iLiad Huge exploit found in 2.7 - Page 5

scotty1024 · 10-20-2006, 06:58 PM

Quote:

Originally Posted by arivero

hmm could you try a ps with information about the parent process of each process, or a pstree if it available? I do not understand why so many copies of the contentlister to start with, I am afraid it could be an artifact of the way we are checking in.

I'll have to build a better ps.

Mike Kostousov · 10-20-2006, 07:33 PM

I think, it is possible to use swap.
Somthing like that:

Code:

#!/bin/sh
dd if=/dev/null of=/mnt/card/.swapfile bs=1024 count=64K
mkswap /mnt/card/.swapfile
swapon /mnt/card/.swapfile

But, don't try to take out mmc card without "swapoff /mnt/card/.swapfile"

I also get dropbear worked. With public key it does connection to iliad more secure

And it is possible to copy with scp. And navigate with konqueror via "fish://root@iliad_ip", but
fuser doesn't work with dropbear.

a.sh

Code:

#!/bin/sh
mkdir /home/root/.ssh
cp /opt/content/books/id_rsa.pub  /home/root/.ssh/authorized_keys
cp /opt/content/books/dr.sh /tmp
cp /opt/content/books/dropbear /tmp
cp /opt/content/books/dropbearkey /tmp

chmod 755 /tmp/dr.sh
chmod 755 /tmp/dropbear
chmod 755 /tmp/dropbearkey

if [ ! -e dropbear_dss_host_key ];then
/tmp/dropbearkey -t dss -f /opt/content/books/dropbear_dss_host_key
fi
if [ ! -e dropbear_rsa_host_key ];then
/tmp/dropbearkey -t rsa -f /opt/content/books/dropbear_rsa_host_key
fi
cp /opt/content/books/dropbear_dss_host_key /tmp
cp /opt/content/books/dropbear_rsa_host_key /tmp
sh /tmp/dr.sh &

dr.sh

Code:

#!/bin/sh
sleep 30
/usr/bin/wired.sh start dhcp
sleep 5
/tmp/dropbear -d /tmp/dropbear_dss_host_key -r /tmp/dropbear_rsa_host_key

id_rsa.pub - your public key.

scotty1024 · 10-21-2006, 02:30 AM

Setting up a Zaurus cross compiler on Mac oS X page: http://www.lucid-cake.net/osx_arm/index_en.html

k2r · 10-21-2006, 07:47 AM

Great, thanks!

arivero · 10-21-2006, 09:56 AM

On a different note, Readers have got script execution this morning, via a bold reflash of the entire filesystem (they use cramfs and they can not penmanently modify a single file, they need to download the old fs, modify offline, and reflash it).

Their other disadventage is that they have not got X, so they need each application to access directly to the framebuffer or to speak with a controller application not in the open source tree. So they will still need some reverse engineering work.

scotty1024 · 10-21-2006, 12:59 PM

I can now verify that the instructions for building a Mac OS X cross compiler creates a cross compiler that compiles code that works on the iLiad Version 2.7.

My next step is to get to where I can compile X apps.

I've always wanted a calculator on my iLiad.

arivero · 10-21-2006, 02:47 PM

Quote:

Originally Posted by scotty1024

I've always wanted a calculator on my iLiad.

The main problem is that, lacking SDK specs or ReverseEngineering, the only tool to update the screen is a command line tool, and it does a complete update with all the flash to white and black. No funny for each keypress.

scotty1024 · 10-21-2006, 03:40 PM

I know, there has to be some event that needs to be triggered to cause an update.

I figure the path to an SDK has several things to be knocked over, one by one.

Right now I'm working on compiling an X11 app.

Next, I'll run it.

If it doesn't update, then I'll find the update trigger I need to embed.

This thing is 95% open source and the other 5% is built with open source. Nothing is going to stand in our way for long.

scotty1024 · 10-21-2006, 04:49 PM

Quote:

Originally Posted by Mike Kostousov

I also get dropbear worked. With public key it does connection to iliad more secure

And it is possible to copy with scp.

I can confirm this works for me, thank you for your excellent work!

scotty1024 · 10-21-2006, 04:55 PM

Anyone else notice this in root's start.sh?

