DSM-G600, DNS-3xx and NSA-220 Hack Forum

unwired · 2008-03-17 03:40:40

Hi folks,

I don't know if anyone is running into the same issues as I am but I'd be interested in hearing from others.
I've thrown an old 2GB drive into the G600 and formated EXT3 successfully.

I've been using WSFTP to copy fun_plug to the main directory. I then use WSFTP to change permissions to 777. It shows as taken but then reverts back after reboot.
I also created a file called fplug as an example and that one says 777 after reboot so perhaps they've gotten a bit smarter.

Any suggestions for me?

Does someone thing back porting to an earlier firmware and trying all this over would make any difference?
Does someone have a working hacked bin file I could use?

My main purpose is (a) to get a torrent app running and (b) try to unlock the USB port so that I can use a writable USB fob (not just Read-only).
I'm not sure if formating my USB fob as ext3 would allow it to be R/W or not. If anyone has a clue pleae let me know.

Thanks.

_

unwired · 2008-03-17 05:53:25

Getting a bit closer but still not there yet.

I removed the drive and installed into running Linux box.
I was able to chmod 777 to fun_plug there.
While I was at it I also copied fun_plug to the .codepages directory

The /HD_a2 directory has busybox, sed and a copy of fun_plug there.
(I also have the dmseg.out file which now got created too so I know it's running from somewhere).

When I telnet into the system I get a user prompt but after I log in and see the busybox version info I never get a '#'
I an kill the session ans try again (so the box isn't hung) but still no luck.

I've tried the telnet file on the dns323.kood.org/dsmg600 site and even tried to replace it and reboot with the busybox from the mldonkey tar file but still not success.

Thoughts anyone?

Thanks.

sala · 2008-03-17 09:46:45

http://dns323.kood.org/forum/t1529-Dead … ccess.html

More info would be good (like your fun_plug and /etc/passwd content).

unwired · 2008-03-17 15:43:59

Getting a bit warmer...

When trying to telnet in I get:

storage login: root
login: no valid shadow password

Connection to host lost.

Loginning in as admin gets me to busybox but no # prompt.
Here's the version info

BusyBox v1.00-pre1 (2005.10.27-08:04+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

I've been tinkering with fun_plug but my scripting is not too hot. I tried to cat things like /etc/shadow to files but it didn't seem to take.The only other file I have is the dmesg.out ubt I'm not sure how much use that would be.

Here's the current funplug

#!/bin/sh
dmesg > /mnt/HD_a2/dmesg.out
cat /etc/shadow > shadow.out
cat /etc/passwd > pass.out

if [ ! -e /mnt/HD_a2/ash ]
then
ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
if [ ! `grep root /etc/shadow` ]
then

echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
/mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi

/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd

cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9

/mnt/HD_a2/busybox telnetd &

########## MLDonkey #############

MLDONKEYROOT="/mnt/HD_a2/mldonkey/"

rm $MLDONKEYROOT/.mldonkey/mlnet.pid

HOME="$MLDONKEYROOT" $MLDONKEYROOT/mlnet.static &

ps -eaf > ps.out

sala · 2008-03-17 16:01:52

Code:

cat /etc/passwd > /mnt/HD_a2/passwd.txt
cat /etc/shadow > /mnt/HD_a2/shadow.txt

Add this to your fun_plug

You may have problem described here:
http://dns323.kood.org/forum/t1371-lett … sword.html

unwired · 2008-03-17 16:53:37

There is no entry for root.

How do I create a new file that gets copied over the existing /etc/shadow or /etc/password file?

Thanks.

the accounts I have are as follows

admin:passhere:0:0:99999:7:::
nobody:passhere:0:0:99999:7:::
kontroll.admin:passhere:0:0:99999:7:::

unwired · 2008-03-17 21:24:17

One more quick update. I'm not quite sure how everything works on this device.

I thought I'd start from scratch with a clean reset device and ext3 formatted drive but I can't quite figure out how I got fun_plug to run that first time.
I've copied fun_plug, sed and busybox down to the device then putthe drive in a linux box and chmod 777 to all three files. I even copied a version of fun_plug into the .codepages directory but still no luck. For now, I can't even get fun_plug to work and spit out the dmesg.out file let alone work telnet.

I'm unsure if htis is b/c my device is a newer revision or if I'm just overlooking something. I'll keep at it until I figure this out.

sala · 2008-03-17 23:45:52

Most people have hard to understand that /mnt/HD_a2/ is mount point to the root of your hard disk, where you need to install a properly chmoded fun_plug file. Making a mnt/HD_a2, HD_a2 or any other directory or copying fun_plug to multiple places (like .codepages ??!!) is wrong because there is no howto step which instruct you to do so.

Just clean up and start again. Restore firmware default (so you could get a clean passwd) and make a new fun_plug file to your hard disk. As I understand you can use a linux PC for making this file and coping to hard disk. If so then use this way, it is recommended and 100% working.

Do everything as wiki page says and you will be good

unwired · 2008-03-18 02:26:01

I understand that fun_plug must be in root dir. of mount point and will work on that from now on.
I have reformatted and reset default firmware too but even with fun_plug as executable (777) nothing works.
I was curious if maybe my new device somehow keeps fun_plug from working correctly. (as I said, the sticker says Hardware version B2).

Would fun_plug work on USB drives too or only on the internal HD_a2?
I could possibly format a USB fob as ext3 and load fun_plug onto the root there.
Also must the specific name fun_plug be used?

Am I correct in understanding that directories like /etc are actually on the chip and not hard drive (HD_a2) and we are using fun_plug as a script to modify the files in ram?

Thanks.

sala · 2008-03-18 08:14:13

unwired wrote:
I was curious if maybe my new device somehow keeps fun_plug from working correctly. (as I said, the sticker says Hardware version B2).

No, you had fun_plug working before....

unwired wrote:
Getting a bit warmer...

When trying to telnet in I get:

storage login: root
login: no valid shadow password

Connection to host lost.

Loginning in as admin gets me to busybox but no # prompt.
Here's the version info

BusyBox v1.00-pre1 (2005.10.27-08:04+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

... and it was right here Only sed executable or command was not properly executed to fix your passwd and shadow. When you get back at the same situation, you may try to pipe a sed output to a file, for example with following command /mnt/HD_a2/sed --help > /mnt/HD_a2/sed.txt to test out if sed binary is working.

Usb drives should be ok to.

unwired wrote:
I have reformatted and reset default firmware too but even with fun_plug as executable (777) nothing works.

This does not help much, you need to give more details, like fun_plug content and maybe output of ls -lah command executed at the root of your hard disk when it was installed on your linux PC.

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2008-03-17 03:40:40

New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#2 2008-03-17 05:53:25

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#3 2008-03-17 09:46:45

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#4 2008-03-17 15:43:59

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#5 2008-03-17 16:01:52

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

Code:

#6 2008-03-17 16:53:37

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#7 2008-03-17 21:24:17

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#8 2008-03-17 23:45:52

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#9 2008-03-18 02:26:01

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

#10 2008-03-18 08:14:13

Re: New G600 from Circuit City doesn't seem 2 B working for me (Rev B. B2)

unwired wrote:

unwired wrote:

unwired wrote:

Board footer