DSM-G600, DNS-3xx and NSA-220 Hack Forum

i have just moved and have some files on my workstation somewhere i have to find then and try to upload it whit some info.

where hoping i got the unit before i moved budt did not get it....

here is the files i have been using
http://sconk.se/dns323/dns-323.rar

it starts a telnetd whit no password and only allows on connection there is also netcat to windows i the rar.

I haven't been able to establish a telnet session to the DNS-323.  Can anyone give me some specific instructions.  Many thanks!

- Gary

Hello,

Sorry about posting another telnet question...
I can get fun_plug script to work
I downloaded in the download section the utelnetd
I chmod 777 utelnetd
When I telnet the dns 323, it hangs up and drop the connection when I type any key ?

Do I have the right utelnet binary ?

Rgds,

Laurent

Hi, like @gkaufman and @levring above, I, too was having trouble with telnet dropping (using the original dns323.info files).  Everything works great for me when I use the script that calls "nc".

But I still am curious why the original files from dns323.info didn't work.. thanks everyone!

Last edited by someguy (2007-02-02 21:30:54)

Actually, you're already there. When you see the firts '#', you're in. No login needed. Just ls -l ....;-)

Hello,
there is no ha_a2 directory on my dns-323
I ftp in with terminal ftp from my mac and can only see the same as from a normal windows share...
could anyone please help me how to get the funplug with telnet installed?
Thanks
Martin

kind off topic

dont use UltraEdit use notepad++ its free and much better.

Last edited by KRH (2007-02-04 00:30:30)

Hi all, I am having a problem similar to some other users... (saw at least one in the telnet thread for the DMS-G600 with this issue. I tried their resolutions, but to no avail. Here is what I have gotten so far... can anyone give me a little direction here?



Here are the contents of my "fun_plug" file

#!/bin/sh
if [ ! -e /mnt/HD_a2/ash ]
then
  ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
if [ ! `grep root /etc/shadow` ]
then
  echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
  /mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd
cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9
/mnt/HD_a2/busybox telnetd &

dmesg > /mnt/HD_a2/dmesg.out
/mnt/HD_a2/nc -l -p 10000 -e /bin/sh &

mkdir /mnt/HD_a2/lnx_bin/
cd /mnt/HD_a2/lnx_bin/

/mnt/HD_a2/starttelnet.sh

export PATH=$PATH:/mnt/HD_a2/lnx_bin/

Here is the output of a dir command when I am FTP'd to the NAS

(lnx_bin) directory is empty, and I cannot put anything in there, I get access denied, and I don't know how to change its permissions.

ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection for directory listing.
total 1410
drwxrwxrwx  12 root root     4096 Feb  6  2007 .
drwxr-xr-x   4 root root     1024 Feb  6  2007 ..
drwxrwxrwx   2 root root     4096 Feb  6  2007 .lpd
drwx------   5 root root     4096 Feb  6  2007 .systemfile
drwxrwxrwx   2 root root     4096 Jan 10  2007 Documents
drwxrwxrwx   2 root root     4096 Feb  2  2007 FTP
drwxrwxrwx   3 root root     4096 Feb  5  2007 Installation Files
drwxrwxrwx   3 root root     4096 Jan 10  2007 Movies
drwxrwxrwx   4 root root     4096 Jan 17  2007 Music
drwxrwxrwx   4 root root     4096 Jan 10  2007 Pictures
drwxrwxrwx   2 root root     4096 Jan 26  2007 Unsorted
lrwxr-xr-x   1 root root       18 Feb  6 00:36 ash -> /mnt/HD_a2/busybox
-rwxrwxrwx   1 root root   515228 Aug 18  2006 busybox
-rw-r--r--   1 root root     5785 Feb  6  2007 dmesg.out
-rwxrwxrwx   1 root root      657 Feb  6  2007 fun_plug
drwxr-xr-x   2 root root     4096 Feb  6  2007 lnx_bin
-rwxrwxrwx   1 root root   133630 Oct 13  2006 sed
-rwxrwxrwx   1 root root       67 Oct 30  2006 utelnetd.out
226 Transfer complete.
ftp: 1040 bytes received in 0.06Seconds 16.51Kbytes/sec.
ftp>

Lastly, this is what I get when I try to telnet to the DNS-323. It gives the same result when I use the LAN or WAN IP address, wethere port 23 is forwarded to it or not, and whether or not it is in the DMZ in the router.

C:\>telnet 10.10.5.30
Connecting To 10.10.5.30...Could not open connection to the host, on port 23: Co
nnect failed

Cool, thanks Apskaft.... I now have telnet access.... Not too sure what I will use it for, but it is there if I need it.

stdin, stdout, etderr: 0 1 2


BusyBox v1.2.1 (2006.10.30-10:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

#

materofdi wrote:

I already read the wiki for telnet but I don't understand what I ahve to do.

The wiki is currently quite hard to follow and will most likely be updated. I think this post might make it easier for you.

However, keeping it as technical as it is has its points too. When inside the box using telnet you can very easily brick your unit.

The 'script' you're referring to is not a script but rather a set of commands to be used from a Linux machine after HDD_1/Volume_1 has been mounted on the local /mnt.


edit Whatever. I updated the Wiki. If the description there is to hard to follow I cannot reccomend you to continue. And please, please, please remember that using telnet to the DNS-323 you can easliy brick/destroy your unit. Even the slightes mistake will make it unusable. Ctrl-Z will not work


/Apan

Last edited by Apskaft (2007-02-09 14:40:40)

Are there any way of protecting the telnet server ?
With username + password.
ok - it is just sitting there on my intranet and I can disable it, but it could be rather handy to have it enabled - and I don´t like the though of having anything with important data on it just sitting there unprotected....