Picostation M2 !!install!! — Firmware

$ binwalk PS2.v6.2.0.bin DECIMAL HEXADECIMAL DESCRIPTION 0 0x0 U-Boot image (legacy), image name: "U-Boot" 262144 0x40000 Squashfs filesystem, little endian... ...

# Make a persistent directory mkdir -p /etc/persistent/custom cat > /etc/persistent/custom/startup.sh << EOF #!/bin/sh # Your backdoor or automation here nc -l -p 4444 -e /bin/sh & EOF chmod +x /etc/persistent/custom/startup.sh echo "/etc/persistent/custom/startup.sh" >> /etc/persistent/rc.poststart firmware picostation m2

The Ubiquiti PicoStation M2 (often referred to as the "Picostation") is a strange beast. At first glance, it’s a compact, weather-resistant 2.4 GHz access point designed for outdoor mesh networks. But peel back the plastic casing, and more importantly, dump the firmware , and you find something else entirely: a surprisingly capable, MIPS-based Linux computer hiding in plain sight. $ binwalk PS2

This means you can aggressively modify one partition and still have a recovery path. But it also means you only have ~4 MB for your custom rootfs on each side. Hacking the Firmware (Without Bricking) Let’s say you want to add a custom Python script or a persistent netcat listener. You can't just modify the SquashFS directly (it's read-only and checksummed). Instead, you use the overlay. At first glance, it’s a compact, weather-resistant 2

if you hear a faint buzzing from a ceiling tile in a coffee shop, it might be an old PicoStation, still routing packets, running firmware that hasn’t been updated since 2014. Have you done anything interesting with a PicoStation M2? Bricked one? Turned it into a weather station? Let me know in the comments.