telnet 可能化

root fs のマウント

ude:~# mkdir /tmp/sdb2
mkdir: cannot create directory `/tmp/sdb2': File exists
ude:~# mount /dev/sdb2 /tmp/sdb2
ude:~#

rcS の修正

telnetd の在処の確認

ude:~# cd /tmp/sdb2/
ude:/tmp/sdb2# ls -l usr/sbin/telnetd
lrwxrwxrwx 1 root root 17 Oct 26 19:08 usr/sbin/telnetd -> ../../bin/busybox
ude:/tmp/sdb2#

rcS のバックアップ

ude:/tmp/sdb2# cd etc/init.d/
ude:/tmp/sdb2/etc/init.d# ls
EnablingAutoip.sh    create_devlink.sh  kernelmon.sh    procps.sh          save_config.sh     smb.sh
FanCheckd.sh         cron.sh            logchkd.sh      rcDown             sendsigs.sh        syslog.sh
FreeRamdisk.sh       daemonwatch.sh     logtag          rcS                sethostname.sh     umount_disk.sh
bootcomplete.sh      devpts.sh          modules.sh      reboot.sh          setup_time.sh      update_file.sh
checkroot.sh         fwupdate.sh        mount_share.sh  reboot_start.sh    shutdown_proc.sh   update_ntp.sh
clientUtil_servd.sh  fwupdate_check.sh  networking.sh   restore_config.sh  shutdown_start.sh
ude:/tmp/sdb2/etc/init.d# mv rcS rcS.orig
ude:/tmp/sdb2/etc/init.d# cp rcS.orig rcS
ude:/tmp/sdb2/etc/init.d# ls -l rcS*
-rwxr-xr-x 1 root root 1250 Nov 24 00:27 rcS
-rwxr-xr-x 1 root root 1250 Aug  3 09:17 rcS.orig
ude:/tmp/sdb2/etc/init.d#

telnetd 起動処理の追加

ude:/tmp/sdb2/etc/init.d# vi rcS
	:
	:
ude:/tmp/sdb2/etc/init.d# diff -c rcS.orig rcS
*** rcS.orig    Fri Aug  3 09:17:20 2007
--- rcS Sat Nov 24 00:30:54 2007
***************
*** 70,73 ****
--- 70,75 ----
        exec_sh ${CMD}
  done

+ /usr/sbin/telnetd
+
  exec_sh bootcomplete.sh
ude:/tmp/sdb2/etc/init.d#

root のパスワードをつぶす

修正個所は？

ude:/tmp/sdb2/etc/init.d# cd ..
ude:/tmp/sdb2/etc# cat passwd
root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
halt:x:7:0:halt:/sbin:/sbin/halt
ftp:x:14:50:FTP User:/home:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
admin:x:52:52:Linux User,,,:/home:/bin/sh
sshd:x:74:74:Linux User,,,:/var/empty/sshd:/sbin/nologin
nobody:x:99:99:Linux User,,,:/home:/bin/sh
guest:x:20:21:Linux User,,,:/home:/bin/sh
ude:/tmp/sdb2/etc# cat shadow
root:（暗号化されたパスワード）:11009:0:99999:7:::
bin:*:11009:0:99999:7:::
daemon:*:11009:0:99999:7:::
halt:*:11009:0:99999:7:::
ftp:*:11009:0:99999:7:::
rpc:*:11009:0:99999:7:::
rpcuser:*:11009:0:99999:7:::
apache:*:11009:0:99999:7:::
sshd:!:13241:0:99999:7:::
nobody:!:13148:0:99999:7:::
guest:!:13148:0:99999:7:::

admin:（暗号化されたパスワード）:11009:0:99999:7:::
ude:/tmp/sdb2/etc#

shadow のバックアップ

ude:/tmp/sdb2/etc# mv shadow  shadow.orig
ude:/tmp/sdb2/etc# cp shadow.orig shadow
ude:/tmp/sdb2/etc# ls -l shadow*
-rw-r--r-- 1 root root 371 Nov 24 00:34 shadow
-rw-r--r-- 1 root root 371 Oct 26 10:11 shadow.orig
ude:/tmp/sdb2/etc#

ude:/tmp/sdb2/etc# ls -l /etc/shadow
-r--r----- 1 root shadow 685 Aug 26 21:32 /etc/shadow
ude:/tmp/sdb2/etc#

root のパスワードをつぶす

ude:/tmp/sdb2/etc# vi shadow
	:
	:
ude:/tmp/sdb2/etc# diff -c shadow.orig shadow
*** shadow.orig Fri Oct 26 10:11:10 2007
--- shadow      Sat Nov 24 00:36:08 2007
***************
*** 1,4 ****
! root:（暗号化されたパスワード）:11009:0:99999:7:::
  bin:*:11009:0:99999:7:::
  daemon:*:11009:0:99999:7:::
  halt:*:11009:0:99999:7:::
--- 1,4 ----
! root::11009:0:99999:7:::
  bin:*:11009:0:99999:7:::
  daemon:*:11009:0:99999:7:::
  halt:*:11009:0:99999:7:::
ude:/tmp/sdb2/etc#

アンマウント

ude:/tmp/sdb2/etc# cd /
ude:/# umount /tmp/sdb2
ude:/#

LS-LGL 起動

LS-LGL に telnet

BUFFALO INC. LinkStation series LS-LGL(SUIZEI)
LS-LGLFF7 login: root


BusyBox v1.1.1 (2007.05.08-14:05+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ #

LS-L250GL 楽天市場 Amazon Yahoo! ショッピング Sofmap TSUKUMO ネットショップ ValuMore! ムラウチドットコム uWorks パソＱ