|
Size: 93
Comment:
|
Size: 3870
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| = Hacking Bus Displays = City of Oulu dumped old bus displays and we got two of those. Main goal is to figure out how it works and then do _something_ with it. |
|
| Line 4: | Line 11: |
| {{attachment:displays.jpg}} == Generic info == * Telnet * FTP * Web-server Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown == Posting content == It seems that you can POST information to WEB-server and it will be show at display. E.g. * Using curl: {{{ curl -d @display_request.xml http://10.2.0.139:8080}}} * display_request.xml {{{ <?xml version="1.0" encoding="UTF-8"?> <displayMLRequest xmlns="http://www.peek.se/DisplayML/" version="1.12" dateTime="2001-12-17T09:30:47-05:00"> <setDisplay template="TimeOutTemplate"> <textField region="Top" align="center" valign="middle">Tarlab FTW!</textField> </setDisplay> </displayMLRequest> }}} {{attachment:tarlab-ftw.jpg}} == Network == {{attachment:display2.jpg}} === nmap -results === {{{ Host is up (0.00088s latency). Not shown: 65532 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 8080/tcp open http-proxy PORT STATE SERVICE VERSION 21/tcp open ftp Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | -rw------- 1 root root 330 Oct 15 2013 .bash_history | -rw-r--r-- 1 root root 6011 Oct 12 2006 .xftcache | -rw-r----- 1 root root 24450 Oct 12 2006 ArialBold-14.bdf_longbus | drwxr-xr-x 1 root root 0 May 28 2002 bin | drwxr-xr-x 1 root root 0 May 28 2002 dev | drwxr-xr-x 1 root root 0 May 28 2002 etc | drwxr-xr-x 1 root root 0 May 28 2002 lib | drwxr-xr-x 1 root root 0 May 28 2002 lost+found | drwxr-xr-x 1 root root 0 May 28 2002 mnt | drwxr-xr-x 1 root root 0 May 28 2002 opt | dr-xr-xr-x 28 root root 0 Jul 10 23:55 proc | drwxr-xr-x 1 root root 0 May 28 2002 root | drwxr-xr-x 1 root root 0 May 28 2002 sbin | drwxr-xr-x 1 root root 0 May 28 2002 tmp | drwxr-xr-x 1 root root 0 May 28 2002 usr |_drwxr-xr-x 1 root root 0 May 28 2002 var 23/tcp open telnet Linux telnetd 8080/tcp open http-proxy? |_http-open-proxy: ERROR: Script execution failed (use -d to debug) }}} === WEB-page === {{attachment:webpage.png}} === telnet === Accounts: {{{ root::0:0:root:/:/bin/sh ftp::0:0:ftp:/:/bin/sh nobody::99:99:nobody:/:/bin/sh }}} === ps auxw === {{{ [/usr/bin]# ps auxwww PID Uid Stat Command 1 root S init 2 root S [keventd] 3 root S [ksoftirqd_CPU0] 4 root S [kswapd] 5 root S [bdflush] 6 root S [kupdated] 7 root S [mtdblockd] 14 root S /bin/sh --login 18 root S /bin/sh /usr/bin/reset_eth.sh 19 root S /usr/bin/paras 28 root S [jffs2_gcd_mtd3] 31 root S /usr/sbin/xinetd 35 root S /usr/bin/paras 36 root S /usr/bin/paras 37 root S /usr/bin/paras 282 root S in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s 307 root S in.telnetd: 10.2.0.137 308 root S -sh 403 root S /bin/ping -c 3 10.0.0.226 404 root R ps auxwww }}} [[/Dmesg]] |
|
| Line 6: | Line 118: |
| === Links === * http://www.parasdisplay.com/ * http://www.parasdisplayboard.com/ * http://mitron.fi * http://displayml.org (defunct) <<AttachList()>> |
Hacking Bus Displays
City of Oulu dumped old bus displays and we got two of those.
Main goal is to figure out how it works and then do _something_ with it.
Generic info
- Telnet
- FTP
- Web-server
Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown
Posting content
It seems that you can POST information to WEB-server and it will be show at display. E.g.
Using curl: curl -d @display_request.xml http://10.2.0.139:8080
- display_request.xml
<?xml version="1.0" encoding="UTF-8"?> <displayMLRequest xmlns="http://www.peek.se/DisplayML/" version="1.12" dateTime="2001-12-17T09:30:47-05:00"> <setDisplay template="TimeOutTemplate"> <textField region="Top" align="center" valign="middle">Tarlab FTW!</textField> </setDisplay> </displayMLRequest>
Network
nmap -results
Host is up (0.00088s latency). Not shown: 65532 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 8080/tcp open http-proxy PORT STATE SERVICE VERSION 21/tcp open ftp Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | -rw------- 1 root root 330 Oct 15 2013 .bash_history | -rw-r--r-- 1 root root 6011 Oct 12 2006 .xftcache | -rw-r----- 1 root root 24450 Oct 12 2006 ArialBold-14.bdf_longbus | drwxr-xr-x 1 root root 0 May 28 2002 bin | drwxr-xr-x 1 root root 0 May 28 2002 dev | drwxr-xr-x 1 root root 0 May 28 2002 etc | drwxr-xr-x 1 root root 0 May 28 2002 lib | drwxr-xr-x 1 root root 0 May 28 2002 lost+found | drwxr-xr-x 1 root root 0 May 28 2002 mnt | drwxr-xr-x 1 root root 0 May 28 2002 opt | dr-xr-xr-x 28 root root 0 Jul 10 23:55 proc | drwxr-xr-x 1 root root 0 May 28 2002 root | drwxr-xr-x 1 root root 0 May 28 2002 sbin | drwxr-xr-x 1 root root 0 May 28 2002 tmp | drwxr-xr-x 1 root root 0 May 28 2002 usr |_drwxr-xr-x 1 root root 0 May 28 2002 var 23/tcp open telnet Linux telnetd 8080/tcp open http-proxy? |_http-open-proxy: ERROR: Script execution failed (use -d to debug)
WEB-page
telnet
Accounts:
root::0:0:root:/:/bin/sh ftp::0:0:ftp:/:/bin/sh nobody::99:99:nobody:/:/bin/sh
ps auxw
[/usr/bin]# ps auxwww
PID Uid Stat Command
1 root S init
2 root S [keventd]
3 root S [ksoftirqd_CPU0]
4 root S [kswapd]
5 root S [bdflush]
6 root S [kupdated]
7 root S [mtdblockd]
14 root S /bin/sh --login
18 root S /bin/sh /usr/bin/reset_eth.sh
19 root S /usr/bin/paras
28 root S [jffs2_gcd_mtd3]
31 root S /usr/sbin/xinetd
35 root S /usr/bin/paras
36 root S /usr/bin/paras
37 root S /usr/bin/paras
282 root S in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s
307 root S in.telnetd: 10.2.0.137
308 root S -sh
403 root S /bin/ping -c 3 10.0.0.226
404 root R ps auxwww
Links
http://displayml.org (defunct)