Hacking TL-MR3020 – Part 3 – Firmware analysis

Extracting and Analysis Firmware of the TL-MR3020
This tutorial shows how the firmware of the TP-Link TL-MR3020 could be analysed.
DRAFT!
 

$ binwalk -e rootfs.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2594041 bytes,  624 inodes, blocksize: 131072 bytes, created: Tue Jun 10 12:04:31 2014

 
 

$ ../../Downloads/fmk/unsquashfs_all.sh working.squashfs Attempting to extract SquashFS .X file system...


Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... 
Trying ./src/squashfs-2.1-r2/unsquashfs... 
Trying ./src/squashfs-3.0/unsquashfs-lzma... 
Trying ./src/squashfs-3.0/unsquashfs... 
Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... 
Trying ./src/others/squashfs-2.0-nb4/unsquashfs... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... 
Trying ./src/others/squashfs-3.3/unsquashfs... 
Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.4-cisco/unsquashfs... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs... 
Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 4 processors

Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 4 processors

Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 4 processors
584 inodes (619 blocks) to write

[===================================================================|         ] 551/619  89%
created 444 files
created 40 directories
created 72 symlinks
created 0 devices
created 0 fifos
File system sucessfully extracted!
MKFS="./src/others/squashfs-4.0-lzma/mksquashfs-lzma"

 
 

$ ls -lah
total 56K
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x  4 matt matt 4.0K Jan 16 00:06 ..
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 bin
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 dev
drwxr-xr-x  7 matt matt 4.0K Jan 15 23:51 etc
drwxr-xr-x  5 matt matt 4.0K Jan 15 23:51 lib
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 mnt
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 proc
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 root
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 sbin
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 tmp
drwxr-xr-x  4 matt matt 4.0K Jan 15 23:51 usr
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 var
drwxr-xr-x 10 matt matt 4.0K Jan 15 23:51 web
matt@kali:~/Scripts/squashfs_working/squashfs-root$ ls -lah *
bin:
total 272K
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
-rw-r--r--  1 matt matt 262K Jan 15 23:51 busybox

dev:
total 12K
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 pts

etc:
total 200K
drwxr-xr-x  7 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 3gISP
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 ath
-rw-r--r--  1 matt matt   67 Jan 15 23:51 fstab
-rw-r--r--  1 matt matt  243 Jan 15 23:51 group
-rw-r--r--  1 matt matt   26 Jan 15 23:51 host.conf
-rw-r--r--  1 matt matt   85 Jan 15 23:51 inittab
-rw-r--r--  1 matt matt   13 Jan 15 23:51 issue
-rw-r--r--  1 matt matt   54 Jan 15 23:51 lld2d.conf
-rw-r--r--  1 matt matt 109K Jan 15 23:51 mode_switch.conf.bin
-rw-r--r--  1 matt matt  215 Jan 15 23:51 nsswitch.conf
-rw-r--r--  1 matt matt  462 Jan 15 23:51 passwd
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 ppp
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 rc.d
-rw-r--r--  1 matt matt  124 Jan 15 23:51 securetty
-rw-r--r--  1 matt matt 5.8K Jan 15 23:51 services
-rw-r--r--  1 matt matt  392 Jan 15 23:51 shadow
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 wpa2
-rw-r--r--  1 matt matt 9.5K Jan 15 23:51 wr941n.ico

