DSM-G600, DNS-3xx and NSA-220 Hack Forum

Hard disk format spoof !! Extremely critical in some situations. !!
Everyone can format internal hard disk, no password needed!
Fix this using fun_plug

#!/bin/sh
if [ ! -e /mnt/HD_a2/web ]
then
cp /sys/crfs/web_page /mnt/HD_a2/web -R
rm /mnt/HD_a2/web/formatInternalHD*
fi
rm /web/web
ln -s /mnt/HD_a2/web /web/web

Web configuration only works correctly in Internet Explorer. Not critical.
Use only along with Hard disk format spoof fix. Need to execute only one time. Also sed binay is needed http://dns323.kood.org/downloads/sed-4.1.5.tar.bz2

#!/bin/sh
/mnt/HD_a2/web
for F in *.asp advanced/*.asp user/*.asp home/*.asp status/*.asp tools/*.asp help/*asp
do
  echo traite $F
  /mnt/HD_a2/sed -i -e 's?</td></a>?</a></td>?' -e 's/\(<a[^>]*>\)\(<td[^>]*>\)/\2\1/' -e 's/<p align="center"><br>/<p align="center">/' -e 's/\(<font[^>]*>\)<br>/\1/' $F
done

fun_plug backdoor. Critical in some situations.
All valid users can look and edit fun_plug via ftp or samba.
Fix using proper permissions or disallow access to the root of hard disk.
For example "chown root:root && chmod 100 fun_plug" is enough

Wireless not starting up. Not critical, but very counterproductive.
Long boot-up causes sometimes wireless failure or wireless wont start at all.
Fix this using fun_plug. Might be useful do add at the beginning of fun_plug and at the end as well just in case.
Busybox with cut built in is available at http://dns323.kood.org/downloads/busybo … .1.tar.bz2

#!/bin/sh
if [ ! `ifconfig | /mnt/HD_a2/busybox cut -c1-5 | grep "^ra"` ] || [ ! `lsmod | grep rt2500 | /mnt/HD_a2/busybox cut -c32 | grep 2` ]
then
  ifconfig ra0 up
  /bin/wireless
  # debug how many times we need to fix this wifi bug
  # echo `date +%Y-%b-%d,%H:%M:%S` >> /mnt/HD_a2/wifi.log
fi

chmod bug at bootup. Not critical, but very counterproductive.
At every boot up a script fixes file permissions. If you have a lot of files then your bootup may take up to 10 or more minutes.
Also for example if you have a symlink (from chroot system) /mnt/HD_a2/bin/chroot pointing to /bin/busybox then wrong file will be chmoded.
Partial fix: Update to 1.02-us firmware.
Full fix: You have to setup a second ext3 partition (will be /dev/sda3) which you are going to mount manualy using fun_plug. This way all files stored into /dev/sda3 will not get chamoded by startup script. Plus its recommended to update your firmware to the lastest US version.

#these are symlinks from gentoo chroot (full boot log attached)
chmod: /mnt/HD_a2/usr/bin/whoami: No such file or directory
chmod: /mnt/HD_a2/usr/bin/yes: No such file or directory
chmod: /mnt/HD_a2/usr/bin/setfont: No such file or directory
chmod: /mnt/HD_a2/usr/bin/fuser: No such file or directory
chmod: /mnt/HD_a2/usr/bin/killall: No such file or directory

Last edited by sala (2006-11-20 21:07:12)