Without the bootloader, you only need these files in casper/ to boot into live ubuntu: filesystem.squashfs initrd vmlinuz
The casper boot script will mount anything named with ".squashfs" to the lower layer of the overlayfs during boot. In this case, I'm creating my own "myroot.squashfs" to add packages and files into the live ubuntu, without having to unpack the existing "filesystem.squash". This saves a lot of time.

1. Mount everything:

Mount the original squashfs as the base (lower2), then mount the overlayfs with our committed changes (lower1) into myroot. Changes will be recorded in upper.

mkdir lower1 lower2 upper work
sudo mount -t squashfs /cdrom/casper/filesystem.squashfs lower2
sudo mount -n -t overlay overlayfs:/overlay -o lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,redirect_dir=nofollow myroot

2. Chroot and enable internet:

sudo chroot myroot/

# Inside chroot:
echo "nameserver 8.8.8.8" > /etc/resolv.conf

3. Install new package (ssh server):

apt update
apt install openssh-sftp-server

sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/g' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/g' /etc/ssh/sshd_config
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/g' /etc/ssh/sshd_config
sed -i 's/#UsePAM no/UsePAM yes/g' /etc/ssh/sshd_config
sed -i 's/#GatewayPorts no/GatewayPorts yes/g' /etc/ssh/sshd_config
sudo passwd -d root

4. Make the new squashfs

run apt clean before leave chroot.

# delete apt cache
sudo rm upper/var/lib/apt/lists
#delete unneed directories
sudo rm -r run tmp

# Merge changes from upper layer
sudo cp -Rf upper/ lower1
sudo rm -r upper/*
rm myroot.squashfs
sudo mksquashfs lower1 myroot.squashfs

Copy myroot.squashfs into the casper folder. Or just create a "myroot.dir" and put modifications there.

Install x11vnc

# Install VNC server
sudo apt update
sudo apt install x11vnc net-tools
# Start the VNC server
x11vnc -auth guess -forever -loop -noxdamage -repeat -nopw -rfbport 5900 -shared &

References:

SSHD without password: phusion/baseimage-docker#417
Default Ubuntu sources.list: https://gist.githubusercontent.com/rhuancarlos/c4d3c0cf4550db5326dca8edf1e76800/raw/480bc68edae51e704114b0f4e256f543f25961af/sources.list