infobyte / cve-2022-27255 Goto Github PK

When using an exploit on Zyxel NBG6615 (V1.00), the device reboot without logging via Telnet, what is the reason?
There is no way to manage Telnet in the web interface, as well as in Tenda AC5.

-Y option is not available in the original binwalk (https://github.com/ReFirmLabs/binwalk)

https://github.com/infobyte/cve-2022-27255/blob/main/analysis/analyse_firmware.py#L16

What version of binwalk were you using?

Hello,

I've used the attached tools for analysing the newest firmware images and it seems that v1 and v2 are ARM based, so probably not vulnerable, because it doesn't use the CPU from Realtek (need confirmation on this claim though). On the readme.md it states that v2 is vulnerable only, which appears to be false.

But the v4 firmware image appears to be MIPS big endian based and vulnerable to the exploit provided.

I would appreciate if you could further test this and if my observations are true change the vulnerable devices list.

I'm watching your presentation on DEFCON, on page 51 you have:

In the post-exploitation stage you can upload any binary files, why would do you this

Using: #define printf ((int(*)(char *, ...)) 0xdeadbeef)