0xPThree.gitbook.io
  • Network Services
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 23 - Telnet
      • 25, 465, 587 - SMTP(S)
      • 53 - DNS
      • 80, 443 - HTTP(S)
        • Frameworks
          • Drupal
          • Flask
          • Laravel
          • Tomcat
          • Werkzeug
        • Fuzzing
        • Grafana
        • Languages
          • PHP
        • WebDAV
        • Web Vulnerabilities
          • CloudFlare Bypass
          • Command Injection
          • CSTI
          • File Inclusion/Path Traversal
          • SQL Injection
          • SSI
          • SSTI
          • Upload bypass
          • XLST
          • XML Injection
      • 88 - Kerberos
      • 135, 593 - MSRPC
      • 139, 445 - SMB
      • 161, 162, 10161, 10162 - SNMP
      • 1433, 3306 - SQL
      • 2049 - NFS
      • 2375 - Docker
  • Active Directory
    • ADCS
    • DACL Abuse
      • AddMember
      • ForceChangePassword
      • Kerberoasting
      • ReadLAPSPassword
      • ReadGMSAPassword
      • Grant Ownership
      • Grant Rights
      • Logon Script
      • Rights on RODC object
    • Security groups
    • Misc
  • Coding Languages
    • Python
  • Exploits / PoC's
    • Ansible
      • Ansible AWX
    • Apache
      • HTTP Server - CVE-2021-41773
      • Struts - CVE-2024-53677 / S2-067
      • Tomcat - CVE-2020-1938 / CVE-2020-10487
      • Tomcat - CVE-2025-24813
    • Confluence - CVE-2023-22527
    • CUPS - CVE-2024-47***
    • D-Link
      • CVE-2020-29322
      • Decrypt firmware: DIR-X1560
    • Dmidecode - CVE-2023-30630
    • EternalBlue - MS17-010
    • Gitlab - CVE-2023-7028
    • Ivanti - CVE-2024-21893 / 21887
    • Jenkins - CVE-2024-23897
    • LXD group - N/A
    • nf_tables - CVE-2024-1086
    • NFS - N/A
    • Oracle
      • WebLogic - CVE-2018-2628
      • WebLogic - CVE-2019-2729
      • WebLogic - CVE-2023-21839
      • WebLogic - CVE-2024-20931
      • WebLogic - CVE-2024-21006
    • PHP
      • CVE-2024-4577
    • RunC
      • CVE-2024-21626
      • CVE-2022-0811
    • Snap - CVE-2019-7304
    • TP-Link - CVE-2024-5035
  • Hardware
    • Firmware
    • JTAG
    • SPI
    • UART
    • USB
  • Post Exploit
    • Compile payload
    • Obfuscation
    • Read VMDK files
    • Saved Credentials
      • Linux - Ansible AWX / Tower
      • Linux - Dell Networker
      • Windows - Mozilla Firefox
      • Windows - Notepad++
      • Windows - WinSCP
    • Session Hijack
    • Sniffing Passwords
    • Upgrade shell
    • VMware
      • Disk Encryption
      • LDAP Connection (SSO)
      • Restore VCSA Postgres Database
      • vCenter Forge SAML
      • Waiter Account Information
  • Development
    • Dnsmasq DHCP
    • Docker
      • Ansible AWX
      • Docker Compose
      • FirmAE - Emulate Firmware
      • Oracle WebLogic
      • Rocket.Chat
      • Tomcat
      • Vaultwarden
    • Harden Windows Host
    • HTTPS Proxy
    • Netplan + Networkd
    • SSL/TLS Certificates
  • TODO
Powered by GitBook
On this page
  • 1. Clone repo, install dependencies and build image
  • 2. Setup a postgres container and import database schema
  • 3. Emulate firmware
  • 4. Create tunnel to emulated devices' web interface with socat

Was this helpful?

  1. Development
  2. Docker

FirmAE - Emulate Firmware

Last updated 10 months ago

Was this helpful?

FirmAE is a fully-automated framework that performs emulation and vulnerability analysis. FirmAE significantly increases the emulation success rate (From 's 16.28% to 79.36%) with five arbitration techniques.

Spreadcheet of verified firmware versions:

Below is a short guide on how to emulate the firmware of a TP-Link Wireless Router.

