Thursday, May 28, 2015

Broken, Abandoned, and Forgotten Code, Part 6

›
Note:   It is assumed that the reader is debugging the processes described in this and the next several posts using emulation and IDA Pro. T...
Thursday, May 21, 2015

Broken, Abandoned, and Forgotten Code, Part 5

›
In previous installments I shared proof-of-concept code that would exercise the Netgear R6200's hidden (and badly broken) SetFirmware...
Thursday, May 14, 2015

Broken, Abandoned, and Forgotten Code, Part 4

›
In the last post , I described how upnpd 's sa_parseRcvCmd() function finds the body of a SOAP request and how it parses that SOAP requ...
Thursday, May 07, 2015

Broken, Abandoned, and Forgotten Code, Part 3

›
In the previous posts , I talked about the hidden "SetFirmware" SOAP action in the Netgear R6200's UPnP daemon, and the weird...
Thursday, April 30, 2015

Broken, Abandoned, and Forgotten Code, Part 2

›
In the part 1 , I showed how the Netgear R6200's upnpd binary contains what appears to be a hidden SOAP action related to the string ...
Thursday, April 23, 2015

Broken, Abandoned, and Forgotten Code, Part 1

›
Introduction This series of posts describes how abandoned, partially implemented functionality can be exploited to gain complete, persiste...
Wednesday, April 22, 2015

Broken, Abandoned, and Forgotten Code: Prologue

›
A Secret Passage to Persistant SOHO Router Pwnage Almost two years ago plus a house selling, a cross-country move, a house buying, a job...
Friday, February 20, 2015

Bowcaster Feature: multipart/form-data

›
Need to reverse engineer or exploit a file upload vulnerability in an embedded web server? I added a multipart/form-data class to Bowcaster...