Hacking ASOS

Hello, Habr! I present to your attention the translation of the article "Breaking Into ASOS" by Michal Necasek.



I love old hardware, and I would like to share with you a curious story of exploring one hard drive from a museum.



The OS / 2 Museum recently acquired a Quantum Bigfoot TS hard drive in excellent condition. Bigfoot discs, if anyone doesn't remember, were rather strange 5.25-inch media popular in the 1990s. They were cheap, rather slow, and large. But unusual in its own way.



There was a sticker on the disc that made it clear that the device was once inside a Compaq machine. After connecting the media to the Linux system, it turned out that the disk is not empty. It was already interesting. However, it later turned out that the contents of the disk were not at all typical for Linux.



After connecting the disk image to the virtual machine, it turned out that the disk is not only bootable, it loads some kind of, to put it mildly, fancy thing that Compaq and SCO once invented. Here's what the boot screen looks like:





Some kind of Microsoft / SCO / Compaq server?



By and large, there is not much to see. Not at all. But after switching the virtual terminal (with the Alt + F2 combination, and who did Linux get this idea from?), It turned out that we have before us a curious mixture of a ready-made OS with some custom settings:





Compaq ASOS configured by SCO OpenServer



As you can see, this is SCO OpenServer Release 5, but with some Compaq modifications. If you do a good search on the net, you will find some details. It turns out the hard drive belongedCompaq Prosignia NeoServer , a fancy network server from the late 1990s. It was a low-power, low-cost Celeron computer with a web server, file server, print server, etc. For some reason, Compaq decided to use it. In truth, the NeoServer was a bit like a shredder or trash can . However, we see the inscription "1999" and "network", so everything should work as it should. Much of NeoServer's functionality relied on the VisionFS product , which was roughly similar to Samba.



The NeoServer line doesn't seem to have been very successful, so it's hard to find documentation. There are tons of dead links. Even archive.org doesn't have a complete Compaq FTP archive. The entire /pub/supportinformation/techpubs/user_reference_guides subtree is not there .



Also, according to one old forum post, NeoServer has been locked, so it is actually impossible to log in as root through the console. So how do you get to OpenServer?



ASOS is configured with a semi-undocumented boot parameter QUIET = YES . This means that there is no way to interrupt the download process. I was unable to find a way to get any single user boot on an OpenServer configured this way.



The obvious alternative would be to connect the disk (image) to Linux ... but this is useless because Linux does not support the OpenServer File System (HTFS). The only remaining option is to use the OpenServer installation disc.



This option doesn't provide an obvious way to access the command line, but we actually have two ways. One of them is pressing the F8 key (not documented) after loading the installer. This brings up the debug screen with the "Shell escape" option:





Magic F8 brings to life the debug installer function



Another option is to add "tools" to the OpenServer installer boot menu, for example:



A little more OpenServer boot magic



After booting, the installer goes to this menu instead of installing the OS:





OpenServer Tools Menu



So, we got to the command line and we can mount the hard disk filesystem using mount/mnt/dev/hd0root. At this stage, it should be possible to run the commandpasswd, with which the root password is reset / deleted. Alas, not everything is so simple. Yes it should work that way and there are instructions on how to reset the root password. However, this doesn't work on ASOS Compaq.



The problem is that /etc/passwd- it's just a symbolic link to /rwroot/etc/passwd. I don't know where it is. The concept of "rwroot" turned out to be quite peculiar to ASOS, as I could not find any links on this topic.



Let's take a look inside the root file system, into the directory /idev. There are /idev/rwroot with minor and major numbers from 1 to 43. If you try mknod /dev/rwroot b 1 43, and then mkdir /rwrootat the end mount /dev/rwroot /rwroot, we will achieve the desired result. And finally open the real /etc/passwdfile in vi:





Here it is, the real ASOS password file



Of course, the real passwords are in the shadow file, but changing what we need is not difficult at all. One reboot ... and it's in the bag! We entered:





ASOS Command Line



This information might even have helped someone 20 years ago. Now, just a way to relieve the research itch.



PS
, root- . , ​​ .. , OpenServer, , Bigfoot. , fdisk divvy, . , Compaq ProSignia NeoServer, 2002 .



Thank you for attention. Source .



All Articles