Firmware 2.2.8 rootable through file explorer and usb stick

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Firmware 2.2.8 rootable through file explorer and usb stick

Post by kea » Wed Oct 03, 2012 10:46 am

The 2.2.8 can be rooted fairly easily through a feature in the built in file explorer.

This is written so that those who knows their way around linux can follow it as they should know the consequences of doing things wrong... The information in here can make your life really miserable and I don't want any part in that!

This was tested on my straight out of the box NS2, your mileage might vary...

- Mount a ext2 formated usb stick on a linux computer.
- Create two symlinks on your stick:
- ln -s /etc/initng/runlevel/default.runlevel default.runlevel
- ln -s /etc/shadow shadow
- Mount the stick on your NS2.
- Launch the file browser from the web console, browse to the USB share.
- Right click on default.runlevel, select open in -> other -> source editor.
- Fix the sshd entry.
- Reboot.
- Edit the shadow using the method above, copy the admin hash to the root account.
- ssh as root to your NS2 on port 2222.

nicolcuisto
Posts: 11
Joined: Mon Mar 29, 2010 5:21 pm
Location: Dunkerque / France

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by nicolcuisto » Fri Oct 26, 2012 9:25 pm

Hello , can you share the two symlink, i have not linux....
thx.

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by kea » Sat Oct 27, 2012 8:49 pm

I hope you know what you are doing... and you should understand the implication of your actions and not just blindly following what I say.

I created a small loop back file system in which I created the links for you.

dd bs=1024 count=50 if=/dev/zero of=link.img
mke2fs link.img
mount link.img /mnt
ln -s /etc/initng/runlevel/default.runlevel default.runlevel
ln -s /etc/shadow shadow
umount /mnt

The image can be written to a usb stick using win32imager, it can be downloaded from https://launchpad.net/win32-image-writer/+download.

Please note that this will overwrite everything on your usb stick, and you must re-format it in windows afterwords in order to be able to use it with windows...

The image can be downloaded from http://kea.penti.org/lacie

nicolcuisto
Posts: 11
Joined: Mon Mar 29, 2010 5:21 pm
Location: Dunkerque / France

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by nicolcuisto » Sun Oct 28, 2012 2:49 am

shit.... work fine!!!!! very very thx !!!!! :!: :!: :!: :!: :!:

nicolcuisto
Posts: 11
Joined: Mon Mar 29, 2010 5:21 pm
Location: Dunkerque / France

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by nicolcuisto » Wed Oct 31, 2012 8:01 pm

hi!! after reboot my ns2 , i lost my root access.... why?

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by kea » Wed Oct 31, 2012 9:07 pm

I noted the same on mine, I believe it writes the default hash to /etc/shadow on each reboot, same happens with some other config files.

I haven't investigated the mechanism behind it as I'm using ssh keys to access it.

The password overwriting is a new behavior, my older one with firmware 2.0.5 does only reset the hash when shares are modified.

So you have to redo the /etc/shadow change and then try to fix a permanent root, maybe add a new account with UID 0 and see if that survives a boot or just go ahead with ssh keys.

The NS2 accepts key authentication by default so it's just a matter of adding your key to /root/.ssh/authorized_keys.

Take a look at http://www.linux-sxs.org/networking/openssh.putty.html as an example if you are using putty.

jzw
Posts: 3
Joined: Sun Jan 13, 2013 3:55 pm

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by jzw » Sun Jan 13, 2013 4:04 pm

For information for anyone using Mac OS X: it is not necessary to use Linux or an ext2-formatted USB stick to get this procedure to work. On the Mac, replace the first step in the original post with:

- Mount a HFS+ (Mac OS Extended) formatted USB stick on a your Mac.

HFS+ is the standard format used by OS X, but you can check and reformat your stick, if needed, using Disk Utility.

You can now follow the rest of the procedure, using the Terminal application to create the appropriate symbolic links as described in the original post. The NetworkSpace 2 recognises the HFS+ formatted USB stick and symlinks fine when you mount it in the NS2 USB port. Much easier for a Mac user than trying to get access to a Linux system or an ext2 filesystem driver.

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by kea » Thu Jan 17, 2013 2:00 pm

Might be that you could altogether skip the USB stick, might be possible to just create a USB share and format that as HFS+.

http://manuals.lacie.com/en/manuals/ns2-nsmax/usb
Technical note: USBShare, when it is created by the LaCie NAS OS, is formatted in MS-DOS (FAT32) for use with PCs and Macs. You may format USBShare into a different file format (NTFS or HFS+) using your computer's native disk management application.