lib:
total 1.3M
drwxr-xr-x  5 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
-rw-r--r--  1 matt matt  23K Jan 15 23:51 ld-uClibc-0.9.30.so
-rw-r--r--  1 matt matt  12K Jan 15 23:51 libcrypt-0.9.30.so
-rw-r--r--  1 matt matt 9.3K Jan 15 23:51 libdl-0.9.30.so
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 libexec
-rw-r--r--  1 matt matt 241K Jan 15 23:51 libgcc_s.so.1
-rw-r--r--  1 matt matt  993 Jan 15 23:51 libip4tc.la
-rw-r--r--  1 matt matt  27K Jan 15 23:51 libip4tc.so.0.0.0
-rw-r--r--  1 matt matt  993 Jan 15 23:51 libip6tc.la
-rw-r--r--  1 matt matt  28K Jan 15 23:51 libip6tc.so.0.0.0
-rw-r--r--  1 matt matt 1.2K Jan 15 23:51 libiptc.la
-rw-r--r--  1 matt matt 4.9K Jan 15 23:51 libiptc.so.0.0.0
-rw-r--r--  1 matt matt  33K Jan 15 23:51 libiw.so.29
-rw-r--r--  1 matt matt 105K Jan 15 23:51 libm-0.9.30.so
-rw-r--r--  1 matt matt 4.4K Jan 15 23:51 libmsglog.so
-rw-r--r--  1 matt matt 1.7K Jan 15 23:51 libnsl-0.9.30.so
-rw-r--r--  1 matt matt  78K Jan 15 23:51 libpthread-0.9.30.so
-rw-r--r--  1 matt matt 1.7K Jan 15 23:51 libresolv-0.9.30.so
-rw-r--r--  1 matt matt 4.6K Jan 15 23:51 librt-0.9.30.so
-rw-r--r--  1 matt matt 394K Jan 15 23:51 libuClibc-0.9.30.so
-rw-r--r--  1 matt matt  33K Jan 15 23:51 libusb-0.1.so.4.4.4
-rw-r--r--  1 matt matt 4.8K Jan 15 23:51 libutil-0.9.30.so
-rw-r--r--  1 matt matt 134K Jan 15 23:51 libwpa_common.so
-rw-r--r--  1 matt matt  13K Jan 15 23:51 libwpa_ctrl.so
-rw-r--r--  1 matt matt 1010 Jan 15 23:51 libxtables.la
-rw-r--r--  1 matt matt  28K Jan 15 23:51 libxtables.so.2.1.0
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 modules
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 pkgconfig

mnt:
total 8.0K
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..

proc:
total 8.0K
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..

root:
total 8.0K
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..

sbin:
total 1.3M
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
-rw-r--r--  1 matt matt  18K Jan 15 23:51 80211stats
-rw-r--r--  1 matt matt  11K Jan 15 23:51 apstart
-rw-r--r--  1 matt matt  22K Jan 15 23:51 athstats
-rw-r--r--  1 matt matt 6.1K Jan 15 23:51 athstatsclr
-rw-r--r--  1 matt matt  24K Jan 15 23:51 dumpregs
-rw-r--r--  1 matt matt 349K Jan 15 23:51 hostapd
-rw-r--r--  1 matt matt  235 Jan 15 23:51 hotplug
-rw-r--r--  1 matt matt  35K Jan 15 23:51 ifrename
-rw-r--r--  1 matt matt  67K Jan 15 23:51 iptables-multi
-rw-r--r--  1 matt matt  31K Jan 15 23:51 iwconfig
-rw-r--r--  1 matt matt  21K Jan 15 23:51 iwevent
-rw-r--r--  1 matt matt  18K Jan 15 23:51 iwgetid
-rw-r--r--  1 matt matt  33K Jan 15 23:51 iwlist
-rw-r--r--  1 matt matt  18K Jan 15 23:51 iwpriv
-rw-r--r--  1 matt matt  19K Jan 15 23:51 iwspy
-rw-r--r--  1 matt matt  12K Jan 15 23:51 pktlogconf
-rw-r--r--  1 matt matt  60K Jan 15 23:51 pktlogdump
-rw-r--r--  1 matt matt 8.2K Jan 15 23:51 reg
-rw-r--r--  1 matt matt 175K Jan 15 23:51 tc
-rw-r--r--  1 matt matt  21K Jan 15 23:51 wlanconfig
-rw-r--r--  1 matt matt 213K Jan 15 23:51 wpa_supplicant
-rw-r--r--  1 matt matt  28K Jan 15 23:51 wpatalk

tmp:
total 8.0K
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..

usr:
total 56K
drwxr-xr-x  4 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
-rw-r--r--  1 matt matt  30K Jan 15 23:51 arp
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 bin
-rw-r--r--  1 matt matt 7.6K Jan 15 23:51 net_ioctl
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 sbin

var:
total 12K
drwxr-xr-x  3 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 run

web:
total 40K
drwxr-xr-x 10 matt matt 4.0K Jan 15 23:51 .
drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 ..
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 dynaform
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 frames
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 help
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 images
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 localiztion
drwxr-xr-x  4 matt matt 4.0K Jan 15 23:51 login
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 oem
drwxr-xr-x  2 matt matt 4.0K Jan 15 23:51 userRpm

 
 

$ file bin/busybox 
bin/busybox: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped

Leave a Reply

Your email address will not be published. Required fields are marked *

*