Reply
Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Nmap & telnet: firmware 2.2

Can someone who has upgraded run nmap on their player?

And, just for kicks, try telnetting in?

 

-wigout


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Kilobyte
capatty
Posts: 31
Registered: ‎08-10-2010
0

Re: Nmap & telnet: firmware 2.2

Doesn't reply to SSH requests on the default port.  Telnet responds with "Venus login," e.g. the default prompt for BusyBox 1.1.3.

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

Did you try the old login: root With no password?

Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Gigabyte
dm
Posts: 191
Registered: ‎08-18-2010
0

Re: Nmap & telnet: firmware 2.2

woot woot

 

called it.

 

 

time to play.

Kilobyte
capatty
Posts: 31
Registered: ‎08-10-2010
0

Re: Nmap & telnet: firmware 2.2

Sorry, put my reply in the other thread.  Yes, root login works.

 

Although since most of the FAT+ partition is squashfs, it's not writable.

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

With some help a whole lot of things are possible: stopall mount -o bind You can do almost anything.... Wigout

Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

For example:

 

stopall

cp /etc/init.d/rcS2 /usr/local/etc

(or

cp /etc/init.d/rcS2 /tmp/usbmounts/sda1/

)

 

edit the rcS2 file. add in what your'd like- dropbear, what have you.

then:

mount -o /tmp/usbmounts/sda1/rcS2 /etc/init.d/rcS2

/etc/init.d/rcS2

 

-wig_out

-wigout


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Yottabyte
bodhi78
Posts: 1,040
Registered: ‎06-04-2009
0

Re: Nmap & telnet: firmware 2.2

 


wig_out wrote:

For example:

 

stopall

cp /etc/init.d/rcS2 /usr/local/etc

(or

cp /etc/init.d/rcS2 /tmp/usbmounts/sda1/

)

 

edit the rcS2 file. add in what your'd like- dropbear, what have you.

then:

mount -o /tmp/usbmounts/sda1/rcS2 /etc/init.d/rcS2

/etc/init.d/rcS2

 

-wig_out

-wigout


 

I can login as root and no password. I think Seagate left this option opened, since everything is encrypted anyway. As you said, "mount -o bind" give us a lot to play with. If this was intentional, it is a nice gesture from Seagate to give something back to users.

-------------
Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
Kilobyte
mikek999
Posts: 29
Registered: ‎07-09-2010
0

Re: Nmap & telnet: firmware 2.2

wigout...

 

Looking for some more information about the encryption.  I do know about the ASE encryption in the firmware, but please explain what you are talking about.  I'm asuming that you are stating that some of the file mounts on the lunix device are encrypted and can not be ....(what?)...accessed....read?  If so what file path, please provide an example. I have an idea that I would like to try...

 

Thanks, Mike

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

mike-

 

check your private messages.

 

Basically there's a couple of things at play here under fat+2.2:

 

One is that the filesystem is open. You can telnet in. There's no password. You can examine the files, tar them out.

 

Two is that the filesystem is squashfs for the rootfs. All the startup settings are there. We can't alter the startup settings without logging in, at bootup, everytime. Troublingly, this includes the /etc/init.d/rcS2 - which includes how you set whether the device automatically upgrades or not.

 

Still, with the right web address blocked by your router to a particular mac address, there's not a lot of reasons why you can't change the heck out of this thing.

 

-wig_out


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Kilobyte
mikek999
Posts: 29
Registered: ‎07-09-2010
0

Re: Nmap & telnet: firmware 2.2

To clear some questions up...

 

The /etc/int.d/rcS2 is a startup script.  Can you change the script by telenet?  Can you access the script by telnet?  Does the script revert back to itself once the device has lost power?

 

Please elaborate on this statement: "All the startup settings are there. We can't alter the startup settings without logging in, at bootup, everytime."

 

What are you saying on this statement, I don't understand you: "Still, with the right web address blocked by your router to a particular mac address, there's not a lot of reasons why you can't change the heck out of this thing"

 

Thanks, Mike

 

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

The /etc/int.d/rcS2 is a startup script.  Can you change the script by telenet?  Can you access the script by telnet?  Does the script revert back to itself once the device has lost power?

