix path: /dev/vc/0
14479296 0xDCEFC0 Ubiquiti partition header, header size: 56 bytes, name: "PARTNAME=%s", base address: 0x74790A00, data size: 23295090 bytes
14486472 0xDD0BC8 xz compressed data
14569424 0xDE4FD0 Unix path: /lib/firmware/updates/4.9.0-OCTEONTX_SDK_6_2_0_p3_build_38
14712280 0xE07DD8 Copyright string: "Copyright(c) 1999-2006 Intel Corporation"
14789199 0xE1AA4F Copyright string: "Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>"
14812265 0xE20469 Copyright string: "Copyright(c) Pierre Ossman"
14848048 0xE29030 Unix path: /sys/firmware/devicetree/base
14848848 0xE29350 Unix path: /sys/firmware/fdt': CRC check failed
14864129 0xE2CF01 Neighborly text, "neighbor table overflow!ate is %x"
15613000 0xEE3C48 LZ4 compressed data, legacy
15613426 0xEE3DF2 Executable script, shebang: "/bin/sh"
16971299 0x102F623 Unix path: /dev/net/tun.
17236166 0x10700C6 mcrypt 2.5 encrypted data, algorithm: "w", keysize: 332 bytes, mode: """,
19705376 0x12CAE20 XML document, version: "1.0"
20045201 0x131DD91 VMware4 disk image
20045848 0x131E018 Executable script, shebang: "/bin/sh"
20111190 0x132DF56 Base64 standard index table
21756040 0x14BF888 Unix path: /sys/class/net/%s/phy80211
22373111 0x15562F7 Base64 standard index table
22816893 0x15C287D MPEG transport stream data
23678637 0x1694EAD Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
24029059 0x16EA783 Unix path: /dev/net/tun
24533651 0x1765A93 eCos RTOS string reference: "ecosW"
24543379 0x1768093 HTML document header
24563221 0x176CE15 LUKS_MAGIC
24564177 0x176D1D1 xz compressed data
24873394 0x17B89B2 OpenSSL encryption, salted, salt: 0xC00770252D323573
24884301 0x17BB44D HTML document header
24906969 0x17C0CD9 Private key in DER format (PKCS header length: 4, sequence length: 2345
25343574 0x182B656 Unix path: /usr/local/shk
25480049 0x184CB71 Executable script, shebang: "/bin/bash"
26449086 0x19394BE SHA256 hash constants, little endian
26965826 0x19B7742 Cisco IOS microcode, for ""
27792979 0x1A81653 gzip compressed data, maximum compression, has header CRC, last modified: 1974-10-07 02:33:45 (bogus date)
30516402 0x1D1A4B2 HTML document header
30707709 0x1D48FFD Base64 standard index table
32138317 0x1EA644D HTML document header
32463276 0x1EF59AC PNG image, 32 x 24, 8-bit/color RGBA, interlaced
32463352 0x1EF59F8 Zlib compressed data, default compression
32492091 0x1EFCA3B GIF image data, version "89a", 5 x
32548082 0x1F0A4F2 JPEG image data, EXIF standard
32574798 0x1F10D4E Zlib compressed data, best compression
32577456 0x1F117B0 Zlib compressed data, best compression
32580729 0x1F12479 JPEG image data, JFIF standard 1.02, thumbnail 11x98
32751022 0x1F3BDAE Zlib compressed data, best compression
32760485 0x1F3E2A5 Zlib compressed data, default compression
