0

I've got a root shell via UART serial connection to an IP Camera that I've been playing with. Similar device is seen here: https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B

It's got busybox with telnetd, so once I run telnetd, I can get into the box without my serial connection. However, once it restarts, any changed data on the filesystem is lost. (I tried adding telnetd to the /etc/init.d/ files, but after reboot that file is reverted to original.)

My goal, ultimately, is to set this up so that I don't need to keep a serial connection. I'd like to have the telnet server run automatically at start up. Any ideas?

Here is some output from serial at boot:

spl: start
rtcbits_v2: initializing ...
rtcbits: resetflag, 8@0
rtcbits: holdbase, 24@8
rtcbits: batterycap, 8@32
rtcbits: retry_reboot, 8@40
rtcbits: fastboot, 1@48
rtcbits: forceshut, 1@49
rtcbits: sleeping, 1@0
spl: ----------------------------------------
spl: devType:0x4
spl: ----------------------------------------
spl: bdevice_id:0x7
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
MMC: block number 0x8001 exceeds max(0x0)
magic do not match2. 0x7f31d8dc
PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846
board arch is set to: a5pv10
cpu is imapx15
rtcbits: get bits for resetflag: 0x00
boot state(0)
---------------bootst: 0
spl: dramc---DDR V6.0: mDDR support 16:58:51
spl: dramc---
dramc init start
spl: dramc---dram.type found in items, the value is mDDR
spl: dramc---dram.freq found in items, its value is 200
spl: dramc---memory.cl found in items, its value is 3
spl: dramc---dram.count found in items, its value is 1
spl: dramc---dram.width found in items, its value is 32
spl: dramc---dram.capacity found in items, its value is 256
spl: dramc---memory.driver not found in items, use its default value -481465940
spl: dramc---memory.trfc found in items, its value is 64
spl: dramc---memory.tras found in items, its value is 15
spl: dramc---memory.highres not found in items, use its default value 0
spl: dramc---dram.rank_sel 1, dram.count 0, dram.reduce_flag 0
spl: dramc---count width capacity: 0, 3, 5, size 0x100
spl: dramc---rcb: 14 10 2
spl: dramc---ADDR_PHY_PGSR = 0xa
spl: dramc---dramc init succeed and finished
rballoc: 0x1000@0x87808000 allocated for bootstats
rballoc: 0x1000@0x87809000 allocated for devType
spl: dramc---dram.size not found in items, use default value 256
rballoc: 0x1000@0x8780a000 allocated for dramsize
rballoc: 0x1000@0x8780b000 allocated for bootxom
spl: boot item exist: board.disk, flash
PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846
hash_data
i: type (1)
i: signature (0)
rballoc: 0x4000@0x8780c000 allocated for itemrrtb
spl: jump
rballoc: 0x4000@0x◊

U-Boot 2009.08 (Jul 27 2016 - 16:58:07)
Shanghai InfoTM Microelectronics Co., Ltd.

Memory type: DDRII 128 MB
rballoc: 0x1000@0x87814000 allocated for rtcbits
rtcbits_v2: initializing ...
rtcbits: resetflag, 8@0
rtcbits: holdbase, 24@8
rtcbits: batterycap, 8@32
rtcbits: retry_reboot, 8@40
rtcbits: fastboot, 1@48
rtcbits: forceshut, 1@49
rtcbits: sleeping, 1@0
rbget item_mem = 8780c000
IR led is not opened 
$$$$$$$$$$$$$$$$$LED ON$$$$$$$$$$$$$$$$$$$$$$$$$
board arch is set to: a5pv10
cpu is imapx15
env_relocate[228] offset = 0x0
*** Warning - bad CRC or NAND, using default environment

