从 Cisco 固件数据 IMG 文件中提取 Web 内容

逆向工程 固件
2021-06-15 21:05:22

我下载固件

https://software.cisco.com/download/home/284973404/type/284971397/release/1.1.4.1

我用 binwalk 提取

sudo apt-get install -y binwalk'
binwalk -eM Sx220-R1.1.4.1.bin
cd _Sx220-R1.1.4.1.bin-0.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/cpio-root

我使用 sqfs.img,想要挂载或解压

查看文件命令

$ file sqfs.img
sqfs.img: data

我试试挂载

$ sudo mount -o loop sqfs.img sqfs
mount: cpio-root/sqfs: wrong fs type, bad option, bad superblock on 
/dev/loop2, missing codepage or helper program, or other error.

见 fdisk -l

$ fdisk -l sqfs.img
Disk sqfs.img: 5 MiB, 5193728 bytes, 10144 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

见分开

$ sudo parted sqfs.img
GNU Parted 3.2
Using cpio-root/sqfs.img
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
Error: cpio-root/sqfs.img: unrecognised disk
label
Model:  (file)
Disk cpio-root/sqfs.img: 5194kB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags:

我读

如何从 .img 文件中提取 N150R 固件

我试试dd

 $ dd if=sqfs.img of=file.squashfs bs=192 skip=1
 27049+1 records in
 27049+1 records out
 5193536 bytes (5.2 MB, 5.0 MiB) copied, 0.0968263 s, 53.6 MB/s

我再次尝试挂载

 $ sudo mount file.squashfs sqfs/
 mount: _Sx220-R1.1.4.1.bin-0.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/cpio-root/sqfs: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or helper program, or other error.

我试试野人

$ sasquatch file.squashfs
SquashFS version [40316.27519] / inode count [-143619237] suggests a SquashFS image of a different endianess
Non-standard SquashFS Magic: ▒<W▒
Reading a different endian SQUASHFS filesystem on file.squashfs
Filesystem on file.squashfs is (31901:32619), which is a later filesystem version than I support!

接下来可以尝试什么?

1个回答

使用binwalk v2.1.2b,解压 cpio 存档后28A000,squashfs-root 文件系统可用作我机器上的目录。

_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted $ ls
5CB1A0.squashfs  CDFB8.squashfs  squashfs-root  squashfs-root-0   <----------------

在这个目录中有名为cgi和 的文件夹cgi-bin,其中包含几个 MIPS Linux ELF32 二进制文件。我想这就是你感兴趣的。

_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/squashfs-root/home/web $ ls
cgi  cgi-bin  css  extHelp  help  home.html  html  images  index.html  js  lang  login.html  logo  mime.types  tmp

_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/squashfs-root/home/web $ ls cgi/
get.cgi  httprestorecfg.cgi  httpuploadbakcfg.cgi  httpuploadlang.cgi  httpuploadruncfg.cgi  login.cgi  set.cgi

请检查您的版本binwalk如果它比 v2.1.2b 旧,您需要卸载旧版本并安装当前版本。

当前版本可以通过首先克隆binwalkgithub 上存储库,然后按照安装说明进行安装

请注意,您可能还需要安装sasquatch.