DSM-G600, DNS-3xx and NSA-220 Hack Forum

Thanks for busybox binary! But we can't do much with admin login. We need root and here it is

fun_plug file

#!/bin/sh
if [ ! -e /mnt/HD_a2/ash ]
then
  ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
if [ ! `grep root /etc/shadow` ]
then
  echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
  /mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/ash/' /etc/passwd
cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9
/mnt/HD_a2/busybox telnetd &

busybox and sed binary
http://dns323.kood.org/downloads/busybo … .1.tar.bz2

PS: root password is same with admin user

Last edited by sala (2006-10-14 21:45:22)

Add a usable shell to admin user and you'll good to go.

admin:x:500:500:Linux User,,,:/:/mnt/HD_a2/ash

Thanks for your report
Now all readme's have fixed fun_plug

/sys/mtd1/shadow at /dev/mtdblock0 is flashed!
/etc/shadow will be flashed only if you change your user setting with D-Link web interface.
So if you haven't changed your user settings after starting to use telnet then your shadow file is OK, but you still need a new fun_plug for telnet!

If your /etc/shadow looks like BertrandB's example then you may want to fix this but it is not crucial!
a) Using vi

/mnt/HD_a2/busybox vi /etc/shadow

and delete unneeded root entries.
If you are not familiar with vi then do not use it!!!
b) You can also copy shadow file to your hard disk, delete unneeded root entries and then copy it back to /etc
After using one of these fixing steps, go to web interface and change admin password, so your fixed /etc/shadow will get flashed.

Here is another way to enable telnet on DSM-G600. This time there is no need of busybox at all.

if [ ! `grep root /etc/shadow` ]
then
  echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
  /mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/dash/' /etc/passwd
for i in 0 1 2 3 4 5 6 7
do
  /mnt/HD_a2/mknod /dev/ttyp$i c 3 $i
  /mnt/HD_a2/mknod /dev/ptyp$i c 2 $i
done
/mnt/HD_a2/utelnetd &

Files needed:
sed - http://dns323.kood.org/downloads/sed-4.1.5.tar.bz2
utelnetd, dash and mknod - http://dns323.kood.org/downloads/utelne … od.tar.bz2

This method may needs some tweaks, a better shell than dash or some utelnetd hacks to make it run smoother.

..connect to your DSM-G600 with telnet client with root user and with password you have specified for admin in web interface.

Login as root not as admin. You need only admin user password.

Files should be at the root of your hard drive not in any directory. HD_a2 is just mount point and you are not seeing it anywhere (not in samba and nor ftp by default).

JohnGalt wrote:

I am wondering if I can install tcsh on it now and have the autocompletion available to me!

bash has already auto completion.

skit wrote:

Hi,

first I'm a newbee and english is not my native language.

I still have problems to log in via telnet.  fun_plug is setup correctly (imo).
After "telnet dsm-g600" an try to login as root this message appears

Connected to dsm-g600.
Escape character is '^]'.

DSM-G600 login: root
login: no valid shadow password
Connection closed by foreign host.

What could be wrong? Can anyone help?

Thanks
skit

Have you setup a password for admin user from web interface?

Another Newbie whith an /etc/shadow question.

I have been able to set up both telnet and dropbear ssh succesfully and can log in, but here is my problem. 

When I first set up telnet my web admin password was blank.  Since then I have changed my web admin to a specific password, but my root password remains blank. 

I can change the root password using a passwd command, but once the DSM-G600 is rebooted it reverts back to root having a blank password. 
I also tried changing the admin password using the passwd command, but still after reboot root is back to a blank password. 

I also deleted the root entry in /etc/shadow thinking that the if statement wasn't being called in fun_plug, but again after reboot /etc/shadow looks just as it did after I first set it up with root and admin having a blank password. 

When I log into the web interface however admin requires the set password I set. 

Any ideas? 

Thank you

austinstat wrote:

Another Newbie whith an /etc/shadow question.

I have been able to set up both telnet and dropbear ssh succesfully and can log in, but here is my problem. 

When I first set up telnet my web admin password was blank.  Since then I have changed my web admin to a specific password, but my root password remains blank.

Ok it's because /etc/shadow issaved in flash.

first edit /etc/shadow
second delete the line with root
third change again the admin passwd with the web interface or create anther account (this flash /etc/shadow)
fouth reboot

I have a very strange problem with telnet.

There is no problem to log in (although password i blank).

The problem is that the telnet session disconnects as soon as I hit the backspace key, or when using tab completion.

I have used my dsm-g600 with telnet for a couple of weeks witout any problems. What might be the problem that disconnects my telnet session???
I have tried both putty and winXP cmd line telnet.

Here is my fun_plug:

#!/bin/sh
if [ ! -e /mnt/HD_a2/ash ]
then
    ln -s /mnt/HD_a2/busybox /mnt/HD_a2/ash
fi
if [ ! -e /bin/bash ]
then
    ln -s /mnt/HD_a2/bin/bash /bin/bash
fi
if [ ! -e /bin/bzip2 ]
then
    ln -s /mnt/HD_a2/bin/bzip2 /bin/bzip2
fi
if [ ! -e /bin/ctorrent ]
then
    ln -s /mnt/HD_a2/bin/ctorrent /bin/ctorrent
fi
if [ ! -e /bin/joe ]
then
    ln -s /mnt/HD_a2/bin/joe /bin/joe
fi
if [ ! -e /bin/microperl ]
then
    ln -s /mnt/HD_a2/bin/microperl /bin/microperl
fi
if [ ! -e /bin/nohup ]
then
    ln -s /mnt/HD_a2/bin/nohup /bin/nohup
fi
if [ ! -e /bin/vifm ]
then
    ln -s /mnt/HD_a2/bin/vifm /bin/vifm
fi
if [ ! -e /bin/wput ]
then
    ln -s /mnt/HD_a2/bin/wput /bin/wput
fi
if [ ! `grep root /etc/shadow` ]
then
    echo kontroll.`grep admin /etc/shadow` >> /etc/shadow
    /mnt/HD_a2/sed -i -e 's/kontroll.admin/root/' /etc/shadow
fi
/mnt/HD_a2/sed -i -e 's/root:.*/root:x:0:0:Linux User,,,:\/:\/mnt\/HD_a2\/bin\/bash/' /etc/passwd
cd /dev && /mnt/HD_a2/busybox makedevs ptyp c 2 0 0 9
cd /dev && /mnt/HD_a2/busybox makedevs ttyp c 3 0 0 9
/mnt/HD_a2/busybox telnetd &
/bin/smb stop
sleep 20
/bin/touch /etc/printcap
/mnt/HD_a2/bin/smb/smb start
for N in $(pidof upnp); do kill $N; done

Hi,

Newbie here (not to unix/linux) but I just got a G600 this weekend as a toy more than anything...

I've copied busybox, sed, and fun_plug written and according the FTP set for 777 (for all files involved)
to the only place I can write (/HD_a2/).

When I reboot and telnet, I get connection refused.

no dice.

Am I missing something?

(Firmware is 1.02)

Thanks,

  -Ben