1

I am working on a router and its firmware is read-only as expected. The busybox they used are trimmed down version of the original tool so i cannot use all the tools necesseray. This router has also a USB port so I thought binding /bin to a usb stick would give me what I want. So used the following commands to bind,

cp -r /bin /mnt/<device-id>/
mount --rbind /mnt/<device-id>/bin /bin

Then I replaced the busybox with a full-fledged version from its repo. I used latest pre-built binary for misp.

Well, as I expected the busybox has all components now, however I cannot telnet from another device, and if I loose the telnet connection I have, I cannot reconnect, and get

$ telnet 192.168.1.1
login:
escape char:
Connection closed by foreign host.

Well there is also the problem of not able to unbind the busybox. When I try to umount it it's busy. It's expected because I am using it as a bash basicaly.

$ umount /bin
umount: /bin: device is busy.

I have no leads. I hope someone can help me.

1 Answer 1

0

I've figured out the problems I am having. So first of all as I mentioned I wasn't able reconnect using telnet. It seems that is because there is a parent process that controls busybox and telnet commands. When I try to create another telnetd process in foreground, I got the following error.

$ telnetd -F
telnetd: bind: Address already in use

What I did is first checked the process that uses port 23 which is default port for telnetd:

$ netstat -lntup | grep 23
tcp        0      0 0.0.0.0:1234           0.0.0.0:*             LISTEN      2697/agent
tcp        0      0 0.0.0.0:23             0.0.0.0:*             LISTEN      362/pc

So binding /binfolder to another location confuses the pc process. As a result it cannot create telnetd sessions and occupies port 23. As this process is resposible for most of the configurations only on boot. Only time I've seen this process id being killed is when the firmware update process starts. Nonetheless, I killed the process and restarted telnetd.

$ kill -9 362
$ telnetd

Now it works, but it's an ugly patch, so i used a different approach. Of course running telnetd is on another port is possible, but I decided not to bind the /bin folder at all.

I decided to add the mount location prior to the path. So every busybox command I ran found in the mounted location. Because first time a command found in PATH that will be executed. So, having multiple busybox in path doesn't hurt. Assuming I have new busybox in /mnt/<device-id>/bin:

$ for i in `./busybox --list`; do ln -s busybox $i; done
$ PATH=/mnt/<device-id>/bin:$PATH

Now all the new busybox commands work as expected. Binding is no longer needed, and system process no longer killed.

As a side note, I did mention in my question post that, I wasn't able to umount /bin folder. Apperently the reason for that was exactly as I thought. Using another busybox instance actually unbinds the /bin folder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .