![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
Promise NS4300Nに関するページです。 †NS4300Nとは †RAIDコントローラで有名なPromise社のNASキット。最大4台のSATAドライブを内蔵可能。コレガのCG-NSC4500GTはOEM版。 情報 †
ハードウェア †仕様 †
MTDマップ †
/proc/cpuinfo †processor : 0 cpu : e300 revision : 1.1 (pvr 8083 0011) bogomips : 265.21 chip : MPC83xx Vendor : Freescale Inc. Machine : mpc83xx sys core clock : 399 MHz bus clock : 266 MHz PVR : 0x80830011 SVR : 0x80570011 PLL setting : 0x6 Memory : 128 MB /proc/meminfo †MemTotal: 126844 kB MemFree: 35104 kB Buffers: 43548 kB Cached: 24752 kB SwapCached: 0 kB Active: 39848 kB Inactive: 35780 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 126844 kB LowFree: 35104 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 56 kB Writeback: 0 kB Mapped: 15388 kB Slab: 7508 kB CommitLimit: 63420 kB Committed_AS: 55712 kB PageTables: 528 kB VmallocTotal: 851968 kB VmallocUsed: 19432 kB VmallocChunk: 832284 kB /proc/mtd †dev: size erasesize name mtd0: 00040000 00020000 "U-Boot" mtd1: 00040000 00020000 "U-Boot_ENV" mtd2: 001c0000 00020000 "Kernel" mtd3: 00320000 00020000 "Rootfs" mtd4: 00800000 00020000 "Usr" mtd5: 001a0000 00020000 "Promise" mtd6: 00100000 00020000 "Data" ソフトウェア †dmesg出力 (Ver. 010507) †Linux version 2.6.11SR3_1_2 (root@localhost.localdomain) (gcc version 3.4.3) #4 Mon Feb 4 07:25:45 CST 2008 On node 0 totalpages: 32768 DMA zone: 32768 pages, LIFO batch:8 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/ram rw console=ttyS0,115200 IPIC (128 IRQ sources, 8 External IRQs) at fe000700 PID hash table entries: 1024 (order: 10, 16384 bytes) Console: colour dummy device 80x25 Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Memory: 123168k available (2292k kernel code, 668k data, 312k init, 0k highmem) Calibrating delay loop... 265.21 BogoMIPS (lpj=132608) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) checking if image is initramfs...it isn't (no cpio magic); looks like an initrd Freeing initrd memory: 3189k freed NET: Registered protocol family 16 PCI: Probing PCI hardware PCI: bridge rsrc 0..ffffff (100), parent c028be7c PCI: bridge rsrc 80000000..9fffffff (200), parent c028be60 PCI:0000:00:00.0: Resource 0: 00000000-000fffff (f=200) PCI: Cannot allocate resource region 0 of device 0000:00:00.0 PCI: parent is c0333054: 80000000-9fffffff (f=200) PCI:0000:00:00.0: Resource 2: 40000000-7fffffff (f=120c) PCI: Cannot allocate resource region 2 of device 0000:00:00.0 PCI:0000:00:00.0: Resource 4: 00000000-3fffffff (f=120c) PCI: Cannot allocate resource region 4 of device 0000:00:00.0 PCI: parent is c0333054: 80000000-9fffffff (f=200) PCI:0000:00:0e.0: Resource 0: 9ffff000-9fffffff (f=200) PCI:0000:00:0e.1: Resource 0: 9fffef00-9fffefff (f=200) PCI:0000:00:10.0: Resource 0: 00ffff80-00ffffff (f=101) PCI:0000:00:10.0: Resource 2: 00fffe00-00fffeff (f=101) PCI:0000:00:10.0: Resource 3: 9fffd000-9fffdfff (f=200) PCI:0000:00:10.0: Resource 4: 9ffc0000-9ffdffff (f=200) PCI: Failed to allocate mem resource #2:40000000@c0000000 for 0000:00:00.0 PCI: Failed to allocate mem resource #4:40000000@c0000000 for 0000:00:00.0 Registering ipic with sysfs... SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) squashfs: version 3.0 (2006/03/15) Phillip Lougher Installing knfsd (copyright (C) 1996 okir@monad.swb.de). JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. Initializing Cryptographic API MPC83xx SPI Driver on MDS board: Revision: 1.0 Successfully registered spi major=252 MPC83xx GPIO Driver on MDS board: Revision: 1.0 Successfully registered gpio major=253 Real Time Clock Driver v1.10f MPC83xx Watchdog Demo Init Serial: 8250/16550 driver $Revision: 1.1.1.1.2.1 $ 4 ports, IRQ sharing disabled ttyS0 at MMIO 0xe0004500 (irq = 9) is a 16550A ttyS1 at MMIO 0xe0004600 (irq = 10) is a 16550A io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize loop: loaded (max 8 devices) gfar_driver_version = 1.1a GFAR: ECNTRL=00001018, MACCFG1,2=00000030,00007205 eth0: Gianfar Ethernet Controller Version 1.1, 00:0a:79:b9:91:ee eth0: MTU = 1500 (frame size=1514,truesize=1784) eth0: Running with NAPI enabled eth0: 64/64 RX/TX BD ring size eth0: Socket buffer recycling mode enabled SKB Handler initialized(max=64) MPC8349MDS flash device: 1000000 at fe000000 Partition number 7 MPC8349MDS Flash Map Info: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 MPC8349MDS Flash Map Info: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. add_mtd_partitions Creating 7 MTD partitions on "MPC8349MDS Flash Map Info": 0x00000000-0x00040000 : "U-Boot" ftl_cs: FTL header not found. 0x00040000-0x00080000 : "U-Boot_ENV" ftl_cs: FTL header not found. 0x00080000-0x00240000 : "Kernel" ftl_cs: FTL header not found. 0x00240000-0x00560000 : "Rootfs" ftl_cs: FTL header not found. 0x00560000-0x00d60000 : "Usr" ftl_cs: FTL header not found. 0x00d60000-0x00f00000 : "Promise" ftl_cs: FTL header not found. 0x00f00000-0x01000000 : "Data" ftl_cs: FTL header not found. MPC8349MDS flash device initialized ehci_hcd 0000:00:0e.1: NEC Corporation USB 2.0 ehci_hcd 0000:00:0e.1: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0e.1: irq 21, io mem 0x9fffef00 ehci_hcd 0000:00:0e.1: park 0 ehci_hcd 0000:00:0e.1: USB 2.0 initialized, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 3 ports detected ohci_hcd: 2004 Nov 08 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd 0000:00:0e.0: NEC Corporation USB ohci_hcd 0000:00:0e.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:0e.0: irq 21, io mem 0x9ffff000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 3 ports detected usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver usbcore: registered new driver hiddev usbcore: registered new driver usbhid drivers/usb/input/hid-core.c: v2.01:USB HID core driver mice: PS/2 mouse device common for all mice i2c /dev entries driver device-mapper: 4.4.0-ioctl (2005-01-12) initialised: dm-devel@redhat.com NET: Registered protocol family 2 IP: routing cache hash table of 1024 buckets, 8Kbytes TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 3, 32768 bytes) TCP: Hash tables configured (established 8192 bind 8192) NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 5 RAMDISK: Compressed image found at block 0 VFS: Mounted root (ext2 filesystem). Freeing unused kernel memory: 312k init Promise FastTrak TX 4310 Serieal Device Driver 2.6.0.0330 (Sep 01, 2006) PRODUCT_VERSION SR1_1_5 Build_Time Mar 27 2008 17:11:22 Required extension size: max: 2061328 Min: 1554420 fasttrak 0000:00:10.0: Found FastTrak Controller with IRQ: 23 Required DMA safe size: max: 169992 Min: 6556 Required DMA safe size: max: 169992 Min: 6556 scsi0 : ftsata2 Vendor: Promise Model: 4 Disk RAID5 Rev: 1.10 Type: Direct-Access ANSI SCSI revision: 02 sda : very big device. try to use READ CAPACITY(16). SCSI device sda: 5860182144 512-byte hdwr sectors (3000413 MB) sda: asking for cache data failed sda: assuming drive cache: write through sda : very big device. try to use READ CAPACITY(16). SCSI device sda: 5860182144 512-byte hdwr sectors (3000413 MB) sda: asking for cache data failed sda: assuming drive cache: write through unknown partition table Attached scsi disk sda at scsi0, channel 0, id 0, lun 0 Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0, type 0 Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. fuse init (API version 7.8) fuse distribution version: 2.7.4 kjournald starting. Commit interval 5 seconds EXT3 FS on dm-0, internal journal EXT3-fs: mounted filesystem with ordered data mode. eth0: MTU = 9000 (frame size=9014,truesize=9464) fifo_tx_thr=100,1c0 fifo_tx_sp=10,25 fifo_tx_starve=80,1a0 fifo_tx_starve_shutoff=100,1c0 fifo_rx_alarm=100,40 fifo_rx_alarm_shutoff=80,20 fifo_rx_panic=180,60 fifo_rx_panic_shutoff=100,40 eth0: PHY is IP1001 (2430d90) eth0: Full Duplex eth0: Speed 1000BT eth0: Link is up eth0: Flow control is on glibcのバージョン (/lib/libc.so.6 の出力) †# /lib/libc.so.6 GNU C Library stable release version 2.3.2, by Roland McGrath et al. Copyright (C) 2003 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled by GNU CC version 3.3.6 (Debian 1:3.3.6-4). Compiled on a Linux 2.6.0-test7 system on 2005-05-10. Available extensions: GNU libio by Per Bothner crypt add-on version 2.1 by Michael Glad and others linuxthreads-0.10 by Xavier Leroy BIND-8.2.3-T5B libthread_db work sponsored by Alpha Processor Inc NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk software FPU emulation by Richard Henderson, Jakub Jelinek and others Report bugs using the `glibcbug' script to <bugs@gnu.org>. ファームウェア †Ver. 010105 †
Ver. 010205 †
Ver. 010507 †どのバージョンからか不明だが、アップグレード用のファームウェアファイルが暗号化されるようになっている。ここによると、カスタマイズされたbcryptコマンドを使って blowfish encryption and signed されているらしい。今までのように、簡単にハックはできなくなったようだ。 ハック †Corega NSC-4500GT を Promise NS4300N 化する †1年ほど前に購入した NSC-4500GT を今更ながら Promise 化する。このモデルは、Buffalo製品と異なり、ファームウェアを一旦 NAS 上のディレクトリにコピーした後、Web画面でそのファイルを指定することにより、ファームウェアの更新がなされるようになっている。したがって、まず最初に RAID 領域を作成し、フォーマットを済ませておく。後は、順次古いファームウェアから順番に更新していけばよい。今回は、Corega版のファームが古かった（多分、Ver.01.01.2140.10）ので、 Corega版ファーム → ns4300_010206.upg(ftp://ftp.winco.com.hk/product/Promise/NS4300N/firmware/にあるやつ) の順に更新した。 010507へのアップグレードではじめて、作業の進捗状況を示すバーが表示されるようになった。 rootのパスワードを変更する †Application Pluginを利用する方法 †rosvall rosvall ist offline Neuer Benutzer Registriert seit: 12.08.2007 Beiträge: 1 Renommee-Modifikator: 0 rosvall befindet sich auf einem aufstrebenden Ast Quick telnet hack via application plugin My german is a bit rusty, so please bear with me. Note: i tried to post this in the ns4300n-info.de forum, but i get a http-error. Long story short: After countless hours spent trying to crack the root password in /etc/shadow in the firmware image from promise, i remembered the seemingly stupid "Application Plugin" thingy in the web interface. With access to the perl/php scripts for the webinterface it's pretty easy to figure out how to make such a plugin, so i set out for making a little shell script to add the admin user to /etc/sudoers and /etc/telnet.user. The files that the plugin-thingy accepts has a pretty obscure format, like the firmware image itself. The first 97KB is discarded, and after that there has to be a gzipped tar containing a file called "rev" and the application itself in a dir named the same as the plugin. The rev file needs to contain three lines in a format like: PKGNAME=my_plugin_name PKGVERSION=X.X.9999.X FWVERSION=010105 You can substitute the X'es as you like, but the 9999 is some sort of oem-code, whatever that is. Of course the my_plugin_name is substituted for the name of your plugin. Anyways, as far as i can see, the only way to get it to execute something from the plugin-package is to call the plugin DLNA, which will make the "DLNA" tab in the web interface light up. Then, when you choose enable service, it will try to execute /VOLUME1/PROMISEAPP/DLNA/.server/fupper So what i did, was i made a ./rev like: -----cut------- PKGNAME=DLNA PKGVERSION=1.0.9999.0 FWVERSION=010105 -----cut------- And a ./DLNA/DLNA/.server/fuppes like: -----cut----- #!/bin/ash echo "admin ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers echo "admin" >> /etc/telnet.user -----cut------ ...did a chmod +x ./DLNA/DLNA/.server/fuppes and put it all in a tarball with tar cvfz telnet-hack.tgz ./rev ./DLNA Now i had the tarball, i just needed the 97kB of padding: dd if=/dev/urandom of=telnet-hack bs=97k count=1 and put it together with cat telnet-hack.tgz >> telnet-hack And here it is: http://rapidshare.com/files/48464094...ack-combo.html (Please, for the sake of your own security, make your own plugin like described or at least verify that mine does what i say it does.) Just upload the file to the ns4300n, go to the Management->System Upgrade->Application Plugin page on the web interface and fill out the form. When it has done it's thing, go to File & Print->Protocol Control->DLNA and enable it. Then you should be able to login via telnet on port 2380 with you admin user. I'm sorry if i didn't make much sense, i have been at it for about 20 hours now, and i really need some sleep WebGUIの脆弱性を利用する方法 †以下の内容は旧バージョンのファームウェアで可能だが、最近のバージョンでは使えないテクニックと思われる。 情報源：SecurityFocus Promise NAS NS4300N GUI bug Promise NAS NS4300N GUI bug Sep 27 2007 09:19PM Tor Houghton (torh bogus net) List, There is a bug in the Promise NAS NS4300N web GUI (firmware version 1.1.0.5) which allows an authenticated (admin) user to change the password of the 'root' account. The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles this does not check to see if the admin is changing a user account or system accounts such as 'root'. By changing the value of the 'user' parameter to 'root' (from whatever user id whose password is being changed, e.g. 