15:45
I Hacked This Temu Router. What I Found Should Be Illegal.
Low Level
Overview
This video details a security researcher's process of finding critical vulnerabilities in a popular, inexpensive Wi-Fi router purchased from Temu. The researcher demonstrates how to exploit command injection flaws to gain initial access, extract the device's firmware, and then reverse-engineer it to discover further vulnerabilities. The ultimate goal is achieved by uploading and executing a script that provides root-level shell access, highlighting significant security risks in widely distributed low-cost electronics.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- The researcher targets inexpensive embedded devices, known for poor security, starting with a Temu router that is a bestseller.
- An initial test involves injecting a 'reboot' command via a password parameter, exploiting a lack of input sanitization.
- This injection leads to a 'soft brick' by writing the password to NVRAM, causing a loop, but also inadvertently reveals a method to extract firmware.
This chapter demonstrates a common and effective initial exploit technique for embedded devices, showing how seemingly minor vulnerabilities can lead to deeper system compromise.
Injecting '`reboot`' into the password field to trigger a command execution and soft-brick the device.
- Holding the device's reset button for an extended period (60 seconds) triggers a low-level diagnostic web interface.
- This interface, despite its basic appearance, offers a 'firmware backup' option.
- The researcher successfully downloads the entire firmware image ('full.bin') without needing to physically desolder chips, a significant convenience.
Gaining access to the device's firmware is crucial for in-depth security analysis, allowing for offline examination of its software and potential vulnerabilities.
Accessing the diagnostic interface after holding the reset button and using the 'firmware backup' feature to download 'full.bin'.
- The downloaded firmware is analyzed using 'binwalk' to extract its file system, revealing the device's operating environment.
- By observing network requests (e.g., to 'protocol.csp'), the researcher identifies key binaries like 'lighty' (web server) and 'comm' (likely handling web requests).
- The 'comm' binary is further analyzed using a decompiler (Ghidra) to understand how it processes incoming parameters.
Reverse-engineering the firmware allows for the identification of specific software components and potential weaknesses that are not visible through the device's normal interface.
Using 'grep' on the extracted file system to find strings like 'protocol.csp' and 'wizard config', leading to the identification of the 'comm' binary.
- Within the decompiled 'comm' binary, a 'time_comp' function is found that handles time configuration requests.
- This function uses 'sprintf' to write user-supplied time data into a buffer and then executes it as a system command via a 'system' wrapper.
- The lack of input sanitization in this function allows for arbitrary command injection by crafting a specific URL request.
This reveals a critical vulnerability where a seemingly innocuous function for setting the device's time can be abused to execute arbitrary commands on the system.
Sending a crafted 'curl' request to 'protocol.csp' with 'fname=net', 'opt=time_comp', and a malicious 'time' parameter like '`reboot`' to execute commands.
- The researcher first attempts to use 'tnetd' (a network daemon) for a bind shell, but faces issues.
- Investigation reveals a writable '/webs' directory and a CGI script '/webs/cgibin/upload.cgi' used for firmware updates.
- By uploading a script that starts a Telnet server (using 'tnetd' with 'binsh') via the 'upload.cgi' vulnerability, root access is achieved.
This demonstrates the final exploit chain, escalating from basic command execution to full root control of the device, highlighting the severe security implications.
Uploading a script via 'upload.cgi' that enables a Telnet server on port 4444, then connecting via Netcat to gain root access.
Key takeaways
- Inexpensive consumer electronics often have significant security vulnerabilities due to cost-cutting and lack of security focus.
- Command injection is a prevalent vulnerability in embedded devices that lack proper input sanitization.
- Firmware extraction and reverse engineering are powerful techniques for uncovering hidden vulnerabilities.
- Even seemingly harmless functions, like time configuration, can be exploited if they interact with system commands insecurely.
- The ability to upload and execute arbitrary files on a device is a direct path to full system compromise.
- The widespread sale of insecure devices poses a broad risk to users and networks.
- Responsible disclosure is important, but challenging when the manufacturer cannot be identified.
Key terms
Embedded DevicesVulnerability ResearchTemuCommand InjectionInput SanitizationNVRAMSoft BrickFirmwareBinwalkFile System ExtractionGhidraDecompilationsprintfSystem CallCGI ScriptBind ShellTelnetRoot Access
Test your understanding
- What is command injection, and how did the researcher initially exploit it on the Temu router?
- Why is extracting the device's firmware a critical step in security research?
- How did the 'time_comp' function in the router's firmware allow for arbitrary command execution?
- What is the significance of the '/webs/cgibin/upload.cgi' script in the final exploit chain?
- What are the broader security implications of finding such vulnerabilities in popular, low-cost electronic devices?