DSM-G600, DNS-3xx and NSA-220 Hack Forum

fonz wrote:

Try

Code:

utelnetd -l /bin/sh

You'll get a root shell. For login to work, you need to set a password for root, and make sure it's stored in /etc/shadow (restored from flash after reboot!)

As I said before, login works for accounts other than root.  Only root login fails.

I tried setting password for root, but this does not get updated in /etc/shadow.  Somehow it looks like root password is not updated in /etc/shadow.

I worked out a way to add it manually to /etc/shadow file, but I am looking for a better solution.

Transcript below with encrypted passwords deleted.

Kind regards,

Jaya

# cat /etc/shadow
admin:[deleted]:0:0:99999:7:::
nobody:[deleted]:0:0:99999:7:::
# passwd
Changing password for root
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers.
Enter new password:
Bad password: too short.

Warning: weak password (continuing).
Re-enter new password:
Password changed.
# cat /etc/shadow
admin:[deleted]:0:0:99999:7:::
nobody:[deleted]:0:0:99999:7:::
#

Last edited by jayas (2008-01-25 01:41:29)

Hello,

Many thanks to Fonz, here is the complete solution to do what I wanted which will clone "admin" password at boot time as the "root" password, and only allow "root" to telnet to DNS-323 in way that allows the disks to be fully dismounted while in the telnet session.

Enjoy.

Jaya

fun_plug contents:

#!/bin/sh

# switch to disk environment
cd /mnt/HD_a2

# transcript log ...
logFile=$PWD/fun_plug.log

{
    # boot timestamp
    date

    # execution trace
    set -x

    # install telnet
    cp telnet/utelnetd /sbin
    cp telnet/busybox3 /sbin

    # replace shell
    mv -f /bin/sh /bin/sh.old
    ln -s /sbin/busybox3 /bin/sh

    # establish console
    mknod /dev/ptyp0 c 2 0
    chmod 0666 /dev/ptyp0
    mknod /dev/ttyp0 c 3 0
    chmod 0666 /dev/ttyp0 

} >$logFile 2>&1

# revert to host environment
cd /home/root

# restrict telnet users
cp /etc/passwd passwd
sed -e '2,$s|:/home/.*|:/:/bin/sync|' passwd >/etc/passwd
echo "/etc/passwd updated" >>$logFile

# clone admin password
sed -n -e 's|^admin:|root:|p' /etc/shadow >>/etc/shadow
echo "/etc/shadow updated" >>$logFile

# start telnet daemon
utelnetd -l /bin/login -d
echo "telnet daemon started" >>$logFile

HaydnH wrote:

"and only allow "root" to telnet to DNS-323"
You do realise that telnet sends passwords in plain text - therefore anyone on your network will be able to see your root password using simple commands like snoop or tcpdump? If anyone other than you has access to the network I would suggest using ssh instead.

My next step is to switch enable only https and ssh, and would appreciate pointers as to how well https works on this box and where I can get ssh.

Jaya