'admin' if you have not defined any users) in the POST request to /usercp.php, we can provide a known password for the root account and thereby login to the NAS (which is normally not possible because Promise has not divulged root's password). The vendor has not been notified, but this is hardly a critical issue..? Tor moonshade:~$ telnet 192.168.5.16 2380 Trying 192.168.5.16... Connected to 192.168.5.16. Escape character is '^]'. NS4300N R1.1 A10 (Version 01.01.0000.05) - Promise Technology, INC. nas login: root Password: BusyBox v1.00-rc2 (2006.11.07-01:55+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. root is allowed to login. [root@nas]# dmesg Linux version 2.6.11SR1_1_2 (root (at) localhost (dot) loca [email concealed]ldomain) (gcc version 3.4.1) #2 Tue Apr 3 15:43:13 CST 2007 On node 0 totalpages: 32768 DMA zone: 32768 pages, LIFO batch:8 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/ram rw console=ttyS0,115200 IPIC (128 IRQ sources, 8 External IRQs) at fe000700 PID hash table entries: 1024 (order: 10, 16384 bytes) Console: colour dummy device 80x25 Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Memory: 123936k available (2276k kernel code, 660k data, 312k init, 0k highmem) Calibrating delay loop... 265.21 BogoMIPS (lpj=132608) -- http://www.bogus.net/~torh Webからシャットダウンする †情報：2ch [うんcorega]NAS 「HDD Bank TERA」 Vol.1
326 ：不明なデバイスさん：2007/12/07(金) 23:49:53 ID:843Ig8N5
>>321みてて、sendkeyでtelnet操作してるの見てて、
IEオブジェクト使ってWEB画面操作でもいいんじゃねと思って作ってみた。
プロミスファームでは普通に動いた。
多分、これならコレガファームでもいけると思う。改変必要かも知んないけど…
ファイル名：適当.vbs
=======
strIP = "xxx.xxx.xxx.xxx" '←IPアドレスとか
strLogin = "admin"
strPwd = "xxxxxxxx" '←パスワード
Set objIE = CreateObject("InternetExplorer.Application")
objIE.Visible = False
objIE.Navigate "http://" & strIP
While objIE.Busy = true:WScript.sleep(250):Wend:WScript.sleep(500)
objIE.Document.Forms(0).login.value = strLogin
objIE.Document.Forms(0).password.value = strPwd
objIE.Document.Forms(0).submit.click
While objIE.Busy = true:WScript.sleep(250):Wend:WScript.sleep(500)
objIE.Navigate "http://" & strIP & "/shutdown.php"
While objIE.Busy = true:WScript.sleep(250):Wend:WScript.sleep(500)
objIE.Document.Main.Radiosubmit(1).checked = true
objIE.Document.Main.submit.Onclick = "return true"
objIE.Document.Main.Submit.Click
While objIE.Busy = true:WScript.sleep(250):Wend:WScript.sleep(500)
objIE.Quit
Set objIE = Nothing
=======
Application-Plugin †ここやここによると、NS4300Nの"Application Plugin" は、先頭の97KBにごみがついた tar.gz ファイルである。tar.gz は。revという名前のファイルとプラグイン名のディレクトリで構成される。 DLNA-plugin-v010106-beta †$ unzip dlna_plugin_v0000_010106-beta.zip $ dd if=dlna_plugin_v0000_010106-beta.ppg of=dlna_plugin_v0000_010106-beta.tar.gz bs=97k skip=1 $ file * dlna-build6-beta-readme.pdf: PDF document, version 1.6 dlna_plugin_v0000_010106-beta.ppg: data dlna_plugin_v0000_010106-beta.tar.gz: gzip compressed data, from Unix, last modified: Thu Feb 12 17:46:33 2009 dlna_plugin_v0000_010106-beta.zip: Zip archive data, at least v2.0 to extract $ mkdir contents $ tar zxvf dlna_plugin_v0000_010106-beta.tar.gz -C contents $ ls -al contents 合計 4 drwxr-xr-x 3 hoge users 96 2009-04-07 12:42 . drwxr-xr-x 3 hoge users 288 2009-04-07 12:42 .. drwxr-xr-x 4 hoge users 128 2008-10-30 19:30 dlna -rw-r--r-- 1 hoge users 87 2009-02-09 16:29 rev rev †$ cat rev PKGNAME=dlna PKGVERSION=01.01.0000.06 FWVERSION=01.03.0000.01 FIXSCRIPT=upgrade_script dlna/upgrade_script †#!/usr/bin/perl
unlink("/data/etc/server/dlna");
system("echo no >/etc/server/dlna");