1. Clone repo, install dependencies and build image

void@dev:~$ git clone https://github.com/pr0v3rbs/FirmAE.git
void@dev:~/FirmAE$ ./download.sh
void@dev:~/FirmAE$ ./install.sh
void@dev:~/FirmAE$ reboot (to make sure $USER is member of docker group)
void@dev:~/FirmAE$ ./docker-init.sh
void@dev:~/FirmAE$ sudo apt install python3-coloredlogs -y

2. Setup a postgres container and import database schema

void@dev:~/FirmAE$ service postgresql stop
void@dev:~/FirmAE$ docker pull postgres
void@dev:~/FirmAE$ docker run -itd -e POSTGRES_USER=firmadyne -e POSTGRES_PASSWORD=firmadyne -e POSTGRES_DB=firmware -p 5432:5432 -v /data:/var/lib/postgresql/data --name postgresql postgres
void@dev:~/FirmAE$ PGPASSWORD=firmadyne psql -h localhost -p 5432 -U firmadyne -d firmware < ./database/schema
(optional - verify)
void@dev:~/FirmAE$ PGPASSWORD=firmadyne psql -h localhost -p 5432 -U firmadyne -d firmware

3. Emulate firmware

Check the emulation using the -ec flag, if successfull you can then build/debug it using -ed flag.

void@dev:~/FirmAE/firmwares$ cp /mnt/hgfs/vm-share/Archer_C5400_US__V1_170731.zip .
void@dev:~/FirmAE$ ./docker-helper.py -ec tplink ./firmwares/Archer_C5400_US__V1_170731.zip 
2024-06-10 12:48:24 dev root[24739] INFO [*] docker0_Archer_C5400_US__V1_170731.zip emulation start!
2024-06-10 12:54:08 dev root[24739] INFO [+] docker0_Archer_C5400_US__V1_170731.zip emulation finished. (339.4081s)

void@dev:~/FirmAE$ ./docker-helper.py -ed firmwares/Archer_C5400_US__V1_170731.zip
2024-06-10 12:56:53 dev root[27825] INFO [*] docker0_Archer_C5400_US__V1_170731.zip start!
[*] /work/firmwares/Archer_C5400_US__V1_170731.zip emulation start!!!
[*] extract done!!!
[*] get architecture done!!!
[*] /work/firmwares/Archer_C5400_US__V1_170731.zip already succeed emulation!!!

[IID] 2
[MODE] debug
[+] Network reachable on 192.168.1.1!
[+] Web service on 192.168.1.1
[+] Run debug!
Creating TAP device tap2_0...
Set 'tap2_0' persistent and owned by uid 0
Bringing up TAP device...
Starting emulation of firmware... 192.168.1.1 true true 8.186311590 50.931019008
[*] firmware - Archer_C5400_US__V1_170731
[*] IP - 192.168.1.1
[*] connecting to netcat (192.168.1.1:31337)
[-] failed to connect netcat
------------------------------
|       FirmAE Debugger      |
------------------------------
1. connect to socat
2. connect to shell
3. tcpdump
4. run gdbserver
5. file transfer
6. exit
>

4. Create tunnel to emulated devices' web interface with socat

void@dev:~/FirmAE$ socat TCP-LISTEN:8080,reuseaddr,fork 'EXEC:docker exec -i docker0_Archer_C5400_US__V1_170731.zip "socat STDIO TCP-CONNECT:192.168.1.1:80"' &
[1] 68468

void@dev:~/FirmAE$ ss -plunta
Netid     State      Recv-Q     Send-Q                 Local Address:Port             Peer Address:Port     Process                               
udp       ESTAB      0          0               192.168.101.224%eth0:68              192.168.101.1:67                                             
tcp       LISTEN     0          4096                         0.0.0.0:5432                  0.0.0.0:*                                              
tcp       LISTEN     0          4096                       127.0.0.1:42187                 0.0.0.0:*                                              
tcp       LISTEN     0          4096                            [::]:5432                     [::]:*                                              
tcp       LISTEN     0          5                                  *:8080                        *:*         users:(("socat",pid=67161,fd=5))

void@dev:~/FirmAE$ curl http://localhost:8080
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="refresh" content="0; URL=/webpages/login.html" />
</head>
</html>
Firmadyne
view