1. The kernel starts /linuxrc as passed via the kernel parameter read from DTS rdinit=/linuxrc, which is a symlink to /bin/busybox.
2. busybox, running as an init process, parses /etc/inittab.
3. As part of sysinit loaded from the inittab, fstab filesystems are mounted. At this time, no writable unprotected persistent filesystems are available.
4. The last inittab entry at the sysinit level starts /etc/init.d/rcS.
5. /etc/init.d/rcS flattened:

# First create shadow which became the main system shadow file
cp -f /etc/shadow_security /tmp/shadow

Use this gist as a starting point https://gist.github.com/C0DEbrained/c6f508109e34f43a39f4c22e901408dd

In my case after execution of the original script and first reboot printer stopped to accept connection to 22 port, so I rewrote the persistence script inside the exploit and applied exploit again.