Asmodian's Work Bench: Hacking The WD MyBook NAS Drive

The Project
The WD World Book II is a network attached storage device meant for a typical home or professional user. It varies in storage capacity. At the time of writing the sizes vary between 250GB and 2TB. The device itself is the size of an external USB hard-drive, the larger capacities being wider than the base end models. Inside there is a controller board connected to one or two 3.5 inch hard drives. The Controller is running an ARM processor on 32 mb of ram.

The group at mybookworld.wikidot.com collected some scripts to trick the upgrade feature on the drives web interface to run arbitrary commands as root.

Out of the box, the underlying OS is not available. The goal of this project is to enable the ssh server and/or telnet.

The Process
Side notes on recent firmware revisions. Recent revisions will display an error message, the payload will have still have been run though.

1. Login to the world book web interface. (the default login is admin : 123456)


2. Make a user with the web interface


3. Type the following into your browser : http://(DEVICE IP)/auth/firmware_upgrade.pl?fwserver=martin.hinner.info/mybook/firmware.php or http://(DEVICE IP)/auth/firmware_upgrade.pl?fwserver=mybook1.110mb.com/firmware.php


4. You will now see a screen telling you that there is a new firmware release available. Click on the "Download and install" button.


5. The process will take about 5 minutes or less. Then login via ssh as the user you made on step two then su to the root user with a blank password. If you use the alternate firmware site the password is 'root'

Now I would like to say, at this point, with the firmware release I have this did not work for me. If you still cannot login via ssh, try these steps:

1. Type in http://(DEVICE IP)/auth/firmware_upgrade.pl?fwserver=www.geekoh.com/mybook/telnet


2. Telnet to the device and login as your user. Then su to root with the password being root or "" depending on which scripts you ran.

Once you have root edit the /etc/inittab file and add "::sysinit:/usr/sbin/sshd".

There is more than enough storage space to work with so there isn't any reason you couldn't run a full LAMP environment off of it along with whatever services you want.

Resources:

The Hacks:

mybookworld.wikidot.com. "hacks and howto" Accessed January, 2009.

Hinner, Martin. "Hacking Western Digital MyBook World Edition" (September 14, 2008) Accessed January, 2009.


Physical Repair:
Pascucci, Mario. "How to Revive Western Digital Mybook World Edition" (July 25, 2007) Accessed January, 2009.

The Device:
Western Digital Corp. "My Book® World Edition™ II" Accessed January, 2009.


Related HiR Articles:
Ax0n. "La fonera lab: Fon unbricking howto", (October 10, 2008) Accessed January, 2009.

Ax0n. "Jasagar Lives Muahahaha" (October 9,2008) Accessed January, 2009.

Asmodian's Workbench: Suhosin Hardened PHP extension and patch.

Suhosin is a plug-in and patch for PHP. It places a white-list filter of actions which are allowed. It prevents a pile of PHP exploits from happening such as buffer overflows and certain kinds of injection attacks. You can find it at the Hardened PHP project web-page. It has a number of default items it blocks, one of which is the number of variables it allows to be posted and received.

You can configure it to either block potential attacks a and to log the results in unix syslog. you can also configure it to allow issues to occur and to only log events too.

You can control the Suhosin default values in your php.ini file.

Some php applications use an enormous amount of post variables so the default value (200) is probably too low. As I have explained to my co-worker, getting rid of the plug-in because your script uses too many post variables is probably not the best solution.

The solution in the that event is to modify the maximum request and post vars.

You can also tell suhosin to in the event of encountering a possible attack to run a different script or a http redirect instead. Like perhaps something like this:
(php.ini entry)

[suhosin]
suhosin.filter.action=[302,]http://www.youtube.com/watch?v=Yu_moia-oVI

As you can see this has a number of interesting possibilities.

If you are interested in PHP and AMP (oamp,lamp ...etc) technologies See also:

The hardened PHP project:
http://www.hardened-php.net/suhosin/

Ax0n's OAMP (Apache, Mysql, PHP on OpenBSD) Article:
http://www.h-i-r.net/2008/12/sysadmin-sunday-amp-on-openbsd-44.html

Asmodian X's Name based hosting mini-howto:
http://www.h-i-r.net/2008/10/sysadmin-sunday-apache-name-based.html

The PHP main website:
http://www.php.net/

The Apache webserver website:
http://httpd.apache.org/

Asmodian's Workbench: The archive sorter

In the past when I have done backups for home computers, I used a cd-rom burner and dumped everything in a tarball. The problem is that the archive is full of stuff I don't need, want or remember anything about.

So to aid in figuring out whats what I turned to the wonderful unix command FILE.

The file command spits out what file format it thinks a given file is. Its does this through magic numbers.

#!/bin/bash
TEMP_DIR1=`mktemp -d -q /tmp/TMP1.XXXXXX`
TEMP_DIR2=`mktemp -d -q /tmp/TMP2.XXXXXX`
DATE=`date "+%m_%d_%y"`
ARC_FILE=$1
TF=`mktemp -q /tmp/TF.XXXXX`
cp $ARC_FILE $TF.tgz
tar -zx -C $TEMP_DIR1 -f $TF.tgz
NUM1=1
find=`find -X -P $TEMP_DIR1/. -type f`
for FILE in $find; do
  TYPE=`file -b $FILE|tr [:space:][:cntrl:] \_`
  FILTERED=`basename $FILE|tr [:space:][:cntrl:][:punct:] \.`
  FILEFILTERED=`echo $NUM1$FILTERED`
  mkdir -p $TEMP_DIR2/$TYPE
  cp $FILE $TEMP_DIR2/$TYPE/$FILEFILTERED
  echo $FILE >> $TEMP_DIR2/md5_file_list.txt
  md5 $FILE >> $TEMP_DIR2/md5_file_list.txt
  NUM1=`expr $NUM1 + 1`
done
mv $TEMP_DIR2 ~/recovered$DATE
rm -rf $TEMP_DIR1
rm $TF.tgz
rm $TF

This code has been tested on Mac OS X 10.5 . Linux handles the find and file commands differently. OS X either classifies it as a file (well gee now I know its a normal file... Thanks OS X, you were very helpful there...) or it responds with everything up to and including the picture size. Linux responds with some basics about the file or the whole mime-type, which comes in handy if you want to sub categorize. And I made use of the kick ass TR command (which Ax0n based a previous article about). The find command was useful too but once again there is a syntax difference between OSX and Linux.



Interesting Facts:
Wikipedia: Magic Numbers in files
Apple Man pages

iPod touch hack released

iPOD touch hack released.
Check out http://www.ziphone.org/. Zibri found the solution to the iPod touch's in ability to be unjailed. The problem was with the nvram being corrupted.
Here is how to do it.

1. Just run the un-corruption utility in the zPhone utility
2. Run the jailbreak.
3. Install the BSD Subsystem.
   
4. Then Run the 1.1.3 updates for the BSD subsystem terminal for back spacing.
   
5. Then install the SUID Lib Fix .
6. Install The Term-VT100 terminal program.
   
7. Install the Cydia package (DEBIAN style package management!) which will replace the BSD subsystem.

Side notes:

• The /Library/LaunchAgent/ folder contains the daemon launch plists. deleting one will prevent it from loading.
  
• If you still have the BSD subsystem do not change the root password. The BSD passwd utility BREAKS the OS causing you to need to re-install the firmware. The Cydia utility works with out incident.
• The default root password for for the iPOD will be either "alpine" or "dottie".