search

banksy-git / lidl-gateway-freedom

Freeing the Silvercrest (Lidl/Tuya) Smart Home Gateway from the cloud.
https://paulbanks.org/projects/lidl-zigbee/
GNU General Public License v3.0
206 stars 66 forks source link

[Request] More information on Gaining initial access to the device using modified SquashFS #12

Closed chaisaeng closed 3 years ago

chaisaeng commented 3 years ago

From the article to Gaining access to the device Quote "3) We replaced the /etc/passwd symlink with a passwd file we created with a known root password." Question: the password file to be put in the unsquashfs filesystem structure, is it need to be format as shardow passwd file or just plain text format like in the old-time linux passwd file. where should it be located in the file system i.e. in root directory and change the symlink to /etc/passwd Quote "6) Finally we TFTP'd the newroot.bin file to the device and used the bootloader command FLW to write it to flash." Can you outline the process to in the Quote (step 6 in the article)
Currently I have a dump of the device from your dump_flash.py and unsquashfs it into my virtualbox debian vm I got the directory contains all the files from the SquashFS dumped. as I'm not very familiar with the process of flashing the device with tftp I need more detail on how to do that on my device. I got device but can not get the root password fron the process you mentioned in the article so the alternative is to reflash it with modified SquashFS flash image to gain initial access to the device. I hope this will also help other that fail to get root password of the device as I am.

Thanks very much.

challs commented 3 years ago

Question: the password file to be put in the unsquashfs filesystem structure, is it need to be format as shardow passwd file or just plain text format like in the old-time linux passwd file. where should it be located in the file system i.e. in root directory and change the symlink to /etc/passwd

It's shadow format. See my forum post for more details (look for the mkpasswd command.

Can you outline the process to in the Quote

See the Upload Image part

chaisaeng commented 3 years ago

Question: the password file to be put in the unsquashfs filesystem structure, is it need to be format as shardow passwd file or just plain text format like in the old-time linux passwd file. where should it be located in the file system i.e. in root directory and change the symlink to /etc/passwd

It's shadow format. See my forum post for more details (look for the mkpasswd command.

Can you outline the process to in the Quote

See the Upload Image part

Thanks, I looked into the forum it look like I have found new hope. BTW for the passwd file you mention it's shadow format which mean in the file if I only having root user then it is only 1 line as followed root:rvE2CYlmZo43R or 2 file with different content below
file: passwd root:x:0:0:root:/root:/bin/bash and file: shardow root:rvE2CYlmZo43R

Thanks very much for pointing me to the information I needed.

challs commented 3 years ago

for the passwd file you mention it's shadow format which mean in the file if I only having root user then it is only 1 line as followed or 2 file with different content below

Sorry, I misread your first question and my answer was confusing.

There is only 1 file ("like in the old-time linux passwd file") There is no shadow password file needed.

chaisaeng commented 3 years ago

This issue was resolved in the forum mentioned by @challs