iLiad Huge exploit found in 2.7

[scotty1024]

OK I can confirm it works. Thanks for the ZIP's design256!

Notes:
tsh <your iliad ip> /bin/sh

By default it tries to exec bash and can't find it.

Note: design256's tsh source is double gzip'd.

If you need to discover your IP:

#!/bin/sh
sleep 120
/usr/bin/wired.sh start
sleep 5
/sbin/ifconfig >/mnt/card/ifconfig.txt

I updated tsh to have a Mac build option (working!) see attached ZIP (comes with Mac binaries no extra charge.)

And for those that may be confused (as was I) when he says "Quit" he means get out of the profile manager. I pressed the main menu button. If you wait around the profile manager will whack your connection shortly after it comes up.

[scotty1024]

Looks like we have a winner in the "encrypted book format" race:

Found this in /mnt/settings/er_registry.txt
uaIDList=BROWSER;XPDF;APABIMOBI;IMAGEVIEWER;SETUP; PROFILES;EBA

Amazon here we come...

[TadW]

scotty, what makes you think of Amazon?

The list is the same as it was a firmware before.

[scotty1024]

Hmm look what else I found:

/mnt/settings/er_registry.txt
redirectUrl=https://ids.irexnet.com:443/redirector

No need for a frickin' proxy now. And I'm hoping, no need for frickin' https either.

Yeeeeee Haaaawwww!

I hope this works, I was sorely getting tired of hacking x.509 certs with md5 rainbow tables.

[scotty1024]

Originally Posted by TadW

scotty, what makes you think of Amazon?

The list is the same as it was a firmware before.

APABIMOBI;

[TadW]

Originally Posted by scotty1024

redirectUrl=https://ids.irexnet.com:443/redirector

No need for a frickin' proxy now.

You're going to replace redirectUrl with one of your own web addresses?

[TadW]

Originally Posted by scotty1024

APABIMOBI;

APABI is a Chinese e-book format -> http://www.apabi.com/

MOBI might hint at MobiPocket, but it's been there for a long time. It's true though that there were various mentions here before that iRex could be working with MobiPocket to integrate their e-book software.

[scotty1024]

Originally Posted by TadW

APABI is a Chinese e-book format -> http://www.apabi.com/

MOBI might hint at MobiPocket, but it's been there for a long time. It's true though that there were various mentions here before that iRex could be working with MobiPocket to integrate their e-book software.

Yeah, just googled that myself. Let's see, sheepish grin is where???

[scotty1024]

Originally Posted by TadW

You're going to replace redirectUrl with one of your own web addresses?

I've been working an an iDS server written in Java.

This all popped just in time to make for a very interesting weekend.

One feature I appreciate about having your own iDS server? Local time, it feels so good to have your notes show up in the right time zone! Hmm of course I could hack that right now from the command line couldn't I.

[scotty1024]

They have a getty running against ttyS2

/proc # ls -l /dev/ttyS2
crw--w--w- 1 root root 4, 66 Oct 20 16:58 /dev/ttyS2

PID Uid VmSize Stat Command
1 root 524 S init [5]
2 root SW [keventd]
3 root SWN [ksoftirqd_CPU0]
4 root SW [kswapd]
5 root SW [bdflush]
6 root SW [kupdated]
7 root SW [kUCB1x00d]
8 root SW [tffs1]
9 root SW [mtdblockd]
10 root SW [khubd]
234 root 580 S /sbin/cardmgr
252 root 556 S /sbin/klogd -n
324 root 560 S /sbin/syslogd
325 root 564 S /usr/bin/displayMgr -p -w /var/waveform.bin
326 root 524 S /usr/bin/erbusyd
327 root 3848 S /usr/bin/Xfbdev -screen 768x1024x8 -3button -dpi 160
331 root 524 S /usr/bin/erbusyd
332 root 3880 S /usr/bin/matchbox-window-manager -use_titlebar no -us
333 root 5164 S /usr/bin/pageBar
334 root 3760 S /usr/bin/matchbox-panel --size 39 --no-menu --bgcolor
336 root 524 S /usr/bin/erbusyd
478 root 2592 S mb-applet-icon-container
486 root 9456 S /usr/bin/contentLister --sync
487 root 1992 S /usr/bin/powerMgr
491 root 1992 S /usr/bin/powerMgr
492 root 1992 S /usr/bin/powerMgr
494 root 1992 S /usr/bin/powerMgr
535 root 9456 S /usr/bin/contentLister --sync
538 root 9456 S /usr/bin/contentLister --sync
577 root 9456 S /usr/bin/contentLister --sync
657 root 9456 S /usr/bin/contentLister --sync
658 root 9456 S /usr/bin/contentLister --sync
667 root SW [usbplugd]
668 root 404 S msdisk
683 root 512 S /sbin/getty -L ttyS2 115200 vt100
1780 root SW [mmcblockd]
1902 root 568 S udhcpc -n -p /var/run/udhcpc.eth0.pid -t 4 -i eth0
1905 root 96 S /tmp/tshd
1990 root 144 S /tmp/tshd
1991 root 540 S sh -c /bin/sh
1992 root 880 S /bin/sh
2038 root 704 R ps -ex

