PeterG75

Assembly Language / Reversing / Malware Analysis -resources

⭐Assembly Language

Modern x64 Assembly

https://www.youtube.com/playlist?list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA

Netgear Signed TLS Cert Private Key Disclosure

Overview

There are at least two valid, signed TLS certificates that are bundled with publicly available Netgear device firmware.

These certificates are trusted by browsers on all platforms, but will surely be added to revocation lists shortly.

The firmware images that contained these certificates along with their private keys were publicly available for download through Netgear's support website, without authentication; thus anyone in the world could have retrieved these keys.

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

	############################################################################################
	##
	## One-Click Hex Copy!
	##
	## Updated for IDA 7.xx
	##
	## All credit for actual IOCTL decode logic:
	## http://www.osronline.com/article.cfm?article=229
	##
	## Big thanks to @gaasedelen for the IDA 7 update ideas:

	import idaapi, idc, idautils


	class DecryptorError(Exception):
	pass


	def rc4crypt(key, data):
	x = 0
	box = range(256)

	Set-ExecutionPolicy Unrestricted;
	iex ((New-Object System.Net.WebClient).DownloadString('http://boxstarter.org/bootstrapper.ps1'));
	get-boxstarter -Force;
	Install-BoxstarterPackage -PackageName 'https://gist.github.com/OALabs/afb619ce8778302c324373378abbaef5/raw/4006323180791f464ec0a8a838c7b681f42d238c/oalabs_x86vm.ps1';

	from datetime import datetime
	import time
	import threading
	import random
	###########################
	import dns.resolver
	import dns.reversename
	import ftplib
	import ipaddress

	void TestCopy()
	{
	BOOL cond = FALSE;
	IFileOperation *FileOperation1 = NULL;
	IShellItem isrc = NULL, idst = NULL;
	BIND_OPTS3 bop;
	SHELLEXECUTEINFOW shexec;
	HRESULT r;

	do {

	/*
	* fork.c
	* Experimental fork() on Windows. Requires NT 6 subsystem or
	* newer.
	*
	* Copyright (c) 2012 William Pitcock <[email protected]>
	*
	* Permission to use, copy, modify, and/or distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.

	import idautils
	import idaapi

	def memdump(ea, size, file):
	data = idc.GetManyBytes(ea, size)
	with open(file, "wb") as fp:
	fp.write(data)
	print "Memdump Success!"