Getting root on the Trendtac EPC 700

Intro

Browsing around the userinterface you notice a few things:

• file:/// works in bon-echo. With that you can browse around the filesystem, and upload any file on the system to a webserver. Next to that you will find out that things like telnetd fortunately exist. And of course: the possible block filesystems are everything dos and ext3. And last but not least: the root passwd in /etc/passwd is empty. We are running as root.
• The filemanager itself only allows what's in /etc/vfs.conf .

Looking around etc we see 2 files that are interesting: /etc/init.d/rcS with a telnetd commented out, and inittab. There are some other files that might give a cleaner hook to get us a telnetd. Bon echo can be used to implant a shell script from a usb stick or sd-card if it supported editing the mime-type handlers. (Note: my first "attack" was to try to get bon-echo to start the helpers I wanted. Unfortunately it did not have an external helper config. Somebody else already found that the external helper of the pdf viewer is configurable, hence that solutions is much faster to use.)

Doing it

The EPC 700 will happily mount any ext3 formatted media. However it will start nothing from that media. But we can use ext3 to override the vfs.conf by placing a symlink to /etc on our media:

mkfs.ext3 /dev/sdb1
mount /dev/sdb1 /mnt
ln -s /etc /mnt/etc
umount /mnt

Insert that media (sd card or usb flash, doesn't really matter) into your EPC 700, and browse with your root privileged file browser: . cp the necessary files to your flash to edit. A good place is to cp the /etc/init.d/rcS and uncomment that telnet option. Another options is to cp the /etc/inittab, and add the line:

tty3::askfirst:/sbin/getty 38400 tty3

which will give you a normal login prompt after pressing enter at the third virtual console (ctrl-alt-F3).