32767499 0x1F3FE0B JPEG image data, JFIF standard 1.02
32822738 0x1F4D5D2 Zlib compressed data, best compression
32831773 0x1F4F91D XML document, version: "1.0"
32866201 0x1F57F99 JPEG image data, JFIF standard 1.02
32905743 0x1F61A0F GIF image data, version "89a", 30 x 30
32943989 0x1F6AF75 Zlib compressed data, best compression
32947100 0x1F6BB9C Zlib compressed data, best compression
32954824 0x1F6D9C8 XML document, version: "1.0"
32972713 0x1F71FA9 JPEG image data, JFIF standard 1.01
33011108 0x1F7B5A4 PNG image, 52 x 5, 8-bit/color RGBA, non-interlaced
33201563 0x1FA9D9B XML document, version: "1.0"
33236782 0x1FB272E PNG image, 1000 x 280, 8-bit/color RGBA, interlaced
33318819 0x1FC67A3 Zlib compressed data, best compression
33382838 0x1FD61B6 JPEG image data, JFIF standard 1.01
33382868 0x1FD61D4 TIFF image data, little-endian offset of first image directory: 8
33516114 0x1FF6A52 ZBOOT firmware header, header size: 32 bytes, load address: 0x9C54505A, start address: 0x8B844857, checksum: 0x4F8B885F, version: 0xFF979388, image size: 991901497 bytes
33609975 0x200D8F7 PNG image, 300 x 84, 8-bit/color RGBA, non-interlaced
33776158 0x203621E XML document, version: "1.0"
33809104 0x203E2D0 PNG image, 310 x 531, 8-bit/color RGBA, non-interlaced
33809203 0x203E333 Zlib compressed data, best compression
34312241 0x20B9031 JPEG image data, JFIF standard 1.01
34352652 0x20C2E0C TIFF image data, big-endian, offset of first image directory: 8
34799229 0x212FE7D Base64 standard index table
35282151 0x21A5CE7 HTML document header
35375557 0x21BC9C5 Base64 standard index table
38441243 0x24A911B Certificate in DER format (x509 v3), header length: 4, sequence length: 873
38694241 0x24E6D61 Executable script, shebang: "/bin/bash"
38694568 0x24E6EA8 Unix path: /dev/net/tun
39750489 0x25E8B59 Unix path: /usr/lib64/tc/
39881890 0x2608CA2 Copyright string: "Copyright (C) 2004 by Harald Welte <laforge@gnumonks.org>"
40546844 0x26AB21C Unix path: /home/ruby/X
40667261 0x26C887D Copyright string: "Copyright (C) 2018, Thomas G. Lane, Guido Vollbeding"
40692035 0x26CE943 Unix path: /home/ruby/X
42108450 0x2828622 Copyright string: "Copyright (C) 2018, Thomas G. Lane, Guido Vollbeding"
42240067 0x2848843 Copyright string: "Copyright (C) 2018, Thomas G. Lane, Guido Vollbeding"
42600735 0x28A091F gzip compressed data, ASCII, from VM/CMS, last modified: 1995-08-24 06:41:07
42608185 0x28A2639 ELF, 64-bit LSB processor-specific,
42845890 0x28DC6C2 Neighborly text, "neighbor C %s"
43871781 0x29D6E25 Unix path: /home/ruby/X
44237701 0x2A30385 Executable script, shebang: "/bin/sh"
44249877 0x2A33315 OpenSSH RSA public key
45239782 0x2B24DE6 SHA256 hash constants, little endian
45601353 0x2B7D249 gzip compressed data, ASCII, from VM/CMS, last modified: 2008-04-20 10:46:28
