Now that the iOS fam have joined hopefully, these guides will help those unfamiliar with RetroArch:

• RetroArch for iOS - BEGINNERS GUIDE -

• How to use Shaders -

• Make your own Shader presets -

• Where do BIOS files go? -

• how to use Cheats -

• Preemptive Frames -

• Change User Interface -

• Adjust Menu Size -

• Touch Screen Overlays -

• Rewind -

• Boxart and Thumbnails -

• Automatically Load Shaders -

• How to Calculate Run-Ahead Frames -

• Fix Screen Tearing -

• HDR -

• Useful Hotkeys -

• Improved Sega Mega Drive Rotation Fix -

• SNES Mode 7 HD -

• Create Views -

• RetroArchievements -

This is a follow up post to a recent project that I've been working on where I am trying to get a root shell on a FULLHAN fh8626 camera. Because of school, I was not able to interact with it but now I was able to get a root shell on this camera.

Binwalk RootFS Extraction

When I ran binwalk on the firmware file I got an xz compressed data and a bunch of other files. After decompressing the data I ran binwalk on it which extracted a cpio archive which contains the root file system.

Password Cracking

I used john the ripper to crack the password hash using the shadow file. Which gave me root123 as the password. Even though I know it was not the password, but I gave it a shot which resulted in login incorrect.

Startup Script Analysis

Since the above password didn't work, I decided to see the rcS script in /etc/init.d/. Which just ran a lot of scripts starting from S01,S02,... in order. But, the S04app script was interesting. It ran an app_init.sh script which was no where to be found in the rootFS.

Boot Log Analysis

I was able to see the boot log using minicom. And in there i found that the system is mounting one squashfs filesystem and two jffs2 filesystems to /app , /app/userdata, /app/res.

SquashFS Analysis

In this file system I was able to see the app_init.sh file alongside with some other files.

SquashFS Modification 1

After that, I came all the way to the end of the app_init.sh script and added some linux commands which shows the contents of the shadow file and repacked the firmware and uploaded it to the camera.

Boot Log Analysis(again)

Now I saw the contents of all shadow files listed in the boot log and the shadow file from /app/userdata/shadow is copied to /etc/shadow and there was also a shadow file in the squashfs file system which is not being bothered by anyone. The shadow file which should be modified is in a jffs2 filesystem.

SquashFS Modification 2

Now, I removed the contents of app_init.sh and replaced it with /bin/sh and repacked it and uploaded it to the camera.

Changing The Password

Now, I used minicom to connect to the camera which showed me a root shell. Even though it's a root shell it's not that useful. So, I went into /app/userdata/ and changed the contents of the shadow file.

New Password Generation

In order to generate a new password I used a binary in the root file system named cryptw which spits out a DES-crypt(UNIX) hash for whatever you enter. In order to do this I chrooted into the filesystem and used qemu-user-static. I also checked the hash by using python crypt function. The first two characters in the "hash" is the salt and the rest is the actual hashed password + salt.

Now, I replaced the contents of app_init.sh back to its original.

Root Shell

After flashing the modded firmware back to the EEPROM. I was able to get a full privileged root shell through telnet using the new password.

Notes

• The crypt function doesn't support python3.7. That's why I used python2.7

• I know that this device is arm(armv6l) based by actually looking at the kernel zImage

• I used ch341a BIOS flasher to conduct all firmware flashing process

• The other jffs2 file system contains audio files which are used to indicate the user about various things

• I could have packed the jffs file system on the computer using mkfs.jffs2 but I just wanted to see and gain some experience by going through the hard route.

• That blue and yellow box just contains an UART to USB adapter

Reference