DSM-G600, DNS-3xx and NSA-220 Hack Forum

fonz wrote:

Tilly wrote:

The German DL-Support Board offer a simple small remote shutdown tool with which it is possible to shutdown the DNS-323 without a login into the webinterface.

It's not a bug, it's a feature...

Hi Fonz

Which maybe bug, which maybe feature?

luusac wrote:

PhilW's vista gadget also offers this.  You can also set up a webshortcut on your desktop to call the relevant shutdown script.

That´s right, but how do you use this nice Vista gadget from PhilW with XP?

So everyone (on the LAN) can shutdown the dns without a password?

Loose Gravel wrote:

So everyone (on the LAN) can shutdown the dns without a password?

Why not try it and find out?

Last time I checked it needed authentication provided no one had authenticated from the system you were on in the previous five or ten minutes.

fordem wrote:

Last time I checked it needed authentication provided no one had authenticated from the system you were on in the previous five or ten minutes.

That is possible, it is a while since I used xp, so I can't remember whether I was doing this.  When I wanted to shut down the unit, I just used to double click on the desktop shortcut pointing to the relevant form url.  even if you do need to authenticate for this, security is still poor on the unit though :-)

luusac wrote:

fordem wrote:

Last time I checked it needed authentication provided no one had authenticated from the system you were on in the previous five or ten minutes.

That is possible, it is a while since I used xp, so I can't remember whether I was doing this.  When I wanted to shut down the unit, I just used to double click on the desktop shortcut pointing to the relevant form url.  even if you do need to authenticate for this, security is still poor on the unit though :-)

hi fordem

The statement by luusac is right!

Mabe you doesn´t use the right shutdown script or shutdown way without a login before!?

hmm, not quite sure what you mean, "vista gadget" or "windows vista gadget" are pretty synonymous ?

I have had a look at the software you mention.  I don't see anywhere in the configuration to put a username or password in.  When you initially install telnet you get root access without having to enter a password.  This is perhaps what this software relies on as the batch file makes a telnet call, or at least passes the command "-telnet [IP address of nas] <shutdown.txt" with shutdown.txt containing the command to run on the nas.  However, as I don't have the source for "plink.exe" I am not going to run it to find out :-)  If it does not have the option for passwd/username then it won't be of any use to those who have given the root user a passwd.

As to the authentication issue, the d-link forum post you directed us to does state that the behaviour changed in f/w 1.05bXY it is quite possible when I was following a url shortcut in XP that I was running f/w 1.04.

Tilly wrote:

Please: http://www.chiark.greenend.org.uk/~sgta … nload.html

Ok, I should have googled it, not knowing it I thought that it was something somebody had posted to the other forum.  I use and trust putty and so would plink too.

luusac wrote:

If it does not have the option for passwd/username then it won't be of any use to those who have given the root user a passwd.

Having looked at the documentation I see that plink does support username and password logins.  Note that it supports telent as well as i.a. ssh with telnet or ssh.

Tilly wrote:

With also a DNS-323 there are a lot of scipts and actions which run without the password function or login or authentification.

I am sure, that is what I meant earlier when I was saying about security.  Actually, I misspoke myself, the web shortcut I was referring to was calling a web form, rather than a shell script, but it did the same job - shutting down the unitl.