ファームウェア 1.21 の telnetd

LS-CHL

ファームウェア 1.20 以降 telnetd がなくなっているはず。
確認する。

ハックキットで起動

先日インストールしたハックキットで起動

標準ファームの HDD を USB で接続

標準ファームの HDD を 玄人志向 KRGW-SD1/BK にセットして接続。
chl:~# tail -f /var/log/messages
	:
	:

Sep 20 22:04:49 chl kernel: usb 1-1: new high speed USB device using ehci_marvell and address 2
Sep 20 22:04:49 chl kernel: usb 1-1: configuration #1 chosen from 1 choice
Sep 20 22:04:49 chl kernel: scsi2 : SCSI emulation for USB Mass Storage devices
Sep 20 22:04:54 chl kernel: scsi 2:0:0:0: Direct-Access     ViPowER  VP-89118(SD1)    2.10 PQ: 0 ANSI: 4
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: [sdb] 976773168 512-byte hardware sectors (500108 MB)
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: [sdb] Write Protect is off
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: [sdb] 976773168 512-byte hardware sectors (500108 MB)
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: [sdb] Write Protect is off
Sep 20 22:04:54 chl kernel: sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: [sdb] Attached SCSI disk
Sep 20 22:04:54 chl kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0

マウント

マウントポイントを作り、sdb2 をマウントする
chl:~# mkdir /tmp/root
chl:~# mount /dev/sdb2 /tmp/root/
chl:~#

busybox の確認

chl:~# cd /tmp/root/bin
chl:/tmp/root/bin# ls -l busybox
-rwxr-xr-x 1 root root 810724 May  1 10:40 busybox
chl:/tmp/root/bin# ./busybox --help
BusyBox v1.7.0 (2009-04-29 19:12:57 JST) multi-call binary
Copyright (C) 1998-2006  妥rik Andersen, Rob Landley, and others.
Licensed under GPLv2.  帯ee source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        [, [[, addgroup, adduser, adjtimex, ar, arp, arping, ash,
        awk, basename, bunzip2, bzcat, cal, cat, catv, chattr,
        chgrp, chmod, chown, chpasswd, chpst, chroot, chrt, chvt,
        cksum, clear, cmp, comm, cp, cpio, crond, crontab, cryptpw,
        cut, date, dc, dd, deallocvt, delgroup, deluser, df, dhcprelay,
        diff, dirname, dmesg, dnsd, dos2unix, du, dumpkmap, dumpleases,
        echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake,
        expand, expr, fakeidentd, false, fbset, fdflush, fdformat,
        fdisk, fgrep, find, fold, free, freeramdisk, fsck, fsck.minix,
        ftpget, ftpput, fuser, getopt, getty, grep, gunzip, gzip,
        halt, hdparm, head, hexdump, hostid, hostname, httpd,
        hwclock, id, ifconfig, ifdown, ifup, inetd, init, insmod,
        install, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute,
        iprule, iptunnel, kill, killall, killall5, klogd, last,
        length, less, linux32, linux64, linuxrc, ln, loadfont,
        loadkmap, logger, login, logname, logread, losetup, ls,
        lsattr, lsmod, lzmacat, makedevs, md5sum, mdev, mesg,
        mkdir, mkfifo, mkfs.minix, mknod, mkswap, mktemp, modprobe,
        more, mount, mountpoint, mt, mv, nameif, nc, netstat,
        nice, nmeter, nohup, nslookup, od, openvt, passwd, patch,
        pidof, ping, ping6, pipe_progress, pivot_root, poweroff,
        printenv, printf, ps, pscan, pwd, raidautorun, rdate,
        readahead, readlink, readprofile, realpath, reboot, renice,
        reset, resize, rm, rmdir, rmmod, route, rpm, rpm2cpio,
        run-parts, runlevel, runsv, runsvdir, rx, sed, seq, setarch,
        setconsole, setkeycodes, setlogcons, setsid, setuidgid,
        sh, sha1sum, slattach, sleep, softlimit, sort, split,
        start-stop-daemon, stat, strings, stty, su, sulogin, sum,
        sv, svlogd, swapoff, swapon, switch_root, sync, sysctl,
        syslogd, tail, tar, taskset, tcpsvd, tee, telnet, test,
        tftp, time, top, touch, tr, traceroute, true, tty, ttysize,
        udhcpc, udhcpd, udpsvd, umount, uname, uncompress, unexpand,
        uniq, unix2dos, unlzma, unzip, uptime, usleep, uudecode,
        uuencode, vconfig, vi, vlock, watch, watchdog, wc, wget,
        which, who, whoami, xargs, yes, zcat, zcip

chl:/tmp/root/bin#
やっぱり telnetd はない。

LS-CHL
バッファローダイレクト
楽天市場
Amazon


ファームウェア 1.21 の セキュリティホール
ハックの記録
LinkStation/玄箱 をハックしよう

ファームウェア 1.21 に telnetd

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市