Code:

# Temporary fix to show the WiFi mac address to the user
if [ ! -e /mnt/free/wlan_mac.txt ]
then
    echo "WiFi card MAC address:" > /mnt/free/wlan_mac.txt
    ifconfig wlan0 | awk '$4 ~ /HWaddr/ { mac = $5; gsub(/:/, "-", mac); print mac }' >> /mnt/free/wlan_mac.txt
fi

When I inspect the file:

Code:

root@ereader:~# cat /mnt/free/wlan_mac.txt 
WiFi card MAC address:

I guess I have my first iRex bug to fix.

arivero · 10-21-2006, 06:58 PM

Quote:

Originally Posted by Mike Kostousov

I also get dropbear worked. With public key

YESSS!!! I am in! I mean, I have now the Nokia 770 and the iLiad linked via an Ad-Hoc wireless connection, and I can enter with dropbear as you suggested!

The AdHoc is straightforward but wired.sh does not provide it. So instead of your simple

Code:

#!/bin/sh
sleep 30
/usr/bin/wired.sh start dhcp
sleep 5
/tmp/dropbear -d /tmp/dropbear_dss_host_key -r /tmp/dropbear_rsa_host_key

... I am forced to use a full launch

Code:

#!/bin/sh
sleep 50
ethIf=wlan0
ethDrv=cf8385
ethDrv2=cfio
address=10.1.1.2
netmask=255.0.0.0
modprobe $ethDrv 2>/dev/null
iwconfig $ethIf mode Ad-Hoc
iwconfig $ethIf essid "iLiad"
ifconfig $ethIf > /dev/null
ifconfig $ethIf up address $address netmask $netmask
route add default gw 10.0.0.60
sleep 3
echo `date` > /opt/content/books/dbdate.txt
iwconfig > /opt/content/books/iwconfig.txt
ifconfig > /opt/content/books/ifconfig.txt
route > /opt/content/books/routes.txt
sleep 5
/tmp/dropbear -d /tmp/dropbear_dss_host_key -r /tmp/dropbear_rsa_host_key

Note I have put a delay of 50 seconds. This is because I need time to abort the "searching" well before starting to bring up the wireless interface. So I press the button, I abort after 10 seconds going to the main menu of the iLiad, I wait the other 40 seconds, and I can connect. In the Nokia it is even easier, just create an adhoc connection using the menus, and specifying the same netmask blablablah... I am starting the Nokia before the iLiad, so I can check that iwconfig.txt gets to hang from the same cell.

The Xwindows access is also fine. I have gnuplot in the nokia, so I do export DISPLAY=10.1.1.2:0; gnuplot and then for instance plot sin(x) and yes, it appears (with manual updating of the screen, well). Fine. I am going to get LaTex in the Nokia and I can see the output in the iLiad.

AdHoc is a great thing because you do not need to rely in a common AccessPoint. Plus, the iLiad has ethernet (the Nokia hasnot) and the Nokia has bluetooth (iLiad not), so it is sort of synergetic, and same with the memory cards.

scotty1024 · 10-22-2006, 01:43 AM

Wow, it's like a real Unix or something.

Code:

root@ereader:/media/card# ls

Broadcast message from root (Sun Oct 22 05:40:35 2006):

The system is going down for system halt NOW!
Connection to 10.0.1.3 closed by remote host.
Connection to 10.0.1.3 closed.

Results of sliding the power switch in the middle of a session.

BTW don't be cd'd to /mnt/card and pull the card out, I knew better but in the excitement, I forgot.

Antartica · 10-22-2006, 06:42 AM

Quote:

Originally Posted by design256

eeek. that was quick

guess we'll have to keep working on an IDS-based exploit. I wonder if they also closed off the Xserver?

Sorry, it seems that it was my fault (the only explanation I can find is that the four times I tried it i must have misspelled somethibg). I've tried It today after sleeping something more reasonable that the other day and it still works. Phew!

Antartica · 10-22-2006, 06:44 AM

Quote:

Originally Posted by TadW

As far as I can tell 2.7 is unchanged since its initial release.

