UART 103: Device Communication and Shell Access

Objective

In this blog, our objective is to gain shell access to the target device via the UART interface. Once a successful connection is established, we'll explore the device's file system with the aim of locating stored credentials or configuration data. This process is a vital step in hardware analysis, as it can reveal sensitive information or help us better understand how the device operates internally.

Description

Identifying UART pins on a PCB might sound intimidating at first, but it's actually pretty approachable once you know what to look for. One of the most reliable ways to do this is by using a Digital Multimeter (DMM). By measuring voltage levels and checking connectivity at various pinouts on a board, you can usually spot the UART interface.

Steps

1. Connecting UART Pinouts to USB-to-TTL Converter

1. Use jumper wires or breakaway headers to link the USB-to-TTL adapter to the UART pins on the router's PCB.
2. If required, solder the wires or headers to ensure a stable connection.
3. Connect the Tx pin of the USB-to-TTL converter to the Rx pin on the router.
4. Connect the Rx pin of the USB-to-TTL converter to the Tx pin on the router.
5. Connect the GND of the USB-to-TTL converter to the GND pin on the router.

2. Shell Access

1. After establishing the physical UART connections, plug the USB-TTL converter into your laptop's USB port.
2. Identify the connected serial interface, typically available at /dev/ttyUSB0.
3. Power on the device and immediately launch a serial console utility to catch the boot process.
4. Common utilities for serial console access include:
   • picocom
   • screen
5. Use the following command to initiate a session with picocom:

sudo picocom -b <baudrate> -D <device>

Replace <baudrate> (e.g., 115200) and <device> (e.g., /dev/ttyUSB0) accordingly.

3. Baudrate Identification

1. Most devices use a default baudrate of 115200, but this can vary.
2. If you see unreadable or "garbage" data in the terminal, it's likely that the baudrate is incorrect.

3. Once you observe system logs or boot messages, and the terminal responds to commands like ls, it confirms that shell access has been successfully established — assuming your wiring is correct.
4. You can now begin exploring the file system and look for valuable data such as stored credentials.

4. Note on "Sending Discover" Messages

1. If the terminal becomes cluttered with repetitive messages like "sending discover", these are typically generated by background services (e.g., DHCP clients).
2. While they don't prevent shell access, they can be distracting.
3. You may choose to terminate or kill the related processes to maintain a clean working shell.

System Access Achieved

Gaining shell access through UART provides a powerful entry point into the inner workings of embedded devices. From observing boot logs to navigating the file system, this method offers valuable insights and potential access to critical data such as stored credentials. While UART doesn't always guarantee root access, it serves as a solid foundation for further analysis and exploitation.