<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: exploiting-embedded-device-firmware
description: >-
  Extract, analyze, and exploit firmware from embedded devices including IoT, routers, and industrial controllers to identify backdoors, hardcoded credentials, and code execution vectors.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - firmware
  - iot
  - embedded
  - reverse-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["binwalk", "ghidra", "firmwalker"]
---

# Exploiting Embedded Device Firmware

## Overview

Extract, analyze, and exploit firmware from embedded devices including IoT, routers, and industrial controllers to identify backdoors, hardcoded credentials, and code execution vectors.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `binwalk` | Security tooling |
| `ghidra` | Security tooling |
| `firmwalker` | Security tooling |
| binwalk, Ghidra, firmware extraction tools, UART/JTAG access | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
binwalk -e firmware.bin && firmwalker extracted_fs/
```

## Workflow

### Step 1: Extract Firmware

```bash
binwalk -e firmware.bin && firmwalker extracted_fs/
```

### Step 2: Analyze Binary Components

```bash
node scripts/agent.js analyze --firmware firmware.bin
```

### Step 3: Identify Vulnerabilities

```bash
node scripts/agent.js exploit --firmware firmware.bin --vector command-injection
```

## Detection

```yaml
title: Exploiting Embedded Device Firmware Detection
id: 87c012bf-2b73-4e88-800e-df6f370724f5
status: experimental
description: Detects suspicious activity related to exploiting embedded device firmware techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*embedded*"
  condition: selection
level: critical
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Exploiting Embedded Device Firmware Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- **Verify extraction**: `node scripts/agent.js analyze --firmware firmware.bin`
- **Confirm vulnerability**: `node scripts/agent.js exploit --firmware firmware.bin --vector command-injection`

## References

- MITRE ATT&CK: T1195.002
- Frameworks: MITRE ATT&CK
- Tools: binwalk, ghidra, firmwalker
