ude:~# tail /var/log/messages Dec 27 06:22:29 ude kernel: scsi2 : SCSI emulation for USB Mass Storage devices Dec 27 06:22:34 ude kernel: Vendor: ST310212 Model: A Rev: 0811 Dec 27 06:22:34 ude kernel: Type: Direct-Access ANSI SCSI revision: 00 Dec 27 06:22:34 ude kernel: SCSI device sdb: 20005650 512-byte hdwr sectors (10243 MB) Dec 27 06:22:34 ude kernel: sdb: test WP failed, assume Write Enabled Dec 27 06:22:34 ude kernel: SCSI device sdb: 20005650 512-byte hdwr sectors (10243 MB) Dec 27 06:22:34 ude kernel: sdb: test WP failed, assume Write Enabled Dec 27 06:22:34 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 > Dec 27 06:22:34 ude kernel: sd 2:0:0:0: Attached scsi disk sdb Dec 27 06:22:34 ude kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0 ude:~# mkdir /tmp/boot ude:~# mount /dev/sdb1 /tmp/boot ude:~# ls /tmp/boot conf_save.tgz initrd.buffalo initrd.gz patch.buffalo.zip uImage.buffalo hack initrd.buffalo.orig lost+found u-boot.buffalo uImage.buffalo.orig
ude:~# cd /tmp/boot ude:/tmp/boot# gunzip initrd.gz ude:/tmp/boot# mkdir /tmp/root mkdir: cannot create directory `/tmp/root': File exists ude:/tmp/boot# mount -o loop initrd /tmp/root ude:/tmp/boot#
ude:/tmp/boot# cd /tmp/root/usr/sbin/ ude:/tmp/root/usr/sbin# ls chroot crond inetd telnetd ude:/tmp/root/usr/sbin# pwd /tmp/root/usr/sbin ude:/tmp/root/usr/sbin# ls -l total 0 lrwxrwxrwx 1 root root 17 Nov 13 11:16 chroot -> ../../bin/busybox lrwxrwxrwx 1 root root 17 Nov 13 11:16 crond -> ../../bin/busybox lrwxrwxrwx 1 root root 17 Nov 13 11:16 inetd -> ../../bin/busybox lrwxrwxrwx 1 root root 17 Nov 13 11:16 telnetd -> ../../bin/busybox ude:/tmp/root/usr/sbin#あるやん!
ude:/tmp/root/usr/sbin# cd /tmp/root ude:/tmp/root# vi linuxrc : ude:/tmp/root# diff -c linuxrc.orig linuxrc *** linuxrc.orig Mon Nov 12 15:44:26 2007 --- linuxrc Thu Dec 27 15:32:24 2007 *************** *** 176,181 **** --- 176,182 ---- if [ $? -ne 0 ]; then return 0 fi + touch ${MPT_BOOT}/hack # delete lost+founc rm -rf ${MPT_BOOT}/lost+found/* # *************** *** 251,256 **** --- 252,258 ---- HddRoot() { echo "-HddRoot-" + /usr/sbin/telnetd HasUpdatedFile if [ $? != 0 ]; then echo "** has Updated Files **" ude:/tmp/root#
ude:/tmp/root# cd / ude:/# umount /tmp/root ude:/# cd /tmp/boot ude:/tmp/boot# gzip initrd ude:/tmp/boot# mkimage -A ARM -O Linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 -n initrd -d initrd.gz initrd.buffalo Image Name: initrd Created: Thu Dec 27 15:35:13 2007 Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 1486789 Bytes = 1451.94 kB = 1.42 MB Load Address: 0x00000000 Entry Point: 0x00000000 ude:/tmp/boot# ls -l initrd.buffalo* -rw-r--r-- 1 root root 1486853 Dec 27 15:35 initrd.buffalo -rw-r--r-- 1 root root 1477002 Nov 13 11:16 initrd.buffalo.orig ude:/tmp/boot# cd / ude:/# umount /tmp/boot ude:/#
yasunari@ude:~$ telnet whi Trying 192.168.2.41... Connected to whi.yamasita.jp. Escape character is '^]'. BUFFALO INC. LinkStation series LS-LGL(SUIZEI) LS-LGL-EMFF7 login:EM モードのプロンプトが現れたぁ!
LS-LGL-EMFF7 login: root Password: Login incorrect LS-LGL-EMFF7 login:がー。
|
← 中の様子を探る(2) |
ハックの記録 LinkStation/玄箱 をハックしよう |
→ 中の様子を探る(4)root のパスワードをつぶす |