Geeks are GREAT Lovers

This post was found on a page that is no longer available, if the author is around somewhere please comment so that I can give you credit to the information:

After countless hours spent trying to crack the root password in /etc/shadow in After countless hours spent trying to crack the root password in / etc / shadow in the firmware image from promise, i remembered the seemingly stupid “Application the firmware image from promise, i remembered the seemingly stupid “Application Plugin” thingy in the web interface. Plugin “thingy in the web interface. With access to the perl/php scripts for the webinterface it’s pretty easy to With access to the perl / php scripts for the webinterface it’s pretty easy to figure out how to make such a plugin, so i set out for making a little shell figure out how to make such a plugin, so i set out for making a little shell script to add the admin user to /etc/sudoers and /etc/telnet.user. script to add the admin user to / etc / sudoers and / etc / telnet.user.
The files that the plugin-thingy accepts has a pretty obscure format, like the The files that the plugin-thingy accepts has a pretty obscure format, like the firmware image itself. The first 97KB is discarded, and after that there has to firmware image itself. The first 97KB is discarded, and after that there has to be a gzipped tar containing a file called “rev” and the application itself in a be a gzipped tar containing a file called “rev” and the application itself in a dir named the same as the plugin. The rev file needs to contain three lines in a dir named the same as the plugin. The rev file needs to contain three lines in a format like: format like:
PKGNAME=my_plugin_name PKGNAME = my_plugin_name
PKGVERSION=XX9999.X PKGVERSION = XX9999.X
FWVERSION=010105 FWVERSION = 010105
You can substitute the X’es as you like, but the 9999 is some sort of oem-code, You can substitute the X’es as you like, but the 9999 is some sort of oem-code, whatever that is. Of course the my_plugin_name is substituted for the name of whatever that is. Of course the my_plugin_name is substituted for the name of your plugin. your plugin.
Anyways, as far as i can see, the only way to get it to execute something from Anyways, as far as i can see, the only way to get it to execute something from the plugin-package is to call the plugin DLNA, which will make the “DLNA” tab in the plugin-package is to call the plugin DLNA, which will make the “DLNA” tab in the web interface light up. Then, when you choose enable service, it will try to the web interface light up. Then, when you choose enable service, it will try to execute /VOLUME1/PROMISEAPP/DLNA/.server/fupper execute / VOLUME1/PROMISEAPP/DLNA/.server/fupper

So what i did, was i made a ./rev like: So what i did, was i made a. / Rev like:

—–cut——- —– cut ——-
PKGNAME=DLNA PKGNAME = DLNA
PKGVERSION=1.0.9999.0 PKGVERSION = 1.0.9999.0
FWVERSION=010105 FWVERSION = 010105
—–cut——- —– cut ——-

And a ./DLNA/DLNA/.server/fuppes like: And a. / DLNA / DLNA / .server / fuppes like:

—–cut—– —– cut —–
#!/bin/ash #! / bin / ash
echo “admin ALL=(ALL) NOPASSWD: ALL” >> /etc/sudoers echo “admin ALL = (ALL) NOPASSWD: ALL”>> / etc / sudoers
echo “admin” >> /etc/telnet.user echo “admin”>> / etc / telnet.user
—–cut—— —– cut ——

…did a chmod +x ./DLNA/DLNA/.server/fuppes … did a chmod + x. / DLNA / DLNA / .server / fuppes
and put it all in a tarball with and put it all in a tarball with tar cvfz telnet-hack.tgz ./rev ./DLNA tar cvfz telnet-hack.tgz. / rev. / DLNA

Now i had the tarball, i just needed the 97kB of padding: Now i had the tarball, i just needed the 97kB of padding:
dd if=/dev/urandom of=telnet-hack bs=97k count=1 dd if = / dev / urandom of = telnet-hack bs = 97k count = 1

and put it together with and put it together with cat telnet-hack.tgz >> telnet-hack cat telnet-hack.tgz>> telnet-hack And here it is: http://rapidshare.com/files/48464094…ack-combo.html And here it is: http://rapidshare.com/files/48464094…ack-combo.html
(Please, for the sake of your own security, make your own plugin like described (Please, for the sake of your own security, make your own plugin like described or at least verify that mine does what i say it does.) or at least verify that mine does what i say it does.)

Just upload the file to the ns4300n, go to the Management->System Just upload the file to the ns4300n, go to the Management-> System Upgrade->Application Plugin page on the web interface and fill out the form. Upgrade-> Application Plugin page on the web interface and fill out the form.
When it has done it’s thing, go to File & Print->Protocol Control->DLNA and When it has done it’s thing, go to File & Print-> Protocol Control-> DLNA and enable it. Then you should be able to login via telnet on port 2380 with you enable it. Then you should be able to login via telnet on port 2380 with you admin user. admin user.

I’m sorry if i didn’t make much sense, i have been at it for about 20 hours now, I’m sorry if i didn’t make much sense, i have been at it for about 20 hours now, and i really need some sleep and i really need some sleep.

LONG STORY SHORT:

dd if=PACKAGE.ppg of=PACKAGE.tar.gz skip=97 bs=1k

Will get you a gzipped tarball of the contents of the mediatomb package that you can edit as you like to do what you please.  Makes it very nice to create your own packages to add whatever functionality you like to your NS4300N.

Created by geek