 |
7200emu.hacki.at
Dynamips, Dynagen and all that stuff
|
 |
|
|
| View previous topic :: View next topic |
| Author |
Message |
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
 Posted: Tue Jun 16, 2009 9:34 am Post subject: Cracking LINA to make ASDM works |
 |
|
Hi there, I'm working on reversing ASA Lina executable to inject the hardware model I want. Here the tutorial, I'll test ASDM and bring you news:
To unpack/repack, see http://ers.msk.ru/cisco/pix7-asa8.html
1) hexedit Lina and find Hardware:, 2nd occurence:
| Code: | | Hardware: %s, %d MB RAM, |
2) Find a string longer than this, in the linux shell, type:
3) Search this string in the hex editor, I'll take "pager_main() - Unable to create the pager initialization thread", so I'm looking for "pager_main", for example
4)Replace this string and end with 0s:
| Code: | | "Hardware: ASA5520, 128 MB RAM, CPU Pentium II 2000 MHz" |
You can let the %s,%d or hard writting it, that what i'll do because otherwise couln't have the CPU name...
Before:
| Code: | | pager_main() - Unable to create the pager initialization.....thread |
After:
| Code: | | Hardware: ASA5520, 128 MB RAM, CPU Pentium II 2000 MHz..................thread |
(Fill the old string with 00 hex, to not change exe structure, and don't forget the ,).
Well, I repacked it and try, but the show ver gave me:
Hardware: ASA5520, 128 RAM, CPU Pentium II 2000 MHzc
Notice the final C... It is due to the CPU Fetch function, so what you have to do, is to go back to the original string in your hex editor:
Notice the string:
Hardware: %s, %d MB RAM, .cpuid.c.CPU %s .%d MHz. reg%d: 0x%x..c....
There are two damned C(after cpuid, and at the end of the line), well, replace it with 00 hex and it's cool.
5) Disassemble lina with IDA Pro (wait the analysis to complete, long time), then click views, open subviews, string, and search(ALT+T) for the string you've written, with the 5520 or whatever you've put, and note the file offset, string address, and offset name. (you may have to select and right click and then select string to convert it to string)
In my case it is:
| Code: |
File offset:0x01280BD8
Adress:0x092C8BD8
Offset name: aHardware5515SD |
then look for the original Hardware: %s, %d... string in the strings window Click on it
Note same infos as above
| Code: | File offset:0x014AFB8F8
Adress:0x094F7BF8
Offset name:aHardware5520DM |
6)Right click on the offset name and click jump to xrefs to operand and click ok. Note the file offset:
0x01024C30
Select aHardware5520DM and go to hex view.
You'll notice:
BB F8 7B 4F 09
That is 094F7BF8 reversed.
Then it's here you have to replace with your address!
So 09 2C 8B D8 would become
D8 8B 2C 09.
Return to your hex editor, go to the file offset 0x01024C30 and write down the new address of your edited string
7)Save the lina executable, and repack the IOS, then launch n prey
| Code: | ciscoasa# sh ver
Cisco Adaptive Security Appliance Software Version 8.0(2)
Compiled on Fri 15-Jun-07 19:29 by builders
System image file is "Unknown, monitor mode tftp booted image"
Config file at boot was "startup-config"
ciscoasa up 3 secs
Hardware: ASA5520, 128 RAM, CPU Pentium II 2000 MHz |
WHOOOHOOO
Let's try ASDM: Work!!!
