View source for Netgear NTV200-100NAS

__FORCETOC__
{{Disclaimer}}
[[File:NetgearNeoTV.jpg|200px|left|thumb]]
[[Category:Media Players]]
This page will be dedicated to a general overview, descriptions, and information related to the Netgear NTV200-100NAS media player.

== Purchase ==
Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
[http://www.amazon.com/gp/product/B007YW4EQ8/ref=as_li_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B007YW4EQ8&linkCode=as2&tag=exploiteers-20&linkId=AIOKVF6HQHOWDCZI Purchase the Netgear NTV200-100NAS at Amazon]

== UART Pinout ==
<gallery>
File:Ntv200-uart.jpg
</gallery>

== Exploitation ==

After analyzing and  extracting the firmware by way of dumping the NAND flash, we discovered a flaw that allowed for code executing as root. This is a bit more complex than others, but it is still very straightforward to do.

Any of the "apps" on the device (flash applets) are downloaded from this url: http://updates1.netgear.com (yes, it's HTTP)

Using dnsspoof, we can spoof that url to point to a webserver that we control.

On that webserver, create the directory structure outlined below:

<pre>
 /ntv200/us/game/
</pre>

Since we will be using the Texas Hold'em app to gain root, download and place in that folder this file: http://updates1.netgear.com/ntv200/us/game/texas.tar

This is a two step process:
*Step 1
**Place a symlink labeled "hackme" pointing to /
*Step 2
**Drop the actual payload through the symlink

So, we first modify texas.tar - Add a symlink of hackme to / 
Copy that as texas.tar in the directory above, save it, and click the Texas Hold'em app. It will black screen, hit home a few times. Delete the texas.tar, and replace it with the new texas.tar that is created below:

Modify the tar, replace the symlink with a a folder structure: 
<pre>
/hackme/mnt/pstor/ 
</pre>
Add a file in that directory called rcc.user calling telnet

<pre>
FIX---------
telnetd
</pre>
This file is run via bash as root and will persist at every boot. Login using the username root, no password!