$first_volume = "";
$music_path = "";
$video_path = "";
$picture_path = "";
open(IN,"/bin/df |");
while(<IN>){
if ( /(VOLUME\d+)/ ) {
if ( -f "/$1/PLUGINAPP/DLNA/.server/fuppes.db" ) {
unlink("/$1/PLUGINAPP/DLNA/.server/fuppes.db");
unlink("/$1/PLUGINAPP/DLNA/.server/.uuid");
system("/bin/rm -rf /$1/PLUGINAPP/DLNA/.server/tmp");
}
if ( $first_volume eq "" ) {
$first_volume = "/$1";
}
if ( $music_path eq "" && -d "/$1/MUSIC" ) {
$music_path = "/$1/MUSIC";
}
if ( $picture_path eq "" && -d "/$1/PICTURE" ) {
$picture_path = "/$1/PICTURE";
}
if ( $video_path eq "" && -d "/$1/VIDEO" ) {
$video_path = "/$1/VIDEO";
}
}
}
close(IN);
#print "$first_volume $music_path $video_path $picture_path\n";
if ( $music_path eq "" ) {
system("/promise/util/addsharefolder.pl \"$first_volume\" MUSIC >/dev/null 2>/dev/null");
system("/promise/util/setsmb.pl add \"$first_volume\" MUSIC >/dev/null 2>/dev/null");
system("/promise/util/setftp.pl add \"$first_volume\" MUSIC >/dev/null 2>/dev/null");
system("/promise/util/setafp.pl add \"$first_volume\" MUSIC >/dev/null 2>/dev/null");
system("/promise/util/setnfs.pl add \"$first_volume\" MUSIC >/dev/null 2>/dev/null");
}
if ( $picture_path eq "" ) {
system("/promise/util/addsharefolder.pl \"$first_volume\" PICTURE >/dev/null 2>/dev/null");
system("/promise/util/setsmb.pl add \"$first_volume\" PICTURE >/dev/null 2>/dev/null");
system("/promise/util/setftp.pl add \"$first_volume\" PICTURE >/dev/null 2>/dev/null");
system("/promise/util/setafp.pl add \"$first_volume\" PICTURE >/dev/null 2>/dev/null");
system("/promise/util/setnfs.pl add \"$first_volume\" PICTURE >/dev/null 2>/dev/null");
}
if ( $video_path eq "" ) {
system("/promise/util/addsharefolder.pl \"$first_volume\" VIDEO >/dev/null 2>/dev/null");
system("/promise/util/setsmb.pl add \"$first_volume\" VIDEO >/dev/null 2>/dev/null");
system("/promise/util/setftp.pl add \"$first_volume\" VIDEO >/dev/null 2>/dev/null");
system("/promise/util/setafp.pl add \"$first_volume\" VIDEO >/dev/null 2>/dev/null");
system("/promise/util/setnfs.pl add \"$first_volume\" VIDEO >/dev/null 2>/dev/null");
}
dlna/DLNA/plugin.conf †APPNAME=DLNA APPSTRING=DLNA Server VERSION=01.01.0000.06 AUTOSTART=NO SWAPMEM=NO APPBINDIR=.server MAINPROCESS=fuppes CONTROLSCRIPT=dlna MediaTomb? 0.11.0 UPnP Server プラグイン(801氏作成) †２ちゃんねるの[うんcorega]NAS 「HDD Bank TERA」801氏によるDLNA機能がまともに動くようにするプラグイン（？） 自分で試していないのだが、801氏から許可をいただいたので、ミラーしておく。
rev †PKGNAME=mediatomb PKGVERSION=01.01.0000.02 FWVERSION=01.02.0000.01 mediatomb/MTOMB/plugin.conf †APPNAME=MTOMB APPSTRING=mediatomb 0.11.0 UPnP Server VERSION=01.01.0000.02 AUTOSTART=NO SWAPMEM=NO APPBINDIR=server MAINPROCESS=mtstart CONTROLSCRIPT=mtcontrol telnetを有効にする †標準のファームウェアでは、ユーザ root と engmode のみが telnet でのログインを許可されているが、いずれもパスワードは公開されていない。また、01.05.0000.03 以降のファームウェアに施された罠(？)にも対策しないといけない。 Firmware 01.05.0000.03 以降の対策 †01.05.0000.03 以降のファームウェアでは、以下に示すように cron から 毎分 /usr/sbin/chkhttpd が呼び出され、/etc/telnet.user に ユーザ root と engmode のみを登録するため、せっかく /etc/telnet.user を書き換えて telnet や ssh でログインするユーザを登録しても、勝手に上書きされてしまうという問題がある。そこで、/usr/sbin/chkhttpd を電源を切っても消えない書き込み可能なエリアにコピーし、一部書き換えたものを crontab に登録すればよい。（参考：PC便利帳: NS4300N Telnet 再有効化とかNS4300N Telnet 有効化 3 | RANDOM.SOFT）
Pluginを構成するファイル群 †.
