解析海蜘蛛软路由破解教程-全过程
解析海蜘蛛软路由破解教程-全过程 Posted by: admin in 未分类
破解过程记录
使用gentoo的livecd启动系统
1 查看系统磁盘状态
livecd ~ # cat /proc/partitions
major minor #blocks name
7 0 55328 loop0
3 0 8388608 hda
3 1 250393 hda1
2 继续查看磁盘状态
cfdisk (util-linux-ng 2.13.1.1) Disk Drive: /dev/hda Size: 8589934592 bytes, 8589 MB Heads: 15 Sectors per Track: 63 Cylinders: 17753
Name Flags Part Type FS
Type [Label] Size (MB)
—————————————————————————————— hda1 Boot Primary Linux
ext3 256.44
Pri/Log Free Space 8333.18
3 对hda2进行分区，作为以后破解使用的文件存放位置
cfdisk (util-linux-ng 2.13.1.1) Disk Drive: /dev/hda Size: 8589934592 bytes, 8589 MB Heads: 15 Sectors per Track: 63 Cylinders: 17753
Name Flags Part Type FS
Type [Label] Size (MB)
—————————————————————————————— hda1 Boot Primary Linux
ext3 256.44
hda2 Primary Linux ext3 8333.18
4 对hda2进行格式化，格式化为ext3文件系统
livecd ~ # mkfs.ext3 /dev/hda2
mke2fs 1.40.8 (13-Mar-2008)
Warning: 256-byte inodes not usable on older systems
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
509040 inodes, 2034466 blocks
101723 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=2084569088
63 block groups
32768 blocks per group, 32768 fragments per group
8080 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632 Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done This filesystem will be automatically checked every 36 mounts or 180 days, whichever comes first. Use tune2fs -c or -i to override.
5 挂载磁盘分区
mkdir -p spider/{dom,disk}
mount /dev/hda1 spider/dom/;mount dev/hda2 spider/disk
livecd dom # ls
backup.bin config.tgz config_default.tgz hsrouter_v6.0.5.bin boot config.tgz.last hsrouter
6 拷贝原始的文件到备份空间存放
mkdir ../disk/old
cp -Rpa ./* ../disk/old/
7 解密hsrouter_v6.0.5.bin文件
cat hsrouter_v6.0.5.bin | openssl des-cbc -k ‘letusd01twell’ -d >hsrouter_v6.0.5.tgz
8 解压缩解密的文件包
mkdir tgz
cd tgz/
tar zxvf ../hsrouter_v6.0.5.tgz
9 chroot到解压开的系统
chroot . /bin/bash
10 修改muddyboot用户的密码 root@livecd /\>passwd muddyboot
Changing password for muddyboot
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers. Enter new password:
Re-enter new password:
Password changed.
11 查看和修改md5检测 root@livecd /\>md5sum etc/sha
shadow shadow- root@livecd /\>md5sum etc/shadow*
435229c22f1008712ec3ec88f6a5a908 etc/shadow
3e0dabfa647a76b0beb57f20f258499f etc/shadow- root@livecd /\>cat etc/md5check.lst |grep shado
/etc/shadow 3e0dabfa647a76b0beb57f20f258499f root@livecd /\>cd etc/ root@livecd /etc\>cp shadow shadow- root@livecd /etc\>vi md5check.lst
/etc/inittab bc0903e79fce15af666d8195a5f27604
/etc/passwd 5c5ab6467a5c5f18891cf7ed2c1a826f
/etc/shadow 3e0dabfa647a76b0beb57f20f258499f
/etc/rc.d/init.d/rc fedfd528ba569aa8f066411f1b4754d0
/etc/rc.d/init.d/functions 046e38027c18f68a2b8ba9984a6ad765
/etc/rc.d/init.d/mountkernfs 0663e46efadd2d704607eb400e8e4ebc /sbin/shutdown 9d7e0ebd87189e2685430826ad715aa4
修改为
/etc/inittab bc0903e79fce15af666d8195a5f27604
/etc/passwd 5c5ab6467a5c5f18891cf7ed2c1a826f
/etc/shadow 435229c22f1008712ec3ec88f6a5a908
/etc/rc.d/init.d/rc fedfd528ba569aa8f066411f1b4754d0
/etc/rc.d/init.d/functions 046e38027c18f68a2b8ba9984a6ad765
/etc/rc.d/init.d/mountkernfs 0663e46efadd2d704607eb400e8e4ebc /sbin/shutdown 9d7e0ebd87189e2685430826ad715aa4
保存退出
12
退出，重新打包检查效果，看muddyboot用户是否可以正常登陆
tar cf ../imgtmp_isp.tar .
gzip imgtmp_isp.tar
mkdir cache
mv imgtmp_isp.tar.gz cache/
livecd old # cd cache/
livecd cache # ls
imgtmp_isp.tar.gz
livecd cache # mv imgtmp_isp.tar.gz hsrouter_v6.0.5.tgz livecd cache # ls
hsrouter_v6.0.5.tgz
livecd cache # cat hsrouter_v6.0.5.tgz | openssl des-cbc -k ‘letusd01twell’ -e >hsrouter_v6.0.5.bin
livecd cache # ls
hsrouter_v6.0.5.bin hsrouter_v6.0.5.tgz
13 覆盖原来的bin文件，重新启动观察
cd /spider/dom/
cp ../disk/old/cache/hsrouter_v6.0.5.bin ./
14 vmware做快照
15 重新启动