/proc/tty # cat drivers
serial /dev/cua 5 64-71 serial:callout
serial /dev/ttyS 4 64-71 serial
pty_slave /dev/pts 136 0-255 pty:slave
pty_master /dev/ptm 128 0-255 pty:master
pty_slave /dev/ttyp 3 0-255 pty:slave
pty_master /dev/pty 2 0-255 pty:master
/dev/vc/0 /dev/vc/0 4 0 system:vtmaster
/dev/ptmx /dev/ptmx 5 2 system
/dev/console /dev/console 5 1 system:console
/dev/tty /dev/tty 5 0 system:/dev/tty
unknown /dev/vc/%d 4 1-63 console

/proc/tty/driver # cat serial
serinfo:1.0 driver:5.05c revision:2001-07-08
0: uart:PXA UART port:F8100000 irq:15 baud:19200 tx:4 rx:413822 RTS|CTS|DTR|DSR|CD|RI
1: uart:PXA UART port:F8200000 irq:14 tx:0 rx:0
2: uart:PXA UART port:F8700000 irq:13 baud:115200 tx:93156 rx:0 RTS|DTR

[arivero]

Besides antartica, has anybody downloaded 2.7 today?

[scotty1024]

Ouch, X, contentlister and matchbox are burning up the memory:

327 root 3964 S /usr/bin/Xfbdev -screen 768x1024x8 -3button -dpi 160
331 root 524 S /usr/bin/erbusyd
332 root 3880 S /usr/bin/matchbox-window-manager -use_titlebar no -us
333 root 5296 S /usr/bin/pageBar
334 root 3760 S /usr/bin/matchbox-panel --size 39 --no-menu --bgcolor
336 root 524 S /usr/bin/erbusyd
478 root 2592 S mb-applet-icon-container
486 root 9568 S /usr/bin/contentLister --sync
487 root 1992 S /usr/bin/powerMgr
491 root 1992 S /usr/bin/powerMgr
492 root 1992 S /usr/bin/powerMgr
494 root 1992 S /usr/bin/powerMgr
535 root 9568 S /usr/bin/contentLister --sync
538 root 9568 S /usr/bin/contentLister --sync
577 root 9568 S /usr/bin/contentLister --sync
657 root 9568 S /usr/bin/contentLister --sync
658 root 9568 S /usr/bin/contentLister --sync

Now I think I see why minimo has been so frickin' unstable, after launching there is only 1.4MB of free memory. Much complexity and it'll run out of memory and crash.

With minimo running:

/proc # cat meminfo
total: used: free: shared: buffers: cached:
Mem: 64090112 62640128 1449984 0 2068480 33693696
Swap: 0 0 0
MemTotal: 62588 kB
MemFree: 1416 kB
MemShared: 0 kB
Buffers: 2020 kB
Cached: 32904 kB
SwapCached: 0 kB
Active: 35596 kB
Inactive: 16252 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 62588 kB
LowFree: 1416 kB
SwapTotal: 0 kB
SwapFree: 0 kB

Output from ps for minimo:
2046 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi
2047 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi
2048 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi
2049 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi
2050 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi
2052 root 13784 S /usr/bin/browser /mnt/card/picture/manifest.xml /medi

I wonder why minimo needs 6 processes?

[arivero]

Originally Posted by scotty1024

Output from ps

hmm could you try a ps with information about the parent process of each process, or a pstree if it available? I do not understand why so many copies of the contentlister to start with, I am afraid it could be an artifact of the way we are checking in.

[design256]

Originally Posted by arivero

hmm could you try a ps with information about the parent process of each process, or a pstree if it available? I do not understand why so many copies of the contentlister to start with, I am afraid it could be an artifact of the way we are checking in.

I think they are threads or the 2.4 equivalent - they are all using shared memory. Scotty actually has the 32MB memory marked as cached available for use. Out of 64MB total
assigned this isn't too bad.

[arivero]

Originally Posted by design256

I think they are threads or the 2.4 equivalent - they are all using shared memory. Scotty actually has the 32MB memory marked as cached available for use. Out of 64MB total
assigned this isn't too bad.

vfork then. There is a Warning message in the debug of contentLister:

(CL_E)programManager.c:%d,%s() pmRunViewer: can't fork %s

So guess that this is the way of calling a application, forking contentLister and one of the branches waits for termination, or perhaps even feeds the keyboard input, who knows. But this does not explain the forks in "browser" itself (heavily patched minimo, remember).