5

I want to exploit a specific binary on a embedded device First Part of Examining IP Camera. As this binary won't execute outside the embedded device I'm heading to examine it remotely. It has an SD card slot for storing pictures and videos. I cross compiled dropbear statically for this platform and executed it with success.

For allowing my host to ssh into the target device I have to add the id_rsa key into the ~/.ssh/authorized_keys of the device. As root is mounted completely read only

/mnt/disc1/dropbear_armv5 # touch ~/.ssh
touch: /root/.ssh: Read-only file system

I would like to find a way to specify the location of the keys elsewhere or execute it without using any keys. Knows someone a way of achieving this? In case I misunderstood principles of doing this help would be appreciated too.

On the target

/mnt/disc1/dropbear_armv5 # ./dropbear_static -r dropbear_dss_host_key -r   dropbear_rsa_host_key -B -E
/mnt/disc1/dropbear_armv5 # [27893] Jan 31 22:09:57 Running in background
[28019] Jan 31 22:10:28 Child connection from 192.168.12.1:47398
[28019] Jan 31 22:10:29 Login attempt for nonexistent user from 192.168.12.1:47398
[28019] Jan 31 22:10:29 Login attempt for nonexistent user from 192.168.12.1:47398
[28019] Jan 31 22:10:32 Exit before auth: Exited normally

On the host

# ssh -i ip_cam_rsa r[email protected]                         :(
[email protected]'s password: 

Permission denied, please try again.
Improve this question
2
  • I think dropbear has options to specifiy the directory of the keys. Another technique is to mod the firmware (adding dropbear plus keys), and repackage it. You will need to check if the vendor uses a checksum in their firmware headers, but the tool Binwalk is very helpful.
    – GusGorman402
    Jan 31, 2018 at 20:43
  • @GusGorman402 OpenSSH has these options, but Dropbear doesn't.
    – Gilles 'SO- stop being evil'
    Jan 31, 2018 at 21:37

1 Answer 1

Reset to default
4

Dropbear hard-codes the location ~/.ssh/authorized_keys in its source code, where ~ is the home directory of the target user as read from the user database. If you can't change the user database and can't make the home directory read-write, then you need to modify the source code.

You may be able to make the home directory read-write by mounting a different filesystem over it. That depends what tools are available on the device. For example, maybe you can arrange to mount an in-memory filesystem:

mount -t tmpfs root /root
cp -Rp /somewhere/writable/root/.ssh /root/
dropbear

Or maybe you can make a bind mount:

mount --bind /somewhere/writable/root /root
dropbear
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.