VM Image here:
http://dl.free.fr/qQK1wuZDn
Last edited by nekkro-kvlt on Tue Jun 16, 2009 12:25 pm; edited 2 times in total |
|
| Back to top |
|
 |
tecka
Joined: 20 Feb 2009
Posts: 15
|
| Posted: Tue Jun 16, 2009 11:28 am Post subject: |
|
|
| Hardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 11:29 am Post subject: |
|
|
Yeah, I juste noticed it, i'll try  |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
|
| Back to top |
|
|
tecka
Joined: 20 Feb 2009
Posts: 15
|
| Posted: Tue Jun 16, 2009 12:42 pm Post subject: |
|
|
| Good work ! |
|
| Back to top |
|
|
signal.quest
Joined: 14 Apr 2007
Posts: 113
|
| Posted: Tue Jun 16, 2009 3:06 pm Post subject: |
|
|
| Any luck doing this with the latest OS? 8.2? |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 3:07 pm Post subject: |
|
|
| didn't even tried, but if it can be unpacked, then it should work |
|
| Back to top |
|
|
signal.quest
Joined: 14 Apr 2007
Posts: 113
|
| Posted: Tue Jun 16, 2009 3:16 pm Post subject: |
|
|
| Can you please try to unpack? Your posts indicate that you have a great understanding. |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 3:18 pm Post subject: |
|
|
| I'll take a look at this |
|
| Back to top |
|
|
tecka
Joined: 20 Feb 2009
Posts: 15
|
| Posted: Tue Jun 16, 2009 3:33 pm Post subject: |
|
|
Hint to unpack
| Code: | D:\IOS\asa>tail -c 15083928 asa821-k8.bin > asa821-k8.gz
D:\IOS\asa>gzip -d asa821-k8.gz
gzip: asa821-k8.gz: decompression OK, trailing garbage ignored
|
|
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 3:42 pm Post subject: |
|
|
Yes, I searched in the file 1F 8B
and found it at 0x122E68 so I did :
| Code: | bastien@bastien-laptop:~/asaemu/82$ perl -e '$x=16275456-0x122E68;print "$x\n"'15083928
bastien@bastien-laptop:~/asaemu/82$ tail -c 15083928 asa821-k8.bin > asa821-k8.gz
bastien@bastien-laptop:~/asaemu/82$ gzip -d asa821-k8.gz
gzip: asa821-k8.gz: decompression OK, trailing garbage ignored
bastien@bastien-laptop:~/asaemu/82$ mkdir uncompressed
bastien@bastien-laptop:~/asaemu/82$ cd uncompressed/
bastien@bastien-laptop:~/asaemu/82/uncompressed$ sudo cpio -id --no-absolute-filenames < ../asa821-k8
[sudo] password for bastien:
cpio: Removing leading `/' from member names
68058 blocks
bastien@bastien-laptop:~/asaemu/82/uncompressed$ ls
asa dev init linuxrc proc sys usr
bin etc lib mnt sbin System.map vmlinuz
bastien@bastien-laptop:~/asaemu/82/uncompressed$ |
Unpacking it is OK, I'll try to launch it with QEmu |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 3:47 pm Post subject: |
|
|
Ok, I just rezipped it with:
Then launching QEmu with this:
| Code: | | qemu -hda ./FLASH -m 256 -kernel ./uncompressed/vmlinuz -initrd ./asa821-k8.gz --no-kqemu -nographic -append "auto console=ttyS0,9600 bigphysarea=16384 ide1=noprobe" |
and it worked but then it crashed:
| Code: |
ype help or '?' for a list of available commands.
ciscoasa>
ciscoasa>
ciscoasa>
ciscoasa>
ciscoasa>
************************************************************
FATAL DEVICE ERROR DETECTED. ERROR CODE: -9
Please copy the following exactly as it appears,
along with any visible version strings, and contact
your support representative.
Cisco Adaptive Security Appliance Software Version 8.2(1)
Compiled on Tue 05-May-09 22:45 by builders
Serial Number:
Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
************************************************************
Process shutdown finished
Rebooting..... |
I don't have any clues on this... |
|
| Back to top |
|
|
signal.quest
Joined: 14 Apr 2007
Posts: 113
|
| Posted: Tue Jun 16, 2009 3:48 pm Post subject: |
|
|
Thanks for the unpack tip! Excellent! Have you tried running it? I will try to run it!
Last edited by signal.quest on Tue Jun 16, 2009 3:49 pm; edited 1 time in total |
|
| Back to top |
|
|
nekkro-kvlt
Joined: 14 Jun 2007
Posts: 76
|
| Posted: Tue Jun 16, 2009 3:49 pm Post subject: |
|
|
| signal.quest wrote: | | Thanks! Excellent! Have you tried running it? I will try to run it! |
See my post, it boot, but then it crash, but I Don't know why at all...
Edit:
open /dev/hda1:No such device or address
dosfsck(/dev/hda1) returned 1
mount: mounting /dev/hda1 on /mnt/disk0 failed: No such device or address
It maybe the hard drive that is failing, I'll try to partition it... If someone know how to do that |
|
| Back to top |
|
|
signal.quest
Joined: 14 Apr 2007
Posts: 113
|
| Posted: Tue Jun 16, 2009 4:10 pm Post subject: |
|
|
| I am trying to update my usb bootable drive with the new unpacked image. I have to refresh my memory on how to copy the unpacked image to the bootable disk w/o messing up the symbolic links... |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
