ファームウェア 1.21 に telnetd(4)

LS-CHL

debian の telnetd を使わせていただくのはあきらめ。
次の手は、、、
debian の BusyBox が使わせていただけないか。。。

パッケージの入手

BusyBox パッケージを入手する

brick:~# apt-get -d --reinstall install busybox
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  busybox
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 324kB of archives.
After this operation, 578kB of additional disk space will be used.
Get:1 http://ftp.jp.debian.org lenny/main busybox 1:1.10.2-2 [324kB]
Fetched 324kB in 0s (354kB/s)
Download complete and in download only mode
brick:~#

パッケージの展開

brick:~# ls /var/cache/apt/archives/
busybox_1%3a1.10.2-2_armel.deb  lock  partial
brick:~# cd /tmp
brick:/tmp# ar xv /var/cache/apt/archives/busybox_1%3a1.10.2-2_armel.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
brick:/tmp# tar zxvf data.tar.gz
./
./usr/
./usr/share/
./usr/share/man/
./usr/share/man/man1/
./usr/share/man/man1/busybox.1.gz
./usr/share/doc/
./usr/share/doc/busybox/
./usr/share/doc/busybox/copyright
./usr/share/doc/busybox/changelog.Debian.gz
./bin/
./bin/busybox
brick:/tmp#

依存関係?

複雑な依存関係がないか?
brick:/tmp# ldd bin/busybox
        libm.so.6 => /lib/libm.so.6 (0x40026000)
        libc.so.6 => /lib/libc.so.6 (0x400d3000)
        /lib/ld-linux.so.3 (0x40000000)
brick:/tmp#
ライブラリはある?
brick:/tmp# mkdir /tmp/root
brick:/tmp# mount /dev/sdb2 /tmp/root
brick:/tmp# cd /tmp/root/
brick:/tmp/root# ls -l lib/libm.so.6
lrwxrwxrwx 1 root root 11 Nov  1  2007 lib/libm.so.6 -> libm-2.5.so
brick:/tmp/root# ls -l lib/libc.so.6
lrwxrwxrwx 1 root root 11 Nov  1  2007 lib/libc.so.6 -> libc-2.5.so
brick:/tmp/root# ls -l lib/ld-linux.so.3
lrwxrwxrwx 1 root root 9 Nov  1  2007 lib/ld-linux.so.3 -> ld-2.5.so
brick:/tmp/root#
あるある。いけそ。

telnetd

ところで、この BusyBox、telnetd あるんやろ名
brick:/tmp/root# bin/busybox --help
BusyBox v1.7.0 (2009-04-29 19:12:57 JST) multi-call binary
Copyright (C) 1998-2006  妥rik Andersen, Rob Landley, and others.
Licensed under GPLv2.  帯ee source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        [, [[, addgroup, adduser, adjtimex, ar, arp, arping, ash,
        awk, basename, bunzip2, bzcat, cal, cat, catv, chattr,
        chgrp, chmod, chown, chpasswd, chpst, chroot, chrt, chvt,
        cksum, clear, cmp, comm, cp, cpio, crond, crontab, cryptpw,
        cut, date, dc, dd, deallocvt, delgroup, deluser, df, dhcprelay,
        diff, dirname, dmesg, dnsd, dos2unix, du, dumpkmap, dumpleases,
        echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake,
        expand, expr, fakeidentd, false, fbset, fdflush, fdformat,
        fdisk, fgrep, find, fold, free, freeramdisk, fsck, fsck.minix,
        ftpget, ftpput, fuser, getopt, getty, grep, gunzip, gzip,
        halt, hdparm, head, hexdump, hostid, hostname, httpd,
        hwclock, id, ifconfig, ifdown, ifup, inetd, init, insmod,
        install, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute,
        iprule, iptunnel, kill, killall, killall5, klogd, last,
        length, less, linux32, linux64, linuxrc, ln, loadfont,
        loadkmap, logger, login, logname, logread, losetup, ls,
        lsattr, lsmod, lzmacat, makedevs, md5sum, mdev, mesg,
        mkdir, mkfifo, mkfs.minix, mknod, mkswap, mktemp, modprobe,
        more, mount, mountpoint, mt, mv, nameif, nc, netstat,
        nice, nmeter, nohup, nslookup, od, openvt, passwd, patch,
        pidof, ping, ping6, pipe_progress, pivot_root, poweroff,
        printenv, printf, ps, pscan, pwd, raidautorun, rdate,
        readahead, readlink, readprofile, realpath, reboot, renice,
        reset, resize, rm, rmdir, rmmod, route, rpm, rpm2cpio,
        run-parts, runlevel, runsv, runsvdir, rx, sed, seq, setarch,
        setconsole, setkeycodes, setlogcons, setsid, setuidgid,
        sh, sha1sum, slattach, sleep, softlimit, sort, split,
        start-stop-daemon, stat, strings, stty, su, sulogin, sum,
        sv, svlogd, swapoff, swapon, switch_root, sync, sysctl,
        syslogd, tail, tar, taskset, tcpsvd, tee, telnet, test,
        tftp, time, top, touch, tr, traceroute, true, tty, ttysize,
        udhcpc, udhcpd, udpsvd, umount, uname, uncompress, unexpand,
        uniq, unix2dos, unlzma, unzip, uptime, usleep, uudecode,
        uuencode, vconfig, vi, vlock, watch, watchdog, wc, wget,
        which, who, whoami, xargs, yes, zcat, zcip

brick:/tmp/root#
ないやん。あかん

いよいよ別のファームから持ってくるかな。



LS-CHL
バッファローダイレクト
楽天市場
Amazon


ファームウェア 1.21 に telnetd(3)
ハックの記録
LinkStation/玄箱 をハックしよう

ファームウェア 1.21 に telnetd(5)busybox のコンパイル

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市