I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it commands the camera over HTTP using a variety of endpoints.It uses an Ambarella SoC with running buildroot.I port scanned the camera: it has a telnet server running on tcp/23 and a webserver (Cherokee) on tcp/80. It also has some kind of Java RPC server on tcp/7878 but I don't know much about Java or how to use it.$ nmap -A -T4 192.168.42.1 -p 1-65535Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-15 22:02 EDTmass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-serversmass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-serversstty: stdin isn't a terminalstty: stdin isn't a terminalNmap scan report for 192.168.42.1Host is up (0.0041s latency).Not shown: 65530 closed portsPORT     STATE SERVICE    VERSION23/tcp   open  telnet     BusyBox telnetd53/tcp   open  domain     dnsmasq 2.59| dns-nsid:|_  bind.version: dnsmasq-2.5980/tcp   open  http       Cherokee httpd 1.2.101b141103_|_http-server-header: Cherokee/1.2.101b141103_ (UNIX)|_http-title: Site doesn't have a title (text/html; charset=utf-8).7877/tcp open  tcpwrapped7878/tcp open  unknownService Info: Host: buildroot; OS: UnixI'm trying to get into it via the telnet server but I don't know the user/password. They changed the default root password, using root with a blank password doesn't let me in.I was hoping the Android app would make use of the telnet connection so I sniffed the traffic between the app and the camera but it's all HTTP only.So I thought I would poke around the firmware updates.I am looking at these two binaries: http://www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF and http://www.activeon.com/wp/wp-content/uploads/2014/12/LX_v3.15.UGFBoth files have the exact same length of 45,281,280 bytes but different contents (verified with sha1sum).Binwalk seems to think there are lots of files in these firmware updates (unless I'm mis-reading the output):$ binwalk /Downloads/R2_v320_150212.UGFDECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------121908        0x1DC34         CRC32 polynomial table, little endian127773        0x1F31D         Copyright string: Copyright (C) 2004-20071223000       0x12A958        CRC32 polynomial table, little endian1271084       0x13652C        Copyright string: Copyright (C) 2004-20071273818       0x136FDA        Unix path: /../../sv/a5s/image/ambhal.bin1273861       0x137005        Unix path: /../../sv/a5s/image/ambhal.info1274105       0x1370F9        Unix path: /../../../boss_sdk/output.oem/images/Image1274166       0x137136        Unix path: /../../src/linuxinfo/kernel.info1274419       0x137233        Unix path: /../../gui/boss_dv/romfs/a5s_ft_parallel.romfs1274480       0x137270        Unix path: /../../gui/boss_dv/romfs/romfs.info1274813       0x1373BD        Unix path: /../../../boss_sdk/output.oem/images/rootfs.ubi1274873       0x1373F9        Unix path: /../../src/linuxinfo/ubifs.info1274960       0x137450        Unix path: /../../src/linuxinfo/ambernation.img1275009       0x137481        Unix path: /../../src/linuxinfo/ambernation.info1307492       0x13F364        Unix path: /usr/local/share/script/wowlan.sh2218252       0x21D90C        Unix path: /usr/local/share/script/wifi_start.sh2323638       0x2374B6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_DEC/ARM_92326438       0x237FA6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_DEC/ARM_92326806       0x238116        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLC/ARM_112644236       0x28590C        LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 512 bytes3574898       0x368C72        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_ENC/ARM_93577214       0x36957E        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_ENC/ARM_94148260       0x3F4C24        Neighborly text, neighbor point left:ing calibration map...4148284       0x3F4C3C        Neighborly text, neighbor point right:4398826       0x431EEA        Executable script, shebang: /bin/sh' > /tmp/ap_start.sh4399322       0x4320DA        Unix path: /usr/local/share/script/load.sh' >> /tmp/ap_start.sh4399714       0x432262        Executable script, shebang: /bin/sh' > /tmp/ap_stop.sh4536526       0x4538CE        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLD/ARM_115391847       0x5245E7        Unix path: /a/s/d/i]=%d/%d/%d/%d/%d5460823       0x535357        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes5460975       0x5353EF        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes5461035       0x53542B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes5461095       0x535467        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes5699789       0x56F8CD        LZMA compressed data, properties: 0x88, dictionary size: 65536 bytes, uncompressed size: 196608 bytes5708635       0x571B5B        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 256 bytes6431706       0x6223DA        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 62464 bytes6431754       0x62240A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 59904 bytes6431802       0x62243A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 58880 bytes6431850       0x62246A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes6431898       0x62249A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes6461019       0x62965B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 200 bytes6513410       0x636302        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 65538 bytes6564456       0x642A68        YAFFS filesystem6697660       0x6632BC        ASCII cpio archive (SVR4 with no CRC), file name: dev, file name length: 0x00000004, file size: 0x000000006697776       0x663330        ASCII cpio archive (SVR4 with no CRC), file name: dev/console, file name length: 0x0000000C, file size: 0x000000006697900       0x6633AC        ASCII cpio archive (SVR4 with no CRC), file name: root, file name length: 0x00000005, file size: 0x000000006698016       0x663420        ASCII cpio archive (SVR4 with no CRC), file name: TRAILER!!!, file name length: 0x0000000B, file