Exploiting a Stack Buffer Overflow on the Netgear R6700v3 (CVE-2022-27646)

1. Preparation / Setup

1.1 Host System

Install the following dependencies:
- git
- binwalk (https://github.com/ReFirmLabs/binwalk)

Clone the project repository:

git clone https://github.com/pdamian/netgear_r6700v3_circled.git && cd netgear_r6700v3_circled/

Extract the R6700v3 firmware with binwalk:

binwalk -e -M -C firmware/ firmware/R6700v3-V1.0.4.120_10.0.91.zip

Copy the following files to the firmware's root filesystem:

# Variable pointing to the root filesystem
export ROOTFS="$(pwd)/firmware/_R6700v3-V1.0.4.120_10.0.91.zip.extracted/_R6700v3-V1.0.4.120_10.0.91.chk.extracted/squashfs-root"

# Copy pre-built gdbserver binary (or compile your own statically-linked version; arch: armv7-eabihf, libc: uclibc)
cp firmware/bins/gdbserver $ROOTFS/gdbserver

# Copy pre-built libnvram.so library (or compile your own version; arch: armv7-eabihf, libc: uclibc)
cp firmware/bins/libnvram.so $ROOTFS/libnvram.so

# Copy pre-built libcircled.so library (or compile your own version; arch: armv7-eabihf, libc: uclibc)
cp firmware/bins/libcircled.so $ROOTFS/libcircled.so

# Patch out the anti-debugging functionality (allow LDPRELOAD) of the circled binary
python3 firmware/circled.patch.py $ROOTFS/bin/circled $ROOTFS/bin/circled.patched

# Copy circled.sh script (wrapper to emulate binary circled)
cp firmware/circled.sh $ROOTFS/circled.sh

Copy the directories $ROOTFS/ and server/ to an ARMHF guest system (e.g. a QEMU ARMHF Debian VM).

1.2 ARMHF Guest System

In the following, we assume that the variable $ROOTFS points to the copied firmware's root filesystem.
Configure conservative ASLR as being used on the Netgear R6700v3:
```
echo 1 | sudo tee /proc/sys/kernel/randomize_va_spac
```

Chroot into the root filesystem:

sudo mount -t proc /proc/ $ROOTFS/proc/
sudo mount -t sysfs /sys/ $ROOTFS/sys/
sudo mount -o bind /dev/ $ROOTFS/dev/
sudo chroot $ROOTFS/ /bin/sh
export SHELL=/bin/sh

2. Morion Tracing

Use the following steps to trace the binary circled with a proof-of-vulnerability (PoV) payload (as e.g. identified by a fuzzer):

Step	System	Command	Explanation
1	Guest	`python3 server/circled.server.py --payload "pov"`	Start HTTP server delivering proof-of-vulnerability (PoV) payloads
2	Guest (chroot)	`/circled.sh --gdb`	Emulate binary circled with GDB attached (and therefore no ASRL)
3	Host (morion)	`cp circled.init.yaml circled.yaml && gdb-multiarch -q -x circled.trace.gdb`	Collect an execution trace of the binary circled

3. Morion Symbolic Execution

Use the following steps to execute the collected trace symbolically and analyse for potential control flow hijacking vulnerabilities:

Step	System	Command	Explanation
4	Host (morion)	`morion_control_hijacker circled.yaml --disallow_user_inputs`	Symbolically analyse the trace for potential control flow hijacks
5.1	Host (morion)	`morion_control_hijacker circled.yaml --skip_state_analysis`	Symbolically analyse the trace for potential control flow hijacks
5.2	Host (morion)	`quit`	Ignore notification about unrestricted `r11/fp` register
5.3	Host (morion)	`%run -i circled.rop1.py`	Try jump to ROP gadget 1: `0xc9b8: mov r0, r6; bl #0x94a0 <system@plt>`
5.4	Host (morion)	`%run -i circled.rop2.py`	Put argument for function `system@plt`

2. References

Emulating Netgear R6700v3 cicled binary:
Emulating IoT Firmware Made Easy:
- https://boschko.ca/qemu-emulating-firmware/
Defeating the Netgear R6700v3:
- https://www.synacktiv.com/en/publications/pwn2own-austin-2021-defeating-the-netgear-r6700v3.html
Chroot:
- https://wiki.archlinux.org/title/Chroot#Using_chroot
Ready-to-Use Cross-Compilation Toolchains:
- https://toolchains.bootlin.com/
NVRAM Emulator:
- https://github.com/firmadyne/libnvram