Hack teh NAS

[Tlafeir]

Hi,

I *legally own* a western digital netcenter 320 gb netcenter NAS device. I was wondering if there are any known exploits for this NAS. To start, I want to enable telnet or SSH. I know it runs linux, and has a GPL'ed firmware. Its a pretty crappy NAS in its current form (it doesn't even have file level permissions) , however, with some fine tuning, it could be a great product. I would like shell and FTP access to the box to start with. Anybody have any information on this NAS?

 

[rlatemp]

Hi,

I *legally own* a western digital netcenter 320 gb netcenter NAS device. I was wondering if there are any known exploits for this NAS. To start, I want to enable telnet or SSH. I know it runs linux, and has a GPL'ed firmware. Its a pretty crappy NAS in its current form (it doesn't even have file level permissions) , however, with some fine tuning, it could be a great product. I would like shell and FTP access to the box to start with. Anybody have any information on this NAS?

Tlafeir,

I'm in the same situation. My wife and I both run linux on our laptops. I was hoping that my new NetCenter would work better than it does over Samba (only 3.5 MB/sec -- where it should be ~11 MB/sec!). I am currently mounting it as a CIFS drive, and that improved the speed (5.8 MB/sec), but since it is running linux natively, the potential is there to do great things for the price and size (FTP, SSH, possibly a small web server w/dynamic DNS).

The one suggestion I have heard that might work is:

1. Remove the bare drive from the enclosure.
2. Plug it into another computer running linux
3. Mount the drive (I believe it uses the reiserfs)
4. As root, run the command "chroot /wherever_it_is_mounted"
5. Again as root, run the command "passwd"
6. Set your new root password.
7. Change anything else you think you can to enable SSH/Telnet/etc.
8. Put it back into the netcenter, and check if it worked.

Here's the disclaimer -- I have not tried this yet. In theory it should work, assuming that the OS is located on the HD and not in some solid state memory or ROM. The two main reasons why I have not tried it are (1) not enough time right now, and (2) I just got the device and was hoping to discover another way before opening it up.

If you try that method, I'd be interested to know your results. And to anybody else who knows more about this device (including safe exploits) -- please don't hold back! Otherwise, suggestions from anybody are welcome, too.

FYI -- you can mount it using NFS (~ 6MB/s), but file permissions get messed up. Windows can't read anything created by linux over NFS.

Here are the lines I use in my fstab for both CIFS and NFS in case you're interested. My main volume is called "RnC-Data" and my shared folders are "Public" and "Data".

# My Final CIFS Settings
netcenter:/Public  /media/netcenter/public  cifs  auto,user,rw,_netdev,soft,sync,noperm,nosetuids,noacl,guest        0 0
netcenter:/Data    /media/netcenter/data    cifs  auto,user,rw,_netdev,soft,sync,noperm,nosetuids,noacl,user=Guest,pass=mypassword                    0 0 

# My Final NFS Settings (should not be used if windows permission compatibility is desired):
# netcenter:/shares/RnC-Data/Public  /media/netcenter/public  nfs  _netdev,hard,intr,nosuid,rsize=8192,wsize=8192,tcp,nfsvers=3  0 0
# netcenter:/shares/RnC-Data/Data    /media/netcenter/data    nfs  _netdev,hard,intr,nosuid,rsize=8192,wsize=8192,tcp,nfsvers=3 0 0

Thanks all in advance!
-rlatemp

 

[unhappy_mage]

4. As root, run the command "chroot /wherever_it_is_mounted"

This probably won't work - are they using an x86 processor in that box? I'd be more inclined to guess mipsel or arm. Changing the password doesn't require chrooting, though.

 

[rlatemp]

Yeah -- I'm pretty sure it wouldn't be x86. I'm not extremely experienced with the internals of different linux distros, but this suggestion made by one of my co-workers running Gentoo seemed like it had potential.

So assuming that the OS is contained on the hard drive itself, can you think of a way to manually change the root password or enable FTP/SSH/Telnet, etc.?

This is the output I get from rpcinfo -p <netcenter ip>:

program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100005 1 udp 824 mountd
100005 1 tcp 827 mountd
100005 2 udp 824 mountd
100005 3 udp 824 mountd
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100021 1 udp 1026 nlockmgr
100021 3 udp 1026 nlockmgr
100021 4 udp 1026 nlockmgr
100021 1 tcp 1025 nlockmgr
100021 3 tcp 1025 nlockmgr
100021 4 tcp 1025 nlockmgr
100024 1 udp 830 status
100011 1 udp 834 rquotad
100011 2 udp 834 rquotad

Is there any other info that might help us expose an exploit?

-rlatemp

 

[unhappy_mage]

You could download the source and cross-compile it yourself. Not exactly trivial, but it'd work.