size: 0x000000008732501       0x853F55        Certificate in DER format (x509 v3), header length: 4, sequence length: 128410055769      0x997059        Certificate in DER format (x509 v3), header length: 4, sequence length: 132810055773      0x99705D        Certificate in DER format (x509 v3), header length: 4, sequence length: 129210055777      0x997061        Certificate in DER format (x509 v3), header length: 4, sequence length: 131210209925      0x9BCA85        Certificate in DER format (x509 v3), header length: 4, sequence length: 146410379388      0x9E607C        Linux kernel version 2.6.38.8 (kjp@ntek-linux-server) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #1 PREEMPT Mon Nov 3 21:17:07 KST 201410409076      0x9ED474        gzip compressed data, maximum compression, from Unix, last modified: 2014-11-03 12:16:2410506132      0xA04F94        LZO compressed data10512276      0xA06794        CRC32 polynomial table, little endian10525445      0xA09B05        LZMA compressed data, properties: 0x65, dictionary size: 8388608 bytes, uncompressed size: 1048576 bytes10948832      0xA710E0        Unix path: /arm/plat-ambarella/boss/../generic/adc.c10950128      0xA715F0        Unix path: /arm/plat-ambarella/boss/../generic/gpio.c10950456      0xA71738        Unix path: /arm/plat-ambarella/boss/init.c10951032      0xA71978        Unix path: /arm/plat-ambarella/boss/irq.c10952360      0xA71EA8        Unix path: /arm/plat-ambarella/boss/pm.c10953952      0xA724E0        Unix path: /arm/plat-ambarella/boss/../generic/rct/a5s.c10954212      0xA725E4        Unix path: /arm/plat-ambarella/boss/../generic/rtc.c10954344      0xA72668        Unix path: /arm/plat-ambarella/boss/../generic/sd.c10954600      0xA72768        Unix path: /arm/plat-ambarella/boss/boss.c10954944      0xA728C0        Unix path: /arm/plat-ambarella/misc/ambfb.c10955756      0xA72BEC        Unix path: /arm/plat-ambarella/misc/atag.c11032304      0xA856F0        Unix path: /proc/fs/cifs/SecurityFlags11032717      0xA8588D        Unix path: /proc/fs/cifs/SecurityFlags.11040658      0xA87792        Unix path: /proc/fs/cifs/LookupCacheEnabled to 011100704      0xA96220        xz compressed data11168736      0xAA6BE0        Unix path: /arm/plat-ambarella/include/mach/io.h12475632      0xBE5CF0        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: MD5 hash13826304      0xD2F900        JPEG image data, JFIF standard 1.0113871360      0xD3A900        JPEG image data, JFIF standard 1.0113885696      0xD3E100        JPEG image data, JFIF standard 1.0213889792      0xD3F100        JPEG image data, JFIF standard 1.0213891840      0xD3F900        JPEG image data, JFIF standard 1.0214108844      0xD748AC        Certificate in DER format (x509 v3), header length: 4, sequence length: 57614109424      0xD74AF0        Certificate in DER format (x509 v3), header length: 4, sequence length: 70414110132      0xD74DB4        Certificate in DER format (x509 v3), header length: 4, sequence length: 71714110853      0xD75085        Certificate in DER format (x509 v3), header length: 4, sequence length: 222814111022      0xD7512E        Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,14112181      0xD755B5        Copyright string: Copyright (c)1996 VeriSign, Inc.  All Rights Reserved. CERTAIN15629693      0xEE7D7D        MySQL MISAM compressed data file Version 515629905      0xEE7E51        MySQL MISAM compressed data file Version 915650089      0xEECD29        MySQL MISAM compressed data file Version 415696517      0xEF8285        MySQL MISAM compressed data file Version 415696541      0xEF829D        MySQL MISAM compressed data file Version 415696597      0xEF82D5        MySQL MISAM compressed data file Version 416615436      0xFD880C        LZMA compressed data, properties: 0x9A, dictionary size: 262144 bytes, uncompressed size: 299111512 bytes17325931      0x1085F6B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17326177      0x1086061       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17331807      0x108765F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17332115      0x1087793       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17332605      0x108797D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17333091      0x1087B63       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.17333728      0x1087DE0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.17334022      0x1087F06       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.17343657      0x108A4A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.17343817      0x108A549       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17344031      0x108A61F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17345518      0x108ABEE       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17345965      0x108ADAD       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17346442      0x108AF8A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17346547      0x108AFF3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17346825      0x108B109       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17347072      0x108B200       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.17347811      0x108B4E3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17348053      0x108B5D5       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17348232      0x108B688       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17350016      0x108BD80       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17350253      0x108BE6D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17351220      0x108C234       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17351648      0x108C3E0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.17351968      0x108C520       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17352747      0x108C82B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17353891      0x108CCA3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17354102      0x108CD76       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17357134      