praetorian-inc / dvrf

The Damn Vulnerable Router Firmware Project

Damn Vulnerable Router Firmware (DVRF) v0.3

Thanks for checking out my project. The goal of this project is to simulate a real world environment to help people learn about other CPU architectures outside of the x86_64 space. This project will also help people get into discovering new things about hardware.

As of now this firmware is tailored for the Linksys E1550 Device. If you do not have one don't worry! There's also QEMU and I encourage end users to experiment with both environments.

Installation

To Install this binary onto your E1550 simply go to the Firmware Upgrade page (http://192.168.1.1/Upgrade.asp) and point the upgrade path to DVRF_v03.bin and click "Upgrade"

Removal || Revert

To revert back to stock simply navigate to the main page of DVRF (http://192.168.1.1/index.asp), Click Browse, Point it to the stock firmware binary, and Click "Upload Firmware"

Getting Started

You don't have to have a E1550 in order to get started. The following link will show you how to get started with DVRF using QEMU to emulate the environment - https://www.praetorian.com/blog/getting-started-with-damn-vulnerable-router-firmware-dvrf-v0.1

Source Code for pwnables

Feel free to take a look at the source code for the pwnables so you can get a better understanding MIPS assembly. Please note that the compiled binaries used gcc flag -O0 to turn off compiler optimizations.

Compiling your own DVRF build

Execute merge_and_compile.sh and if the tar ball was successfully made you can run clean.sh to remove the 00* files. To compile just extract the TAR file and run make.sh and make sure to update toolchain.sh to the path of your toolchain The toolchain is located under ./projects/hnd/tools/linux/hndtools-mipsel-linux-uclibc-4.2.3/bin. Also note that the target linux version is 2.6 so you can either compile it on a 2.6 box like Fedora Core 11 or try compiling with the linux 2.6 headers.

=======

Fixes

• Replaced execve("/bin/sh",0,0) with system("/bin/sh -c")
• Due to "jr RA" I added exit(0) after the system() call to prevent infinite loops.
• Extended buffer size on pwnable challenges that require shellcode.

Notes

• DO NOT HAVE THE WAN PORT PLUGGED IN WHEN INSTALLING OR RUNNING THIS!!!
• UART access is needed in order to execute the pwnable binaries.
• WiFi is disabled, only the ethernet ports are available.
• Encoder pwnable to be released in v04.

-b1ack0wl

dvrf's Issues

About gdb "The program is not being run."

Hello! Thanks for your anwser last time. This time when i enter a lot of 'A' at the stack_bof_01 beside chroot, the (gdb) c shows "The program is not being run." And when i entered (gdb) file, it shows "No executable file now. No symbol file now." What wrong with my gdb lol.

About extract DVRF_v03

Hello! i'm learning about CPU architectures outside of the x86_64 space by your DVRF project. But when the step i used Binwalk to extract DVRF_v03.bin it's become three WARNING says : No such file or directory,"unsquashfs","sasquatch" might not be installed correctly.

Is this normal?

qemu to install DVRF_v03

hello , i am a beginner and i take problem now.
wheater can i install the DVRF_v03 by QEMU ??
for when i binwalk -eM DVRF_v03.bin and there is only a piggy file in the folder, ( i referto the link you given ：https://www.praetorian.com/blog/getting-started-with-damn-vulnerable-router-firmware-dvrf-v0.1） and there is somewhere different

Thankyou

Compilation failure

Hello! For my tasks i want to make this firmware for different platforms. First of all i have got a trouble compiling it using toolchain attached to the project. Here is log file:

DVRF_makefile_output.txt

I've tried using latest Debian OS and Fedora 11 and the problem is the same

sth wrong about my environment

I install almost everything recommended, buildroot, binwalk, gdb-multiarch, pwndbg, pwntools, qemu and maybe something more. And my commands are that:
`ubuntu@ubuntu:~/Desktop/DVRF/_DVRF_v03.bin.extracted/squashfs-root$ ./qemu-mipsel-static -L ./ -g 1234 ./pwnable/Intro/stack_bof_01
Usage: stack_bof_01
-By b1ack0wl

sudo chroot . ./qemu-mipsel-static -g 1234 ./pwnable/Intro/stack_bof_01

ubuntu@ubuntu:~/Desktop/DVRF/_DVRF_v03.bin.extracted/squashfs-root$ gdb-multiarch pwnable/Intro/stack_bof_01
(gdb) set architecture mips
(gdb) target remote 127.0.0.1:1234
(gdb) c
(gdb) disass main
`

The results are:
warning: remote target does not support file transfer, attempting to access files from local filesystem. Reading symbols from /home/ubuntu/Desktop/DVRF/_DVRF_v03.bin.extracted/squashfs-root/lib/ld-uClibc.so.0...(no debugging symbols found)...done. 0x7f7b9a80 in _start () from /home/ubuntu/Desktop/DVRF/_DVRF_v03.bin.extracted/squashfs-root/lib/ld-uClibc.so.0 (gdb) c Continuing. [Inferior 1 (Remote target) exited with code 01]
Actually there is an warning and exited, which means that gdb can not attach the "DVRF" process, and I do not know what to do more. Since the blog is no longer exist, could you please tell me sth about it? Thx very much!

Could you give the exp for the heapoverflow vuln

Could you give the exp for the heapoverflow vuln, I only know it may be exploited by unlink~~

https://github.com/praetorian-inc/DVRF/blob/master/Pwnable%20Source/Intro/heap_overflow_01.c

compilation failure in make_buildroot.sh

https://github.com/b1ack0wl/DVRF

package/xboard/xboard.mk:14: *** missing separator (did you mean TAB instead of 8 spaces?). Stop.

@b1ack0wl