I've got root!
I can't take any real credit for it, I relied heavily on comments I read on asham.ca for the KD20, but it works!
It requires: A Linux box or Macintosh
A folder made and a user added with full permissions to it on the KD21 through its web interface.
Start SSH on the kd21 by going to <nas ip>/admin/ with a web browser and log in with the username atonnas and password backdoor when it asks you to authenticate. Click on the ssh link in the left pane and enable SSH on the pane that appears on the right.
Linux/Macintosh: Start a Terminal session and make a sym link to /
eg: ln -s / ./beer
My example will make a sym link named beer in your current folder that will navigate to the root filesystem.
Connect to the share via smb or afp from Linux/Mac with the user you made, navigate to your folder and copy the sym link (in my case, beer) into your folder.
Go to your KD21 via web url, <nas ip>/filesystem/index.php
This will start AjaXplorer.
Authenticate with the user and password you made, and select the folder you made via the dropdown menu. Go into the sym link you made (beer in my case). You are now in the root (/) filesystem!
Upload a php backdoor to /usr/htdocs/admin. I used php-backdoor.php which I found at http://users.freenet.am/~zombie/src/backdoor.php
After uploading it to /usr/htdocs/admin, you can now navigate to this backdoor by going to <nas ip>/admin/backdoor.php in your web browser
I executed the command echo -e "beer\nbeer\n" | sudo passwd root
This changed my root password to beer and allowed me to ssh into my kd21.
From here on out, it's all yours. I have a backup of the original passwd file because I fully intend to run it through hashcat and john the ripper.
I filed a support ticket with Shuttle a while back with the faint hope that they might consider opening SSH in their future FW updates. They went one step further and released the entire source code! If anyone is interested it can be downloaded here:http://us.shuttle.com/download/KD21_KD22OpenSource.zip
Their support agent also told me they're working on "opening SSH".
I haven't had a chance to look at the FW yet (and I'm no expert). Hopefully this will open up the box to more possibilities.