I've got a root shell via UART serial connection to an IP Camera that I've been playing with. Similar device is seen here: https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B
It's got busybox with telnetd, so once I run telnetd, I can get into the box without my serial connection. However, once it restarts, any changed data on the filesystem is lost. (I tried adding telnetd to the /etc/init.d/ files, but after reboot that file is reverted to original.)
My goal, ultimately, is to set this up so that I don't need to keep a serial connection. I'd like to have the telnet server run automatically at start up. Any ideas?
Here is some output from serial at boot:
spl: start
rtcbits_v2: initializing ...
rtcbits: resetflag, 8@0
rtcbits: holdbase, 24@8
rtcbits: batterycap, 8@32
rtcbits: retry_reboot, 8@40
rtcbits: fastboot, 1@48
rtcbits: forceshut, 1@49
rtcbits: sleeping, 1@0
spl: ----------------------------------------
spl: devType:0x4
spl: ----------------------------------------
spl: bdevice_id:0x7
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
MMC: block number 0x8001 exceeds max(0x0)
magic do not match2. 0x7f31d8dc
PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846
board arch is set to: a5pv10
cpu is imapx15
rtcbits: get bits for resetflag: 0x00
boot state(0)
---------------bootst: 0
spl: dramc---DDR V6.0: mDDR support 16:58:51
spl: dramc---
dramc init start
spl: dramc---dram.type found in items, the value is mDDR
spl: dramc---dram.freq found in items, its value is 200
spl: dramc---memory.cl found in items, its value is 3
spl: dramc---dram.count found in items, its value is 1
spl: dramc---dram.width found in items, its value is 32
spl: dramc---dram.capacity found in items, its value is 256
spl: dramc---memory.driver not found in items, use its default value -481465940
spl: dramc---memory.trfc found in items, its value is 64
spl: dramc---memory.tras found in items, its value is 15
spl: dramc---memory.highres not found in items, use its default value 0
spl: dramc---dram.rank_sel 1, dram.count 0, dram.reduce_flag 0
spl: dramc---count width capacity: 0, 3, 5, size 0x100
spl: dramc---rcb: 14 10 2
spl: dramc---ADDR_PHY_PGSR = 0xa
spl: dramc---dramc init succeed and finished
rballoc: 0x1000@0x87808000 allocated for bootstats
rballoc: 0x1000@0x87809000 allocated for devType
spl: dramc---dram.size not found in items, use default value 256
rballoc: 0x1000@0x8780a000 allocated for dramsize
rballoc: 0x1000@0x8780b000 allocated for bootxom
spl: boot item exist: board.disk, flash
PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846
hash_data
i: type (1)
i: signature (0)
rballoc: 0x4000@0x8780c000 allocated for itemrrtb
spl: jump
rballoc: 0x4000@0x◊
U-Boot 2009.08 (Jul 27 2016 - 16:58:07)
Shanghai InfoTM Microelectronics Co., Ltd.
Memory type: DDRII 128 MB
rballoc: 0x1000@0x87814000 allocated for rtcbits
rtcbits_v2: initializing ...
rtcbits: resetflag, 8@0
rtcbits: holdbase, 24@8
rtcbits: batterycap, 8@32
rtcbits: retry_reboot, 8@40
rtcbits: fastboot, 1@48
rtcbits: forceshut, 1@49
rtcbits: sleeping, 1@0
rbget item_mem = 8780c000
IR led is not opened
$$$$$$$$$$$$$$$$$LED ON$$$$$$$$$$$$$$$$$$$$$$$$$
board arch is set to: a5pv10
cpu is imapx15
env_relocate[228] offset = 0x0
*** Warning - bad CRC or NAND, using default environment
Console devices(i/o/e): serial, serial, serial
rtcbits: get bits for resetflag: 0x00
---------------bootst: 0
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
Hit any key to stop autoboot: 0
keys.fastboot not exist
display_logo screenDeviceType:1, burn_status:1, timest:1074
display_logo no for begin, timest:1078
rballoc: 0x1000@0x87815000 allocated for rclk
rballoc: 0x1000@0x87816000 allocated for rfpsx1000
rballoc: 0x1000@0x87817000 allocated for div2
rballoc: shared owner (rclk) 0x1000@0x87815000
rballoc: shared owner (rfpsx1000) 0x1000@0x87816000
rballoc: shared owner (div2) 0x1000@0x87817000
rballoc: 0x1000@0x87818000 allocated for ubootlogo
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
assign device(mmc1) failed (-17)
cmd1 intsts=0x104 err!
Card did not respond to voltage select!
assign device(mmc1) failed (-17)
No media_src for seperate images detected
batt_main()
batt_item_init() run
PMU_NULL
batt_item.batt_v_start = 3450
charger_pwron = 0, charger_enable = 0
PMU isn't AXP202, AXP202_MODE_NULL
CPU IS IMAPX15 NEW V2.1
batt_item_init() end
rtcbits: get bits for resetflag: 0x00
bootst exist: 0
---------------bootst: 0
pmu.model is exist, but not set the pmu supported
only for debug, or system error
begain infotm_check_recovery
keys.recovery not exist
PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333
warning: not spi boot
xom=2
boottype == 0
bootl from NORMAL.
fetch kernel0@0xa0000 ...
PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333
warning: not spi boot
xom=2
3268ms
line:248,bootl->board.disk item_equal flash,is spi
BOOT CMD: bootm 80007fc0
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Imogen-X860-I
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 8753448 Bytes = 8.3 MB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
<snip>
I can't paste the entire kernel boot log here but I'll stick it on pastebin: http://pastebin.com/SurihSLL
Any thoughts on how I can make a permanent file system change? Thanks!
UPDATED BELOW
# cat /proc/mounts
rootfs / rootfs rw,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=91180k,nr_inodes=22795,mode=755 0 0
proc /proc proc rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0
tmpfs /dev/shm tmpfs rw,relatime,mode=777 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
tmpfs /root tmpfs rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/mtdblock5 /mnt/config jffs2 rw,relatime 0 0
and..
# cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00010000 "boot"
mtd1: 00010000 00010000 "oem"
mtd2: 00010000 00010000 "config"
mtd3: 00a00000 00010000 "kernel0"
mtd4: 00a00000 00010000 "kernel1"
mtd5: 00080000 00010000 "jffs"
mtd6: 00ae0000 00010000 "media"
So to answer your question @w-s, yes /etc/init.d is writeable but it doesn't persist beyond reboot. :(
Also.. it does use U-Boot. It even shows this (VERY briefly) at boot up: Hit any key to stop autoboot: 0 (line 83 on pastebin above) but even when I repeatedly mash the any key on my keyboard, it doesn't seem to accept input. I've tried a number of times but same lack of success!
/mnt/config?