Firmware image required cracking the root password and figuring out the kernel version.

Full writeup:

[https://ctf.rip/write-ups/iot/firmware/wormcon-firm/#firm1](https://ctf.rip/write-ups/iot/firmware/wormcon-firm/#firm1)

Original writeup (https://ctf.rip/write-ups/iot/firmware/wormcon-firm/#firm1).