Promise VTrak M500f - Revision history

Jan: 74 revisions imported

2016-08-26T19:10:43Z

74 revisions imported

← Older revision

Revision as of 21:10, 26 August 2016

2016-08-26T19:09:41Z

1 revision imported

← Older revision

Revision as of 21:09, 26 August 2016

2011-08-05T09:09:16Z

Part 6

← Older revision		Revision as of 11:09, 5 August 2011
Line 249:		Line 249:
	[[Promise VTrak M500f Firmware/part6\|Full contents of Part 6]]		[[Promise VTrak M500f Firmware/part6\|Full contents of Part 6]]

	'''fw''' and '''sw''', this is probably the interesting stuff?		'''fw''' and '''sw''', this is probably the interesting stuff? But where's the /islavista/conf/sw/php.ini?



	=== Fixing Part 3 ===		=== Fixing Part 3 ===

2011-08-04T20:35:57Z

Finding the php.ini

← Older revision		Revision as of 22:35, 4 August 2011
Line 266:		Line 266:
	Bingo!		Bingo!

	=== ~~Finding the php.ini~~ ===		=== The Missing Link ===
	There are a lot of strings throughout the fimware that point at 4 MTD blocks which get mounted into the /islavista/conf, /islavista/fw, /islavista/sw and /oem directories.		There are a lot of strings throughout the fimware that point at 4 MTD blocks which get mounted into the /islavista/conf, /islavista/fw, /islavista/sw and /oem directories.

Line 280:		Line 280:
	The directory /islavista/flash seems to be the upload destination for firmware updates via the webinterface.		The directory /islavista/flash seems to be the upload destination for firmware updates via the webinterface.
	The filesystem in Part 6 gets mounted to /oem.		The filesystem in Part 6 gets mounted to /oem.

			So where do the juicy bits come from? Let's binwalk part1:
			<pre>
			$binwalk -av -x MIPSE part1
			</pre>
			[[Promise VTrak M500f Firmware/part1\|binwalk output]]

			We're still looking for 2 CramFS and 1 JFFS2...

	== Todo ==		== Todo ==

2011-08-04T19:52:52Z

Finding the php.ini

← Older revision		Revision as of 21:52, 4 August 2011
Line 278:		Line 278:
	</pre>		</pre>

	~~What about~~ /islavista/flash?		The directory /islavista/flash seems to be the upload destination for firmware updates via the webinterface.
			The filesystem in Part 6 gets mounted to /oem.

	== Todo ==		== Todo ==

2011-08-04T19:35:14Z

Finding the php.ini

← Older revision		Revision as of 21:35, 4 August 2011
Line 267:		Line 267:

	=== Finding the php.ini ===		=== Finding the php.ini ===
	~~When in doubt~~, ~~use brute force:~~		There are a lot of strings throughout the fimware that point at 4 MTD blocks which get mounted into the /islavista/conf, /islavista/fw, /islavista/sw and /oem directories.

			Finding the contents of those blocks that gets written to the flash is the interesting part...

	<pre>		<pre>
	~~find -type f -~~exec ~~grep "php.ini" {} \;~~		/dev/mtdblock5 /islavista/fw cramfs suid,dev,exec,auto,nouser,async,ro
	~~Binary file .~~/~~part3~~/~~bin~~/~~i2 matches~~		/dev/mtdblock6 /islavista/sw cramfs suid,dev,exec,auto,nouser,async,ro
	~~Binary file .~~/~~part5.ext2 matches~~		/dev/mtdblock2 /islavista/conf jffs2 defaults
	~~Binary file .~~/~~part5~~/~~usr~~/~~bin/thttpd matches~~		/dev/mtdblock7 /oem cramfs suid,dev,exec,auto,nouser,async,ro
	</pre>		</pre>

			What about /islavista/flash?

	== Todo ==		== Todo ==

2011-08-04T18:18:20Z

Firmware

← Older revision		Revision as of 20:18, 4 August 2011
Line 265:		Line 265:
	</pre>		</pre>
	Bingo!		Bingo!

			=== Finding the php.ini ===
			When in doubt, use brute force:
			<pre>
			find -type f -exec grep "php.ini" {} \;
			Binary file ./part3/bin/i2 matches
			Binary file ./part5.ext2 matches
			Binary file ./part5/usr/bin/thttpd matches
			</pre>

	== Todo ==		== Todo ==

2011-08-04T11:13:58Z

Thanks

← Older revision		Revision as of 13:13, 4 August 2011
Line 276:		Line 276:
	== Thanks ==		== Thanks ==
	* Mathis Schmieder for the ''fsck.cramfs'' tip, i was a bit lost when i discovered the errors in Part 3		* Mathis Schmieder for the ''fsck.cramfs'' tip, i was a bit lost when i discovered the errors in Part 3
	* Joris from Promise Technology, he was the one that ~~finally~~ understood what i was trying to tell them all the time.		* Joris from Promise Technology, he was the one that eventually understood what i was trying to tell them all the time


	EOF		EOF

2011-08-04T11:04:04Z

Part 5

← Older revision		Revision as of 13:04, 4 August 2011
Line 229:		Line 229:
	part5: Linux rev 1.0 ext2 filesystem data, UUID=1e4f9d2b-b406-4a38-bbf8-8f1fcf52e5c7		part5: Linux rev 1.0 ext2 filesystem data, UUID=1e4f9d2b-b406-4a38-bbf8-8f1fcf52e5c7
	</pre>		</pre>
			So it's a gzip, but that contains an ext2 partition.
	<pre>		<pre>
	$ mv part5 part5.ext2		$ mv part5 part5.ext2
Line 238:		Line 239:

	BusyBox, libraries, you name it. This must be the base Linux part.		BusyBox, libraries, you name it. This must be the base Linux part.



	==== Part 6 ====		==== Part 6 ====

2011-08-04T11:02:54Z

Privilege Escalation

← Older revision		Revision as of 13:02, 4 August 2011
Line 94:		Line 94:
	You can automate this, too:		You can automate this, too:
	<pre>		<pre>
	while [ true ]; do if `lynx --dump "http://192.168.0.2/" \| grep -q "tmp"`; then echo "EOF" \| mail -s 'Exploit ready!' you@example.com; break; fi; done		$ while [ true ]; do if `lynx --dump "http://192.168.0.2/" \| grep -q "tmp"`; then echo "EOF" \| mail -s 'Exploit ready!' you@example.com; break; fi; done
	</pre>		</pre>



	=== Remote Privilege Escalation, too? ===		=== Remote Privilege Escalation, too? ===