|
|
|---|---|
|
|
|
|
|
这个是错误的 |
|
|
|
|
|
|
|
|
是找WEB配置的密码 就是WEB登录界面的密码 |
|
|
|
|
|
答案我也不知道，你可以说说你是怎么找的 |
|
|
哈哈，我应该是搞错了，我这是在jar包里翻出来的，看了下前面那个paper，感觉那个应该是正确玩法 |
|
|
这个是找WEB配置密码 不是固件后门密码 |
|
|
|
|
|
|
|
|
那首先还是要确定web server的实例，VxWorks上自带的webserver，按说没有类似tomcat这么高的能力~主要是作为简单网络设备管理界面的，一个4.5M左右的镜像，不像足以支撑个jvm的样子~ ...居然用了RTI NDDS...不便宜啊！ // subhttppwd if ( !strcmp(0x23EF48, *(_DWORD *)(compiler_reserved + 4)) ) { v13 = update_password_file2(v1); generate_temp_html_reply_file(v13); } // subrdepwd if ( !strcmp(0x23EF54, *(_DWORD *)(compiler_reserved + 4)) ) { v14 = update_password_RDE(v1); generate_temp_html_reply_file(v14); } signed int __fastcall update_password_file2(int a1) { signed int v1; // r30@1 signed int v2; // r29@1 signed int v3; // r31@1 int v4; // r3@12 int v5; // r31@12 __int16 saved_lr; // [sp+8h] [-20h]@1 int compiler_reserved; // [sp+Ch] [-1Ch]@3 v1 = 0x2414FC; v2 = 0x2414FC; v3 = 0x2414FC; dict_initState(&saved_lr, a1); while ( dict_nextState((int)&saved_lr) ) { // user if ( strcmp(0x2416B0, *(_DWORD *)(compiler_reserved + 4)) ) { // passwd if ( strcmp(0x2416A8, *(_DWORD *)(compiler_reserved + 4)) ) { // cnfpasswd if ( !strcmp(0x2416B8, *(_DWORD *)(compiler_reserved + 4)) ) v3 = *(_DWORD *)(compiler_reserved + 8); } else { v1 = *(_DWORD *)(compiler_reserved + 8); } } else { v2 = *(_DWORD *)(compiler_reserved + 8); } } if ( strcmp(v3, v1) ) return 33; if ( (unsigned int)strlen(v2) > 0x3C ) return 33; if ( (unsigned int)strlen(v1) > 0x3C ) return 33; // /FLASH0/userlist.dat v4 = fopen(0x241690, 0x23F2E4); v5 = v4; if ( !v4 ) return 33; fprintf(v4); fclose(v5); return 31; }
外部webroot下面的各种jar文件可能是其他版本的部署数据，对于这个题目可能是冗余信息 。固件里有内置web server，应该有一个字典信息存储相应内容，没有暴露在外部文件系统上，可能在内嵌文件系统里。 int __fastcall bootp_builtin_cgi(int a1) { int v1; // r30@1 int v2; // r31@1 v1 = a1; v2 = dict_alloc(); if ( v1 ) parseData(v1, v2); select_fun(v2); return dict_free(v2); } 由此函数输入参数生成的字典。 int __fastcall cgi_test_compatibility_handler(int a1) { int v1; // r31@1 int v2; // r3@1 int result; // r3@1 v1 = a1; v2 = strchr(*(_DWORD *)(a1 + 56), 63); bootp_builtin_cgi(v2 + 1); result = http_send_file(v1, 2367884, 1); if ( result ) result = http_send_error(v1, 600, 2367904, 0); return result; } int __fastcall https_product_specific_handlers(int a1) { int v1; // r28@1 v1 = a1; url_set_handler(*(_DWORD *)(a1 + 28), 2367380, formatFlash_compatibility_handler, 0, -20478); url_set_handler(*(_DWORD *)(v1 + 28), 2367412, chkdsk_handler, 0, -20478); url_set_handler(*(_DWORD *)(v1 + 28), 2367436, reboot_compatibility_handler, 0, -20478); url_set_handler(*(_DWORD *)(v1 + 28), 0x241FE4, cgi_test_compatibility_handler, 0, -20478);// /secure/embedded/builtin url_set_handler(*(_DWORD *)(v1 + 28), 2367488, language_handler, 0, -28670); url_set_handler(*(_DWORD *)(v1 + 28), 2367500, GDa_IF, 0, -28670); url_set_handler(*(_DWORD *)(v1 + 28), 2367524, DHCPa_IF, 0, -28670); url_set_handler(*(_DWORD *)(v1 + 28), 2367552, webdiag_compatibility_handler, 0, -28670); url_set_handler(*(_DWORD *)(v1 + 28), 2367584, webdiag_compatibility_handler, 0, -28670); url_set_handler(*(_DWORD *)(v1 + 28), 2367616, webdiag_compatibility_handler, 0, -28670); return url_set_handler(*(_DWORD *)(v1 + 28), 2367648, webdiag_compatibility_handler, 0, -28670); }
/secure/embedded/
http_passwd_config.htm这个页面会触发对
/secure/embedded/builtin的调用，也就会被
cgi_test_compatibility_handler 这个内置cgi处理。
最后于 2018-7-22 23:49
被HuangZhiHua编辑
，原因：
|
|
|
|
|
|
|