Steps would be:
- Create USB share
- Connect to your mac via USB
- Format as HFS+
- Create links
- Disconnect from the mac
- Open the built in file explorer

joneo74
Posts: 1
Joined: Wed Aug 28, 2013 3:55 pm

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by joneo74 » Sat Sep 21, 2013 10:05 pm

Sorry, i'm newbies, i don't understand how to fix the sshd. I followed your steps:

1. Mount a ext2 formated usb stick on a linux computer.
2. Create two symlinks on your stick:
3. ln -s /etc/initng/runlevel/default.runlevel default.runlevel
4. ln -s /etc/shadow shadow
5. Mount the stick on your NS2.
6. Launch the file browser from the web console, browse to the USB share.
7. Right click on default.runlevel, select open in -> other -> source editor.

i don't understand thhe other steps:

8. Fix the sshd entry. (HOW?!?!!?!)
9. Reboot.
10. Edit the shadow using the method above, copy the admin hash to the root account.
11. ssh as root to your NS2 on port 2222.

If you help me i'll very happy!!!!
Thanks for all

Giovanni

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by kea » Mon Sep 23, 2013 9:15 am

As stated in my original post:
This is written so that those who knows their way around linux can follow it as they should know the consequences of doing things wrong...
The missing clues can be picked up from andreus post
viewtopic.php?f=240&t=4609

Kim

sunsear
Posts: 2
Joined: Wed Jun 19, 2013 5:27 pm

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by sunsear » Thu Dec 19, 2013 7:53 pm

Thanks kea, your trick still works wonders!

kea
Posts: 39
Joined: Fri Sep 16, 2011 6:18 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by kea » Tue Nov 25, 2014 2:02 pm

usb stick is not needed after all on 2.2.8... not sure about the newer firmwares.

- Enable sftp from the web gui on your NS2
- Connect with sftp client as admin, cd to admin share and create the two symlinks.

Code: Select all

kea@raspberry:~$ sftp admin@backup01
admin@backup01's password:
Connected to backup01
sftp> cd MyShare
sftp> symlink /etc/shadow shadow
sftp> symlink /etc/initng/runlevel/default.runlevel default.runlevel
sftp> exit
- Launch the file browser from the web console, browse to the MyShare share.
- Right click on default.runlevel, select open in -> other -> source editor
- Fix the sshd entry
- Reboot the NS2
- Edit the shadow using the method above (copy the admin hash to the root account)
- ssh as root to your NS2 on port 2222.

jzw
Posts: 3
Joined: Sun Jan 13, 2013 3:55 pm

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by jzw » Tue Mar 31, 2015 8:06 pm

Excellent trick kea, wonderful to be able to root the NS2 just using the built-in sftp. So much less hassle than the USB stick method.

One thing for others to note is for me the NS2 used port 22 for sftp (in case you are trying to access it on port 2222).

Thanks again!

Spoon1
Posts: 1
Joined: Sat May 16, 2015 5:36 pm

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by Spoon1 » Sat May 16, 2015 5:46 pm

kea wrote:usb stick is not needed after all on 2.2.8... not sure about the newer firmwares.

- Enable sftp from the web gui on your NS2
- Connect with sftp client as admin, cd to admin share and create the two symlinks.

Code: Select all

kea@raspberry:~$ sftp admin@backup01
admin@backup01's password:
Connected to backup01
sftp> cd MyShare
sftp> symlink /etc/shadow shadow
sftp> symlink /etc/initng/runlevel/default.runlevel default.runlevel
sftp> exit
- Launch the file browser from the web console, browse to the MyShare share.
- Right click on default.runlevel, select open in -> other -> source editor
- Fix the sshd entry
- Reboot the NS2
- Edit the shadow using the method above (copy the admin hash to the root account)
- ssh as root to your NS2 on port 2222.
I confirm that this still works on NS2 with 2.2.10.1 update. Thx for this.

Harald
Posts: 5
Joined: Mon Jul 11, 2016 5:31 am

Re: Firmware 2.2.8 rootable through file explorer and usb st

Post by Harald » Mon Jul 11, 2016 6:54 am

Hello all.
I have to change the name of a shared USB disk attached to my Network Space 2 and I’m trying this method and it’s failing (NAS OS V 2.2.12.2).
kea wrote:
- Edit the shadow using the method above (copy the admin hash to the root account)
I’ve the two symlinks created in MyShare but I can’t open any when logged with SFTP as admin account using Notepad ++.
No such file or directory.
Error code: 2
Error message from server (en-US): No such file
How can I fix this issue?
Thanks for help.

Post Reply