0x108D94E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17360809      0x108E7A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.17371600      0x10911D0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17372514      0x1091562       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17372819      0x1091693       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17374604      0x1091D8C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17374934      0x1091ED6       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17375922      0x10922B2       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17376322      0x1092442       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17379091      0x1092F13       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17379478      0x1093096       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17380115      0x1093313       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.17380498      0x1093492       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17380775      0x10935A7       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17381548      0x10938AC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17381725      0x109395D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17382031      0x1093A8F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17382208      0x1093B40       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17382380      0x1093BEC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17382555      0x1093C9B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17382722      0x1093D42       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.17386590      0x1094C5E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_postp.c:%d failed.17388309      0x1095315       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.17388520      0x10953E8       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.17396295      0x1097247       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.17397243      0x10975FB       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.17397895      0x1097887       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.17400332      0x109820C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.17400594      0x1098312       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.17400906      0x109844A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jenc.c:%d failed.17405011      0x1099453       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_parset.c:%d failed.17406360      0x1099998       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.17408094      0x109A05E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.17412604      0x109B1FC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mixer.c:%d failed.18014464      0x112E100       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x200, data offset: 0x800The other file has a similar binwalk output but I can't put it here because of the message length limit.I tried running binwalk with the -e option to extract the files. I'm getting lots of files with names that seem to be hex addresses but they don't match the binwalk output. Most of the files are mis-identified, 7z files can't be unzipped because they're corrupt, crt files aren't valid either. The 34.9MB file 9ED474.gz extracts to a 46KB file...$ ll _R2_v320_150212.UGF.extracted/total 2057240drwxr-xr-x   34 me  staff      1156 Jul 15 21:44 .drwxr-xr-x  276 me  staff      9384 Jul 15 21:43 ..-rw-r--r--@   1 me  staff      6148 Jul 15 21:44 .DS_Store-rw-r--r--    1 me  staff  27266816 Jul 15 21:44 112E100.ubi-rw-r--r--    1 me  staff  42637044 Jul 15 21:43 28590C.7z-rw-r--r--    1 me  staff  39820457 Jul 15 21:43 535357.7z-rw-r--r--    1 me  staff  39820305 Jul 15 21:43 5353EF.7z-rw-r--r--    1 me  staff  39820245 Jul 15 21:43 53542B.7z-rw-r--r--    1 me  staff  39820185 Jul 15 21:43 535467.7z-rw-r--r--    1 me  staff  39581491 Jul 15 21:43 56F8CD.7z-rw-r--r--    1 me  staff  39572645 Jul 15 21:43 571B5B.7z-rw-r--r--    1 me  staff  38849574 Jul 15 21:43 6223DA.7z-rw-r--r--    1 me  staff  38849526 Jul 15 21:43 62240A.7z-rw-r--r--    1 me  staff  38849478 Jul 15 21:43 62243A.7z-rw-r--r--    1 me  staff  38849430 Jul 15 21:43 62246A.7z-rw-r--r--    1 me  staff  38849382 Jul 15 21:43 62249A.7z-rw-r--r--    1 me  staff  38820261 Jul 15 21:43 62965B.7z-rw-r--r--    1 me  staff  38767870 Jul 15 21:43 636302.7z-rw-r--r--    1 me  staff  38583620 Jul 15 21:43 6632BC.cpio-rw-r--r--    1 me  staff  36548779 Jul 15 21:43 853F55.crt-rw-r--r--    1 me  staff  35225511 Jul 15 21:43 997059.crt-rw-r--r--    1 me  staff  35225507 Jul 15 21:43 99705D.crt-rw-r--r--    1 me  staff  35225503 Jul 15 21:43 997061.crt-rw-r--r--    1 me  staff  35071355 Jul 15 21:43 9BCA85.crt-rw-r--r--    1 me  staff     40960 Jul 15 21:43 9ED474-rw-r--r--    1 me  staff  34872204 Jul 15 21:43 9ED474.gz-rw-r--r--    1 me  staff  34755835 Jul 15 21:43 A09B05.7z-rw-r--r--    1 me  staff  34180576 Jul 15 21:43 A96220.xz-rw-r--r--    1 me  staff  31172436 Jul 15 21:43 D748AC.crt-rw-r--r--    1 me  staff  31171856 Jul 15 21:44 D74AF0.crt-rw-r--r--    1 me  staff  31171148 Jul 15 21:44 D74DB4.crt-rw-r--r--    1 me  staff  31170427 Jul 15 21:44 D75085.crt-rw-r--r--    1 me  staff  28665844 Jul 15 21:44 FD880C.7zdrwxr-xr-x    2 me  staff        68 Jul 15 21:43 cpio-rootAre the binary firmware updates patches or is it the full image?What's my next move?There seem to be some python files in the firmware (as observed by dumping the contents using strings) so maybe I could modify one of the files to give me access to /?Or maybe I could craft my own firmware update file and run a bash script to append a custom user & password to /etc/passwd?There is probably a JTAG connector inside the camera but I'd rather not take it apart.I'm new to this, but I find it very exciting. I'm hoping someone with more experience can point me in the right direction :)Thanks!
Trying to get shell on embedded device. Analyzed firmware update, listened to Android app, no dice. Suggestions?
firmware;embedded