Broken, Abandoned, and Forgotten Code, Part 7

[Zach C <uid000 () gmail com>]

Part 7 is up! We further refine the undocumented firmware header for
the Netgear R6200 SOHO router. A couple of additional checksum and
size fields are added as well as a packed version string field.

http://shadow-file.blogspot.com/2015/06/abandoned-part-07.html

Only 5 bytes in the 58 byte header remain unidentified, which is
sufficient for the web interface to happily accept our custom firmware
image.

Of course we haven't started customizing the contents of the firmware
yet; that will come in a later post. We'll need to generate customized
firmware for use as a payload when exploiting the SetFirmware SOAP
action described in parts 1-4.

If you missed my post to Full Disclosure where I introduced the
series, here's that:
http://seclists.org/fulldisclosure/2015/May/44

As always I welcome feedback via email or Twitter. I'm @zcutlip.

I hope you enjoy it!

Cheers,
Zach

-- 
:wq!

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/