Flashcards
Offensive IoT Exploitation - Firmware
Cards in this deck (59)
- 1What is the tester trying to do in the below screenshot?The trailing single paramater will tell the device to boot in single user mode which will not require authentication.
- 2What are the most popular embedded Linux architectures?Most popular:
- ARM
- MIPS
Other:
- Atmel AVR
- X86
- PowerPCs
- 8051
- SuperH - 3What makes up an embedded device?Bootloader --> Kernel --> File System
- 4What are some popular boot loaders?Das U-Boot
Reboot
Smart Firmware
CFE - 5What is a toolchain?Consists of a number of items:
Binutils
gcc - GNU C Compiler
C library - libc
gdb - GNU Debugger - 6Name 5 filesystem types.SquashFS
CramFS
JFFS2
YAFFS2
ext2 - 7Name 5 common compressions.LZMA
GZip
Zlib
ARJ - 8What is the magic byte for squashfs filesystems?sqsh
- 9What is the magic byte for the zip file format?PK
- 10At what byte does the zip file start?64
- 11This image is the output of `binwalk -E`. What does it tell us about the firmware?The firmware is encrypted as it shows high entropy.
- 12What is XOR?- Outputs true only when the input differ.
- Used in encryption algorithms like AES. - 13What is the potential XOR key based on this image.88 44 a2 d1 68 b4 5a 2d
- 14What options needs to be added to the below command to allow connecting to the process with gdb on port TCP/1234?-g 1234
- 15What tool can you use to decompile a .apk?jadx
- 16What will be the value of r3?0x770c
- 17What are the ARM operating modes?
- 18Which ARM registers are used to hold arguments?r0-r3
- 19Which ARM register points to the top of the stack?r13 (Stack Pointer).
- 20Which ARM register contains the return address when the program goes into a subrouting?r14 (Link Register).
- 21Which ARM register contains the next instruction to be fetched?r15 (Program Counter).
- 22What does the MOV operation do?Moves values to a register.
- 23What does the below command do? `MOV R3, #2`It will move the 2 value into the R3 register.
- 24What does the CMP operation do?Compares two different values by subtracting.
- 25What does the LDR operation do?Loads values from memory to a register. This is necisary since operation commands like ADD, MOV and CMP cannot work directly with memory and can only work with registers.
- 26What will be the value of R3? `LDR R3, [r11, #10]`Whatever is in r11 + 10
- 27What does the STR operation do?Store values from a register to a memory location.
- 28What does the PUSH operation do?To add a data/value (SP decreases).
- 29What does the POP operation do?To remove a data/value (SP increases).
- 30How would I set a breakpoint at the 0x1337 address in GDB?b &0x1337
- 31How would I set a breakpoint at a function in GDB?b function-name
- 32How to fun a specific function in GDB?call some_function()
- 33How would I read 10 places after SP?x/10x $sp
- 34How would I read the contents of the R1 register?x/s $r1
- 35What does this symbol mean and what is its purpose?
- 36What is this hardware component and what is its purpose?
- 37What is this hardware component and what is its purpose?
- 38What is this hardware component and what is its purpose?
- 39What is this hardware component and what is its purpose?
- 40What is this hardware component and what is its purpose?
- 41What is this hardware component and what is its purpose?
- 42Name the 3 types of memory found in IoT devices.
- 43What is UART and what is its purpose?
- 44What is JTAG?
- 45What are JTAG interfaces used for?
- 46Where is JTAG on this board?
- 47What is SDR?
- 48What is GNU Radio?
- 49What is BLE?
- 50How to connect to a specific BLE device on a specific interface with gatttoolgatttool -i -b -I
- 51How to read a value from a characteristic with gatttool?char-read-req
- 52How to write a value to a characteristic with gatttool?char-write-req
- 53hot to listen to bluetooth traffic for a specific device with ubertooth?ubertooth-btle -f -t -c dump.pcap
- 54How can we detect what bluetooth enabled devices are around us?hcitool lescan
- 55What is Zigbee?
- 56What are the 3 types of keys used to secure Ziggbee communications?
- 57What are the Zigbee key distrobution mechanisms?
- 58What are some attack vectors we could use against Zigbee?
- 59What is the below payload?
Information
- Description
- Flashcards on Offensive IoT Exploitation - Firmware, created by Derrie Sutton on 02/11/2020.
- Created by
- Derrie Sutton
- Views
- 21
- Rating