Quick Kindle 3 root shell via USB

[ecostin]

Step 1: Statically compile netcat or similar. For the lazy, download http://rapidshare.com/files/417621092/nk.html
Step 2: Connect your K3 via USB ans copy netcat or the downloaded nk file to the root of the "Kindle" drive
Step 3: Activate the USB networking mode (;debugOn and ~usbNetwork)
Step 4: Configure your USB network link with an IP address from the 192.168.15 C class
Step 5: Type on your Kindle: ~exec /mnt/us/nk -shell -server T,5000 (or similar for netcat); Your K3 stops responding.
Step 6: Telnet from your PC to 192.168.15.244 port 5000

Now you have a root shell and can start customizing the device.

Step 7: To exit without resetting the K3, check your nk / netcat PID with "ps xa" (looking like: 4380 ? S< 0:00 /mnt/us/nk -shell -server T,5000) and kill the process. The K3 now starts responding again.

Good luck

[clarknova]

Wait, you can just run arbitrary code from the search window on the K3? Then, what's everyone's problem with getting in? This is easier than the K2. Could the K2 do this?

[DiapDealer]

I was pretty sure you were limited to typing the commands that show up with `help after the ;debugOn.

Can anyone else verify that random bash commands can be run from the search window of the K3 (like it suggests in the OP's step 5)?

[ecostin]

Originally Posted by DiapDealer

I was pretty sure you were limited to typing the commands that show up with `help after the ;debugOn.

Can anyone else verify that random bash commands can be run from the search window of the K3 (like it suggests in the OP's step 5)?

Actually after ;debugOn, entering ~help lists the commands (not `help) and ~exec is one of them. Maybe amazon has decided to just let us do what we want.

[DiapDealer]

Well that's certainly encouraging.

[clarknova]

Originally Posted by ecostin

Actually after ;debugOn, entering ~help lists the commands (not `help) and ~exec is one of them. Maybe amazon has decided to just let us do what we want.

Just confirmed that this didn't work on K2. Can someone else confirm on K3? If this is the case, the K3 is easier to hack than the K2i and up.

Awesome.

[DiapDealer]

Just confirmed that this didn't work on K2.

Yeah, didn't work on my K2 either, but the ~help command did something--because my home screen changed and displayed numbers in parentheses beside all my titles--just not sure what it's doing.

Potentially great news for K3 users, though!

[odfi]

Originally Posted by clarknova

Can someone else confirm on K3? If this is the case, the K3 is easier to hack than the K2i and up.

Awesome.

On my K3, when I do ;debugOn and then ~help I get a screen with :


Private shortcuts : ~changeLocale, ~disableIndexing, ~disableScreensaver, ~dumpIndexStats, ~exec, ~help, ~indexStatus, ~meminfo, ~reloadContentRoster, ~resumeScreensaver, ~startIndexing, ~stopindexing, ~usbNetwork

I haven't try to use usbNetwork for now.

hope this help.

[blkhawk]

that ~exec is run with root rights is something. I do not think Amazon spend much time or money on securing this device - its basically open and there are tons of ways to getting root. off the top of my head:

1) boot initrd image via serial plug and swap out the password hash in /etc/shadow
2) for some reason said root password hash is only hashed with crypt (sha1). and maybe just "luigi". so it is crackable. Other password hashes in there use md5. this also requires the serial plug.
3) the ~exec method
4) the jtag

common to all these is that no total retar^w^w non-computer savvy person would attempt them. combined with the looming release of the kdk amazon might have decided that locking down isn't really worth it and might even hurt in the long run. I think they plan to get every single person that is able to read a kindle.

[DiapDealer]

Yeah, didn't work on my K2 either, but the ~help command did something--because my home screen changed and displayed numbers in parentheses beside all my titles--just not sure what it's doing.

Never mind my moment of brain-deadedness.

Correct me if I'm wrong, but won't ~exec with root rights allow scripts to be created that can create symlinks (and install the binaries), thereby bypassing the need to create binary update packages for the existing hacks?

I won't complain if they've made that easy, but... wow!

[ecostin]

Originally Posted by DiapDealer

Never mind my moment of brain-deadedness.

Correct me if I'm wrong, but won't ~exec with root rights allow scripts to be created that can create symlinks (and install the binaries), thereby bypassing the need to create binary update packages for the existing hacks?

I won't complain if they've made that easy, but... wow!

Yes, the ~exec function is in fact an interactive shell, but with horrible output, so you'll want to get a remote shell. No need to to any other complicated things, just compile the code, install and use

[DiapDealer]

Yes, the ~exec function is in fact an interactive shell, but with horrible output, so you'll want to get a remote shell.

Agreed. I was just thinking of the non-technical end-users of the existing Screensaver and Fonts hacks. Expecting them to first establish a remote shell to install the screensaver hack would be a bit much. However, typing ";debugOn" followed by a short "~exec ss-install.sh" wouldn't be nearly as hard to create instructions for.

I almost wish I had a K3 to experiment on now.

[Ged_uk]

I can't get my UK K3 to go into usb network, always comes up as disc mode
Probably missed something silly or UK K3 are different?
G

[NiLuJe]

ROFL.

Okay, will try that ASAP...

[porkupan]

Great find (about the ~exec command). Obviously a stupid bug, left-over from firmware debugging. Crrrrrazy stuff! A simple jailbreak script (jb_install.sh) will be something like:

#!/bin/sh
export PATH=/usr/sbin:${PATH}

_FUNCTIONS=/etc/rc.d/functions
[ -f ${_FUNCTIONS} ] && . ${_FUNCTIONS}

mntroot rw

#install key
cat <<EOF > /etc/uks/pubhackkey01.pem
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJn1jWU+xxVv/eRKfCPR9e47lP
WN2rH33z9QbfnqmCxBRLP6mMjGy6APyycQXg3nPi5fcb75alZo+Oh012HpMe9Lnp
eEgloIdm1E4LOsyrz4kttQtGRlzCErmBGt6+cAVEV86y2phOJ3mLk0Ek9UQXbIUf
rvyJnS2MKLG2cczjlQIDAQAB
-----END PUBLIC KEY-----
EOF

mntroot ro

And that's all of it!

The instructions:
1) Copy jb_install.sh into kindle's main storage
2) ;debugOn
3) ~exec /mnt/us/jb_install.sh
4) No reboot needed