const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/CASE" date="2026-08-17" title="Case: vendor gateway, unused parser fields" lede="Authorized firmware review. Composite of more than one engagement. No vendor named, no exploit shipped. The useful part is the sequence, not the CVE."/>
<P>A manufacturer sent us a gateway image and a letter that named that image. They wanted to know what the box would accept on the local HTTP surface before a retail SKU freeze. They did not want a red-team circus on devices already in the field.</P>
<Callout>Composite: details mixed so this is not a fingerprint of one customer. The sequence is real. The bytes in this note are not theirs.</Callout>
<H2>What we did first</H2>
<P>Hashed the image. unblob. Squashfs. Inventory: busybox, a vendor httpd, dropbear with a default key in a world-readable file, an updater that took a tarball over HTTP with no signature. The default key and the unsigned update were already findings. We still had to answer the parser question.</P>
<H2>The parser</H2>
<P>jadx was irrelevant — this was not Android. Ghidra on httpd. A POST handler copied a JSON body into a struct the decompiler drew as four fields. Access patterns said more: loads at +0x10 and +0x14 that no caller in the web UI ever set. Static guess: extra fields the mobile app had forgotten, or a debug overlay.</P>
<P>Unicorn on that function, fake buffer, offsets touched: 0x00, 0x04, 0x08, 0x10, 0x14. Confirmed. We did not then write a public PoC. We wrote: “the daemon reads two fields the UI never sends. If you ever expose this struct on a less trusted path, those fields are live.” The customer’s own lab client could set them. That was in-scope. The internet was not.</P>
<H2>What left with them</H2>
<Ul items={[
'Filesystem inventory and hashes.',
'Default dropbear key — rotate, do not just chmod.',
'Unsigned update path — sign or stop shipping.',
'Struct note for the HTTP body, confirmed offsets, two unused-but-live fields.',
'What we did not do: no mass scan of deployed units, no exploit module.'
]}/>
<H2>Why this is the case we teach</H2>
<P>The “sexy” finding was not a remote 0-click. It was: unpack honestly, inventory the boring secrets, then confirm the one parser in scope. Tool combination from the <a href="post-firmware.html">firmware note</a> and the <a href="post-re.html">offset oracle</a>. If your vendor report is only a binwalk tree, you stopped at the copy.</P>
<Related items={[
['post-firmware.html','Unpacking firmware'],
['post-re.html','Offset oracle'],
['post-re-stack.html','The reverse-engineering desk']
]}/>
</>;
}
window.Article=Article;
mountPost();