DSM-G600, DNS-3xx and NSA-220 Hack Forum

I placed a fun_plug file on HD_a2 via FTP.
I changed its permissions to 777 via my FTP client (it did work).
I unzipped the http://dns323.kood.org/downloads/busybo … .1.tar.bz2 file.
I FTP'd the busybox and the sed files to HD_a2. Changed their permissions to 777 (just in case).
I copied the commands from the README file found in the zipped file to the fun_plug file.

How do I know that it works, and how do I get to telnet (telnet X.X.X.X does NOT work)?

Thanks again.

With which account did you transfer the files to your HD_a2? Did you implement Users?

username wrote:

Thank you for your responses.

I did create a user and FTP'd using that user. Should I have done it differently?

I am trying to do fun_plug without having to physically move the HD to my Linux box and back.

You must create an user on your dsm
You must configure ftp on your dsm to give him rw rights on the root

next you can transfer the fun_plu and all what your need from your linux box (or from a windows one) and change the rights with your ftp client on the dsm.

username wrote:

I did create a user through DSM's web interface. I gave the user full RW rights to the root. Is there another way of doing this other than going through the web interface?

No. Oh and some time you need to start the ftp server threw the web interface
Transfer your fun_plug under HD_a2 (exactly /mnt/HD_a2)
and chmod 700 threw your ftp client
Now you can restart the box threw the web interface

finally,got my busybox running, I think for me it was the chmod that did not work.
Telnet is open, but when I try to login as root i get :no valid shadow password

as Admin I do not get any further than the busybox start message, can you guess what went wrong?

Regards, grouper

Grouper wrote:

finally,got my busybox running, I think for me it was the chmod that did not work.
Telnet is open, but when I try to login as root i get :no valid shadow password

as Admin I do not get any further than the busybox start message, can you guess what went wrong?

Regards, grouper

#!/bin/sh
if [ ! -e /mnt/HD_a2/ash ]
then
ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
if [ ! `grep root /etc/shadow` ]
then
  echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
  /mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd
cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9
/mnt/HD_a2/busybox telnetd &

You need to add ALL these lines to your fun_plug, don't mess around with them.
If you have
* /mnt/HD_a2/fun_plug
* /mnt/HD_a2/sed
* /mnt/HD_a2/busybox
* and enough room for /mnt/HD_a2/ash symlink
this should work without any problems. Also admin login will not work, we do not need it because it has no root privileges. Log in as root and password is same you have specified for admin.

Do not add /mnt/HD_a2/fun_plug into fun_plug. Very bad idea. All you need in fun plug is included at code section.

I am up now! Got telnet to work. Thanks everyone for help.

I think it was the smbclient command that did the trick. I recreated the fun_plug file using vi on the Linux box and ran the put command to copy it to the DSM-G600. Most likely the original fun_plug file that I created on a Windows box did not work right because of different format (EOL/CR/LF or whatever).

Grouper wrote:

Yeah, thouht about it ... not such a good idea.
Here is my fun_plug:

#!/bin/sh
if [ ! -e /mnt/HD_a2/ash ]
then
ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
/mnt/HD_a2/ushare -c /mnt/HD_a2/Musik
/mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd
cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9
/mnt/HD_a2/busybox telnetd &

nothin special,what do yyou tihnk?

Remove this line and try again.
Or put this at the end of your script, also you can add background option &

/mnt/HD_a2/ushare -c /mnt/HD_a2/Musik

These are the lines for root login. At first we duplicate admins password entry and add a control bit. Then we replace control bit + admin with root and finally we add a usable shell to the root user.

echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
/mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd

you have to create it on your own