Yep. it is unchanged. I've compaed the wireless.sh and they're identical. My fault...

arivero · 10-22-2006, 09:01 AM

I am afraid this could be a kind of bug:

Code:

cp /opt/content/books/id_rsa.pub  /home/root/.ssh/authorized_keys

Meaning, that if the filesystem does not remove the previous file, we are wasting 4Kbytes of storage space each time we activate the dropbear. If it is so, one should remove that line after gaining access, or at least to use a conditional if [ ! -e ... ];then instead. I'd suggest the former.

10-22-2006, 01:43 AM	#72
scotty1024 Banned Posts: 1,300 Karma: 1479 Join Date: Jul 2006 Location: Peoples Republic of Washington Device: Reader / iPhone / Librie / Kindle	Wow, it's like a real Unix or something. Code: root@ereader:/media/card# ls Broadcast message from root (Sun Oct 22 05:40:35 2006): The system is going down for system halt NOW! Connection to 10.0.1.3 closed by remote host. Connection to 10.0.1.3 closed. Results of sliding the power switch in the middle of a session. BTW don't be cd'd to /mnt/card and pull the card out, I knew better but in the excitement, I forgot.

10-22-2006, 09:01 AM	#75
arivero Guru Posts: 607 Karma: 2157 Join Date: Oct 2005 Device: NCR3125, Nokia 770,...	journaling fs? I am afraid this could be a kind of bug: Code: cp /opt/content/books/id_rsa.pub /home/root/.ssh/authorized_keys Meaning, that if the filesystem does not remove the previous file, we are wasting 4Kbytes of storage space each time we activate the dropbear. If it is so, one should remove that line after gaining access, or at least to use a conditional if [ ! -e ... ];then instead. I'd suggest the former.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
A Huge Thank You	BurBunny	Amazon Kindle	4	02-27-2009 01:36 PM
Adobe Reader 9 new exploit in the wild	doctorow	News	2	02-20-2009 03:38 PM
Cybook not found in linux, found in win XP	fjf	Bookeen	15	01-18-2008 06:57 PM
Adobe Acrobat subject to remote exploit	Alexander Turcic	News	3	09-16-2006 05:29 AM
Serious exploit in Greasemonkey 0.4	Alexander Turcic	Lounge	2	07-19-2005 04:59 AM

10-21-2006, 02:30 AM	#63
scotty1024 Banned Posts: 1,300 Karma: 1479 Join Date: Jul 2006 Location: Peoples Republic of Washington Device: Reader / iPhone / Librie / Kindle	Setting up a Zaurus cross compiler on Mac oS X page: http://www.lucid-cake.net/osx_arm/index_en.html

10-21-2006, 07:47 AM	#64
k2r Zealot Posts: 124 Karma: 177 Join Date: Jul 2006 Location: Bochum, Germany Device: MP2K, iLiad	Great, thanks!

10-21-2006, 09:56 AM	#65
arivero Guru Posts: 607 Karma: 2157 Join Date: Oct 2005 Device: NCR3125, Nokia 770,...	On a different note, Readers have got script execution this morning, via a bold reflash of the entire filesystem (they use cramfs and they can not penmanently modify a single file, they need to download the old fs, modify offline, and reflash it). Their other disadventage is that they have not got X, so they need each application to access directly to the framebuffer or to speak with a controller application not in the open source tree. So they will still need some reverse engineering work.

10-21-2006, 12:59 PM	#66
scotty1024 Banned Posts: 1,300 Karma: 1479 Join Date: Jul 2006 Location: Peoples Republic of Washington Device: Reader / iPhone / Librie / Kindle	I can now verify that the instructions for building a Mac OS X cross compiler creates a cross compiler that compiles code that works on the iLiad Version 2.7. My next step is to get to where I can compile X apps. I've always wanted a calculator on my iLiad.

10-21-2006, 03:40 PM	#68
scotty1024 Banned Posts: 1,300 Karma: 1479 Join Date: Jul 2006 Location: Peoples Republic of Washington Device: Reader / iPhone / Librie / Kindle	I know, there has to be some event that needs to be triggered to cause an update. I figure the path to an SDK has several things to be knocked over, one by one. Right now I'm working on compiling an X11 app. Next, I'll run it. If it doesn't update, then I'll find the update trigger I need to embed. This thing is 95% open source and the other 5% is built with open source. Nothing is going to stand in our way for long.

Advert

Advert