How I got a root shell in my NAS, 0day inside | Hacker News Reader

How I got a root shell in my NAS, 0day inside

blog.pentbox.net

42 pointsGarbage10 comments

This is cool, but typically it's not considered a vulnerability when the user in possession of the hardware or with admin access can root the box. It's actually inevitable.

Unless an unprivileged, remote attacker can also get a shell on the box, it's not a big deal.

That's not correct. When a researcher finds a vulnerability to get root access on an iPhone (hardware that he owns), it allows him to run code as a privilege user and modify the whole system. That's how jailbreaks are born, and Apple fixes the issues as soon as possible.

So apparently it doesn't give the owner root by default? I don't think I would buy such a product.

And this guy reports the means of getting root on his own device as a "defect" to be "fixed"? That is disgraceful.

You can make a NAS from generic PC equipment, altho it takes some work to get a lot of convenient features.

There are FLOSS friendly NAS-es out there:

http://sourceforge.net/projects/qosgpl/

http://wiki.qnap.com/wiki/Debian_Installation_On_QNAP

http://www.cyrius.com/debian/kirkwood/qnap/

with decent Debian solutions:

http://www.openmediavault.org/

or http://www.nas4free.org/

The thing is you should be able to get root access in a proper way, not using a vulnerability. It is what it is, and should be fixed.

How I got a root shell in my NAS:

Went to "Terminal" in the web control panel.

Enabled the SSH service.

SSHed in as root.

This is an off-the-shelf device, not an OS I installed myself.

Not the same NAS, in DNS320 you don't have that option:

http://www.support.dlink.com/emulators/dns320/200/login.html

The DNS320 has been my home server for just over a year (replacing a LinkStation). You can install Fonz FunPlug in about 5 minutes and get a solid, mirrored server for about £20.

http://nas-tweaks.net/devices/d-link-dns-320/

Unless I'm not understanding correctly, I think you misspelled £60

Wow, great guide to some seemingly awesome tools I didn't know until now.

I love posts like this, well written and easy to understand. This show that finding vulnerabilities is not magic for some ubergeeks but straightforward analysis with a bit of trial and error.

Reply on news.ycombinator.com