I want to exploit a specific binary on a embedded device First Part of Examining IP Camera. As this binary won't execute outside the embedded device I'm heading to examine it remotely. It has an SD card slot for storing pictures and videos. I cross compiled dropbear statically for this platform and executed it with success.
For allowing my host to ssh into the target device I have to add the id_rsa key into the ~/.ssh/authorized_keys of the device. As root is mounted completely read only
/mnt/disc1/dropbear_armv5 # touch ~/.ssh touch: /root/.ssh: Read-only file system
I would like to find a way to specify the location of the keys elsewhere or execute it without using any keys. Knows someone a way of achieving this? In case I misunderstood principles of doing this help would be appreciated too.
On the target
/mnt/disc1/dropbear_armv5 # ./dropbear_static -r dropbear_dss_host_key -r dropbear_rsa_host_key -B -E /mnt/disc1/dropbear_armv5 #  Jan 31 22:09:57 Running in background  Jan 31 22:10:28 Child connection from 192.168.12.1:47398  Jan 31 22:10:29 Login attempt for nonexistent user from 192.168.12.1:47398  Jan 31 22:10:29 Login attempt for nonexistent user from 192.168.12.1:47398  Jan 31 22:10:32 Exit before auth: Exited normally
On the host
# ssh -i ip_cam_rsa r[email protected] :( [email protected]'s password: Permission denied, please try again.