Can someone compile a program for me with gcc-mips? [closed]

Question

I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically mounts, which I can plug into my PC to add/subtract files. I made a copy of the bash and busybox binaries (including a few others), and gave them u+s, hoping setuid root would give me some root privileges. Unfortunately that did not work. Running bash (-rwsr-xr-x), id still shows up as just user. For some reason it doesn't seem to honor the setuid bit for bash or busybox (or a few others) to give me root privs.

So, I had an idea, which brings me to my question: maybe I could compile a small C program, such as:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
   setuid( 0 );
   system( "/tmp/rootscript.sh" );

   return 0;
}

Which, maybe, would allow me to run a script as root. Unfortunately, after a few days of trying to compile various versions of gcc-mips on various systems, I've not been able to do so. Which leads me to ask if someone who already has the tools built would mind compiling the above code for me. I realize it's an odd request, but I guess it's come to this.

Some potentially helpful info:

bash-3.00$ cat cpuinfo 
system type             : Viper
processor               : 0
cpu model               : MIPS 74Kc V4.12  FPU V0.0
BogoMIPS                : 324.40
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
ASEs implemented        : mips16 dsp
shadow register sets    : 2
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

and

file /tmp/bash 
/tmp/bash: setuid ELF 32-bit LSB  executable, MIPS, MIPS32 rel2 version 1, dynamically linked (uses shared libs), for GNU/Linux 2.6.12, not stripped

Any thoughts or advice from anyone? Hopefully this counts enough as a "reverse engineering" post!

Answer 1

I'm afraid your post won't count as reverse engineering :-(

Anyway, don't expect this to work; your setuid(0) won't work unless the uid is 0 in the first place, in which case you had root access without the extra setuid().

Check the mount options on your drive - is the nosuid option set?

Can you change that setting (hint: mount -o remount)?

You did format the drive with an ext[234] filesystem, didn't you? If it's a [V]fat fs, there's no support for unix attributes.

What exactly does id say? Anything about an euid? Like in

# cp /usr/bin/id /usr/bin/suid
# chmod u+s /usr/bin/suid
# ls -l /usr/bin/suid
-rwsr-xr-x 1 root root 25152 Jul 16 08:42 /usr/bin/suid

$ /usr/bin/id
uid=1000(gbl) gid=100(users) groups=100(users)
$ /usr/bin/suid
uid=1000(gbl) gid=100(users) euid=0(root) groups=100(users)

You see, the special suid-version of id sets your effective uid, not the real one; but if they are different, id should report about it. If it doesn't, the problem is probably your mount options; if it does, chances are your C program would actually work, but in that case, it shouldn't even be neccesary.

If you want a compiler that creates mips binaries, you might also find the Mips-Toolchains page helpful.

Answer 2

Thanks for the thoughts guys. Here's what I came up with in case anyone needs this in the future. I didn't end up compiling my own program (as above), but I got close. I downloaded a large virtual machine file which already had the tools compiled (but it had errors with my program calling setuid). So I went another route: I grabbed the pre-compiled mips binary from https://packages.debian.org/sid/super and copied the binary file setuid onto the box with u+s set, root as owner.

$ id
uid=1001(ftpuser) gid=1001(ftpuser) groups=1001(ftpuser)
$ ./setuid 0 id
uid=0(root) gid=1001(ftpuser) groups=1001(ftpuser)
$ ./setuid 0 bash
bash-3.00# id
uid=0(root) gid=1001(ftpuser) groups=1001(ftpuser)

As they say on TV.. Bingo, bango, bongo.