Console devices(i/o/e): serial, serial, serial
rtcbits: get bits for resetflag: 0x00
---------------bootst: 0
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
Hit any key to stop autoboot:  0 
keys.fastboot not exist
 display_logo screenDeviceType:1, burn_status:1, timest:1074
 display_logo no for begin, timest:1078
rballoc: 0x1000@0x87815000 allocated for rclk
rballoc: 0x1000@0x87816000 allocated for rfpsx1000
rballoc: 0x1000@0x87817000 allocated for div2
rballoc: shared owner (rclk) 0x1000@0x87815000
rballoc: shared owner (rfpsx1000) 0x1000@0x87816000
rballoc: shared owner (div2) 0x1000@0x87817000
rballoc: 0x1000@0x87818000 allocated for ubootlogo
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
assign device(mmc1) failed (-17)
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
assign device(mmc1) failed (-17)
No media_src for seperate images detected
batt_main() 
batt_item_init() run 
PMU_NULL 
batt_item.batt_v_start = 3450 
charger_pwron = 0, charger_enable = 0 
PMU isn't AXP202, AXP202_MODE_NULL 
CPU IS IMAPX15 NEW V2.1
batt_item_init() end 
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
pmu.model is exist, but not set the pmu supported
only for debug, or system error
begain infotm_check_recovery
keys.recovery not exist
PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333
warning: not spi boot
xom=2
boottype == 0
bootl from NORMAL.
fetch kernel0@0xa0000 ...
PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333
warning: not spi boot
xom=2
3268ms
line:248,bootl->board.disk item_equal flash,is spi
 BOOT CMD: bootm 80007fc0
## Booting kernel from Legacy Image at 80007fc0 ...
   Image Name:   Imogen-X860-I
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    8753448 Bytes =  8.3 MB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...
<snip>

I can't paste the entire kernel boot log here but I'll stick it on pastebin: http://pastebin.com/SurihSLL

Any thoughts on how I can make a permanent file system change? Thanks!

UPDATED BELOW

# cat  /proc/mounts
rootfs / rootfs rw,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=91180k,nr_inodes=22795,mode=755 0 0
proc /proc proc rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0
tmpfs /dev/shm tmpfs rw,relatime,mode=777 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
tmpfs /root tmpfs rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/mtdblock5 /mnt/config jffs2 rw,relatime 0 0

and..

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00010000 "boot"
mtd1: 00010000 00010000 "oem"
mtd2: 00010000 00010000 "config"
mtd3: 00a00000 00010000 "kernel0"
mtd4: 00a00000 00010000 "kernel1"
mtd5: 00080000 00010000 "jffs"
mtd6: 00ae0000 00010000 "media"

So to answer your question @w-s, yes /etc/init.d is writeable but it doesn't persist beyond reboot. :(

Also.. it does use U-Boot. It even shows this (VERY briefly) at boot up: Hit any key to stop autoboot: 0 (line 83 on pastebin above) but even when I repeatedly mash the any key on my keyboard, it doesn't seem to accept input. I've tried a number of times but same lack of success!

  • Do you have there /proc/mounts and/or /etc/mtab on the file system after system started ? Can you post these files here ? – w s Mar 7 '17 at 6:36
  • Is filesystem with /etc/init.d writable at all after start-up ? – w s Mar 7 '17 at 7:31
  • does it use uBoot or another bootloader? – Igor Skochinsky Mar 7 '17 at 10:43
  • Please see updated question - I answered your questions there because formatting is better. – justin Mar 7 '17 at 14:48
  • what's in /mnt/config? – Igor Skochinsky Mar 8 '17 at 19:36
0

If you can write to the flash, you can try modifying the filesystem to insert necessary hooks there.

Probably the easiest way to do it is to take a firmware update and modify the embedded rootfs.

  • Any further thoughts about which flash settings I might be able to change? – justin Mar 8 '17 at 1:29
  • Igor - I think this is the right way to go about doing this. They released a new firmware, and I have the file downloaded and unpacked. I'd be curious if there are any links you'd recommend I read about RE-packing it so it'll flash correctly. Although I may accept this answer and post a new question since it has tons of new details/etc. – justin Apr 1 '17 at 21:35
  • @justin make a new question and describe your findings. – Igor Skochinsky Apr 1 '17 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.