{"id":623150,"date":"2023-03-29T09:49:20","date_gmt":"2023-03-29T14:49:20","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/03\/29\/establishing-a-uart-root-connection-to-a-tp-link-wireless-router\/"},"modified":"2023-03-29T09:49:20","modified_gmt":"2023-03-29T14:49:20","slug":"establishing-a-uart-root-connection-to-a-tp-link-wireless-router","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/03\/29\/establishing-a-uart-root-connection-to-a-tp-link-wireless-router\/","title":{"rendered":"Establishing a UART Root Connection to a TP-Link Wireless Router"},"content":{"rendered":"
\n

Feb. 16, 2023<\/p>\n

Background<\/h2>\n

Many IoT devices today use a serial communication interface known as the Univeral Asynchronous Receiver Transmitter (UART). The purpose of this interface is to give direct access to the IoT operating system via a command line interface (CLI) for debugging. In many cases, the underlying operating system is just a Unix system, which means backdooring these systems should be (hopefully) very simple.<\/p>\n

I worked on this a while ago but finally was able to get all of the images together and uploaded. I found an unused TP-Link router and thought I\u2019d mess with it a little. I noticed it had a UART connection which gave me an easy root shell. Then I modded the firmware and flashed it onto the device. It was easy enough\u2026 But I may have soft locked it \ud83d\ude1b<\/p>\n

Recon<\/h2>\n

Here is the device in question:<\/p>\n

<\/p>\n

TP-Link Technologies Co., Ltd.<\/em> 300Mbps Wireless N Router WR841NV14<\/strong><\/p>\n

FCCID: TE7WR841NV14<\/strong><\/p>\n

I threw the ID into fccid.io and found its documentation along with internal photographs:<\/p>\n

fcc.id\/TE7WR841NV14<\/a><\/p>\n

I took mine apart and found that the internals were pretty much the same (obviously):<\/p>\n

<\/p>\n

Then I looked around at the various chips and discovered a row of 4 pins which looks to be a UART connection interface! (I soldered on the header pins after I found it)<\/p>\n

<\/p>\n

I grabbed my UART to USB interface adapter and plugged in everything:<\/p>\n

<\/p>\n

Then I opened up PuTTY and connected to COM7 which was the serial device that appeared in the Windows Device Manager:<\/p>\n

<\/p>\n

I set the baud rate to 115200 because the device was relatively new and I figured it would be a good first starting guess. And I was right!<\/p>\n

<\/p>\n

And just like that I had a root shell on the router.<\/p>\n

<\/p>\n

Pilfering<\/h2>\n

After gaining access like a total 1337 h4x0r I took a look at \/etc\/passwd<\/strong><\/p>\n

<\/p>\n

This made it easy enough to throw into hashcat and I came across a pretty funny result:<\/p>\n

<\/p>\n

This will give us SSH access to the router with the user admin<\/strong>, and based off of the running processes, ssh an active service:<\/p>\n

<\/p>\n

Modding the Firmware<\/h2>\n

I wanted to install some sort of backdoor but the filesystem is read-only. So I had to resort to modding the firmware and reflashing it.<\/p>\n

I went to the TP-Link site and downloaded their latest firmware image<\/a><\/p>\n

I downloaded it, unzipped it, and then used firmware-mod-kit<\/a> to extract it. I could have just use binwalk<\/strong> to extract, but doing it this way allowed me to repack it with relative ease.<\/p>\n

<\/p>\n

After making a seemingly minor addition to one of the web files and repacking the firmware, I flashed it onto my device.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

After the router rebooted, I traveled to its IP address and found that my changes were applied successfully! However, the page it now broken and I cannot access any of the routers functions. Sloppy front end development on my part. Hopefully I can fix it soon.<\/p>\n

<\/p>\n

Conclusion<\/h2>\n

Being able to identify certain aspects of SBCs can be very valuable for hardware hacking! This was a great experiment in firmware modding and the UART interface.<\/p>\n<\/p><\/div>\n

Read More<\/a>
\n Qiana Center<\/p>\n","protected":false},"excerpt":{"rendered":"

Feb. 16, 2023 Background Many IoT devices today use a serial communication interface known as the Univeral Asynchronous Receiver Transmitter (UART). The purpose of this interface is to give direct access to the IoT operating system via a command line interface (CLI) for debugging. In many cases, the underlying operating system is just a Unix<\/p>\n","protected":false},"author":1,"featured_media":623151,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27017,114108,46],"tags":[],"class_list":["post-623150","post","type-post","status-publish","format-standard","has-post-thumbnail","category-connection","category-establishing","category-technology"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/623150","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=623150"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/623150\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/623151"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=623150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=623150"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=623150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}