|-- rev
`-- telnetd
`-- TELNETD
|-- .server
| |-- st_hack
| `-- telnetd.sh
`-- plugin.conf
自作プラグインの作成 †$ cd workdir $ chmod a+x telnetd/TELNETD/.server/st_hack telnetd/TELNETD/.server/telnetd.sh $ sudo chown -R root:root . $ sudo tar czvf ../telnet-hack.tar.gz ./rev ./telnetd $ cd .. $ dd if=/dev/urandom of=telnet-hack_v0000_010102.ppg bs=97k count=1 $ cat telnet-hack.tar.gz >> telnet-hack_v0000_010102.ppg rootになる †上で作成したプラグインをインストールして、telnet-hackを有効にすると、ユーザ admin でログインし、sudoコマンドで root 権限を持つことが可能になる。 $ sudo -s
drobpear plugin の作成 †telnetよりセキュアなSSHでのログインを可能にする。NS4300N用のSSHプラグインが見つけられなかったので、自前でビルドしたが、AVS Forumで見つけちゃった。（SSH on the Promise NS4300N） まあ、他のプラグインの作成にも役立つので、記録として残しておく。 クロスコンパイル環境の作成 †NS4300N とできるだけ同じ環境にしておいたほうがよいので、Debian Etch 上で crosstool を使って、gcc-3.4.3-glibc-2.3.2 のクロスコンパイル環境を整備する。
zlib のインストール †$ mkdir workdir; cd workdir $ wget http://www.zlib.net/zlib-1.2.3.tar.bz2 $ tar jxvf zlib-1.2.3.tar.bz2 $ cd zlib-1.2.3 $ ./configure --shared --prefix=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu \ --libdir=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu/lib \ --includedir=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu/include Makefile をクロスコンパイル用に編集 @@ -16,7 +16,7 @@ # To install in $HOME instead of /usr/local, use: # make install prefix=$HOME -CC=gcc +CC=powerpc-linux-gnu-gcc CFLAGS=-fPIC -O3 -DUSE_MMAP #CFLAGS=-O -DMAX_WBITS=14 -DMAX_MEM_LEVEL=7 @@ -25,15 +25,15 @@ # -Wstrict-prototypes -Wmissing-prototypes LDFLAGS=-L. libz.so.1.2.3 -LDSHARED=gcc -shared -Wl,-soname,libz.so.1 -CPP=gcc -E +LDSHARED=powerpc-linux-gnu-gcc -shared -Wl,-soname,libz.so.1 +CPP=powerpc-linux-gnu-gcc -E LIBS=libz.so.1.2.3 SHAREDLIB=libz.so SHAREDLIBV=libz.so.1.2.3 SHAREDLIBM=libz.so.1 -AR=ar rc +AR=powerpc-linux-gnu-ar rc RANLIB=ranlib TAR=tar SHELL=/bin/sh コンパイルしてインストールする。 $ export PATH=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/bin:$PATH $ make all libz.a $ sudo make install $ sudo cp libz.a /usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu/lib dropbear のコンパイル †参考：
$ wget http://matt.ucc.asn.au/dropbear/dropbear-0.52.tar.bz2 $ tar jxvf dropbear-0.52.tar.bz2 $ cd tar dropbear-0.52 $ ./configure --libdir=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu/lib \ --includedir=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu/include \ --host=powerpc-linux-gnu --with-zlib=/usr/crosstool/gcc-3.4.3-glibc-2.3.2/powerpc-linux-gnu/powerpc-linux-gnu
自作プラグインディレクトリ構成 †. |-- dropbear | |-- SSH | | |-- .server | | | |-- config | | | | `-- dropbear.conf | | | |-- ssh2 | | | `-- usr | | | `-- sbin | | | `-- dropbear | | `-- plugin.conf | `-- upgrade_script `-- rev
自作プラグインの作成 †$ cd workdir $ chmod a+x dropbear/upgrade_script dropbear/SSH/.server/ssh2 $ sudo chown -R root:root . $ sudo tar czvf ../dropbear.tar.gz ./rev ./dropbear $ cd .. $ dd if=/dev/urandom of=dropbear_v0000_010101.ppg bs=97k count=1 $ cat dropbear.tar.gz >> dropbear_v0000_010101.ppg
参考 †
FANを静音タイプに交換する †
おまけ(Magic Number) †
|
telnet-hack_v010102.ppg 300件
[詳細]
telnetd.sh 197件
[詳細]
dropbear_v010101.ppg 233件
[詳細]
ssh2 204件
[詳細]
upgrade_script 195件
[詳細]
mediatomb_010102_coregax.ppg 402件
[詳細]
mediatomb_010102_corega.ppg 540件
[詳細]
mediatomb_010102_promise.ppg 52件
[詳細]
tree-promise-010105.txt 494件
[詳細]
tree-usr-010105.txt 490件
[詳細]
tree-root-010105.txt 463件
[詳細]
tree-promise-010205.txt 409件
[詳細]
tree-usr-010205.txt 561件
[詳細]
tree-root-010205.txt 394件
[詳細]
