30/01/2024
Ever wondered how to binary diff router firmwares to write n-day exploits?
Learn how TheZero and Suidpit combined unblob, binexport, ghidra, Qiling, and an Asus router to write an exploit for CVE-2023-39228.
The outcome was unexpected ...
While attending Silvio Cesare's training at Cyber Saiyan's RomHack TheZero and Suidpit chose to do some practice. While looking at the news they discovered about some recently disclosed ASUS routers unauthenticated RCEs.
They quickly bin-diffed the firmware versions, found the vulnerabilities, emulated the vulnerable firmware, and wrote and exploit for one of them.
This was so fast they had a working exploit even before jumping off the wayback 🚂.
Once at home they used their research budget to buy a real device and prove the vulnerability there too, but ... it was not working 🤯
Know what? The vulnerability was not unauthenticated on the physical device!
After some intense debugging sessions they discovered that not only that one but also a lot of other ASUS routers' vulnerabilities were probably incorrectly deemed as unauthenticated.
Apparently most of the researchers are either keeping an authentication bypass private or they do their research in emulated environments only and no one ever checked the vulnerabilities before issuing the CVE numbers and releasing the advisories.
TL;DR
Product security folks: do not blindly trust the attack requirements shared by the researchers.
Security researchers: when testing embedded devices make sure to mimic correctly all their configurations (i.e. the NVRAM content).
Notes on patch diffing, reverse engineering and exploiting CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240.