47200461 0x2D038CD SHA256 hash constants, little endian
通过binwalk的分析结果可以知道,这个固件应该不是加密固件,但是binwalk并不支持它的解包操作,如此我们先大概回顾一下固件的基本结构:
通过以上固件的基本结构,结合binwalk的信息,我们可以这样假设:
偏移 | 功能 | 备注 |
0-0x205857 | BootLoader | 先大概确定内核,再往上推演 |
0x205858-0xEE3DF1 | Kernel | 因为有LZMA的标识,可以大概推断为内核,并且这区间有dtb设备树、PE结构等标识 |
0xEE3DF2-末尾 | Rootfs | 从这里开始有Executable script的标识,表示存在实际的shell脚本文件内容了,以及后面有图片、网页的标识,可以断定为文件系统 |
截取0xEE3DF2的部分内容,可以看出此的确为shell脚本的内容,但是脚本里面充斥着很多非ASCII的内容,经过经验分析,此脚本可能被压缩了。
我们再来分析binwalk的解包结果,在0xC26BA8处有个gzip的标识,经过解压缩,可以知道其为内核的配置信息:
我们知道内核决定了支持的文件系统的类型,那么其配置信息内部可能会定义文件系统的相关配置,如此我们搜索rootfs关键字,最终找到了initramfs.cpio.lz4的字样:
后缀名lz4,可以联想到假定的rootfs区段内shell脚本之前有个LZ4压缩数据,那么可以断定从0xEE3C48应该为文件系统的起始位置。
15613000 0xEE3C48 LZ4 compressed data, legacy
15613426 0xEE3DF2 Executable script, shebang: "/bin/sh"
现在知道了,binwalk可能对lz4压缩不太支持,那么我们手动对binwalk进行功能添加:
# Ubuntu系统 添加lz4压缩工具
apt install liblz4-tool
# 加入lz4的压缩支持(binwalk安装路径/binwalk/config/extract.conf,如果找不到用find命令查找)
^lz4 compressed data:lz4:lz4 -d '%e' '%e.bin'
添加后如下所示:
使用binwalk -Me 固件就能获取到最终的文件系统的内容:
三、新版固件分析
我们说旧版固件是未加密的,新版固件是加密的,那么未加密->加密的过程会有个“过渡”操作,通过关键字“firmware”对整个文件系统进行查找,最终找到一个文件fw_upload里面有对旧版和新版固件的操作:
通过梳理整个逻辑,发现新版固件v4.3.2使用fw_unpacker进行固件的解包操作,并使用chacha20进行解密。
通过分析可知固件的结构:
序号 | 偏移 | 功能 |
1 | 0x0-0x03 | 标识,字符串6216 |
2 | 0x04-0x07 | 填充,值0 |
3 | 0x08-0x0B | header的checksum校验值,值0x3EFB072A |
4 | 0x0C | 值1 |
5 | 0x0D-0x3F | 固件版本号,字符串4.3.2_RC5a |
6 | 0x40-0x43 | 长度,值0x5 |
7 | 0x44-0x48 | 型号,字符串v3910 |
8 | 0x49-0x4C | 填充1,值0 |
9 | 0x4D-0x50 | 未知,值0x00000059 |
10 | 0x51-0x54 | nonce内容的checksum校验值,值0x6B075354 |
11 | 0x55-0x88 | 填充2,值0 |
12 | 0x89-0x8C | 字符串nonce的长度,值0x5 |
13 | 0x8D-0x92 | 字符串nonce |
14 | 0x93-0x95 | nonce内容的长度,值0xC |
15 | 0x96-0xA1 | nonce内容,字符串xRDYwRMx0B7u |
16 | 0xA2-0xA5 | 填充1,值0 |
17 | 0xA6-0xA9 | 未知,值0x02FD1A51 |
18 | 0xAA-0xAD | enc_Image内容的checksum校验值,值0x26B0401D |
19 | 0xAE-0xE1 | 填充2,值0 |
20 | 0xE2-0xE5 | 字符串enc_Image的长度,值0x9 |
21 | 0xE6-0xEE | 字符串enc_Image |
22 | 0xEF-0xF2 | enc_Image内容的长度,值0x02FD1A00 |
23 | 0xF3-0x2FD1AF2 | enc_Image内容 |
... | ... | 以下内容以此类推,包含以下区块: enc_thunder-bootfs-uboot-t81.img fw_release fw_ver pid oid uver bdk_ver linux_ver drayqemu_ver fw_release fw_ver pid oid uver bdk_ver fw_release fw_ver pid oid uver bdk_ver |
每个区块间隔0x40字节,即填充1到填充2之间的内容。
checksum校验算法:
def checksum(data, num):
length = len(data)
num = (~num) & 0xFFFFFFFF
if not num:
num = 0xFFFFFFFF
tmp1 = 0
for i in range(length):
tmp1 = data[i]
for j in range(8):
tmp2 = tmp1 ^ num
num >>= 1
if (tmp2 & 1):
num ^= 0xEDB88320
tmp1 >>= 1
return (~num) & 0xFFFFFFFF
我们需要关心的就是enc_Image区段,它是chacha20加密的,那么找到key,nonce就能解密了,解密出来是一个PE文件,直接使用binwalk -Me 固件解包,解开文件系统如下所示:
最终,本站的固件分析工具也同步更新了此类型固件的解包方式。
四、参考链接
https://blog.csdn.net/smellycat000/article/details/126188195