 

Everything in that gets executed is on the / filesystem. That is squashfs. You can't write to squshfs. Thus you can't change any of the startup files.

 

HOWEVER, with a usb drive you can do the following:

 

telnet in

cp /etc/init.d/rcS2 /tmp/usbmounts/rcS2

 

then edit rcS2 to launch your bittorrent client.

 

stopall

mount -o bind /tmp/usbmounts/rcS2 /etc/init.d/rcS2

/etc/init.d/rcS2

 

DvdPlayers starts up, as called for in your rcS2, but also your bittorrent client.

 

On reboot, the mount -o bind will have been forgotten and all will be as it was originally-- until you log in again mount -o bind again.

 

As for the address blocking- you can often configure a router to not display certain websites AND/OR certain web pages.

 

Thus if you don't want your fat+ to upgrade autmatically online ever- block that page:

http://www.seagate.com/support/software/theaterappliance.xml

using your router's internal settings.

 

-wigout


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Yottabyte
bodhi78
Posts: 1,040
Registered: ‎06-04-2009
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

 

 

@capatty

 

Have you tried to mount cifs share as USB device to see if the FAT+ would index files in the network share?

-------------
Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
Kilobyte
ancaster
Posts: 35
Registered: ‎10-25-2010
0

Re: Nmap & telnet: firmware 2.2

Hello. My first post here, after some (limited) use of the FAT+. I am planning to do the following test. Please, let me know if this has been attempted aleady. It will save me a couple of hours, and perhaps some swearing at Seagate :smileywink:   (or even better some praise to it).

 

1) Connect an ext2-formatted disk through its usb interface;

2) if we telnet to the FAT+, it should show that external drive as /mnt/xxxxxx

3) ftp to FAT+ --  cd /mnt/xxxxx, put new_file

 

That should copy the 'new_file' into the external disk.

 

I am not sure whether this can be done to an NTFS-formatted disk, but assuming the above can be done, it should be able to do the same to a FAT32-formatted disk.

 

Any thoughts, or any similar attempts?

 

 

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010
0

Re: Nmap & telnet: firmware 2.2

1. I believe so.

2. the drives get moved around by hotplug, I believe they are all mounted on /tmp/usbmounts/

3. ftp can work, but you have to install it yourself. In the current incarnation, that means you'll have to log in at EVERY startup (that is, there are no moddable startup scripts, they are all on the unwritable squashfs, so you have to telnet in and start your ftp server).

 

-wigout


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Kilobyte
ancaster
Posts: 35
Registered: ‎10-25-2010
0

Re: Nmap & telnet: firmware 2.2

Hi thanks. I did make some tests with ext2 files and I managed to copy files from my computer to the FAT+-attached disk using the mount command. See for more details/comments in here

 

Any comments on that post's notes will be appreciated.

 

Zettabyte
Tinwable
Posts: 644
Registered: ‎12-27-2009
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

If someone could post the script for adding dropbear to rcS2 it would be much appreciated.  This is not my fortay, and I can do just about enough to get myself in trouble.

 

Also, I don't know if this helps, but I was playing around with telneting and even though most of what I got was:

 

can't cd to /..   or

 

:  Read only file system,  when trying anything.  I did find that you can "mkdir" in /usr/local/etc.  Follow Playdudes directions I was able to mkdir /usr/local/etc/oleg-optware and was able to

copy from the USB drive the ipkg-cl.tar, for Oleg Optware, to that directory.  But that's about as far as I could get.

 

I don't know if this will help, but I thought I would post this anyway.

Kilobyte
ancaster
Posts: 35
Registered: ‎10-25-2010
0

Re: Nmap & telnet: firmware 2.2

cd to /.. means you want to go to a level higher than /, which does not exist.

 

most of the filesystem (or disk, in MS parlance) is 'read-only' as it is the internal FLASH memory (something like ROM). There is a part of it that is created in memory (RAM) and this is where you can create or copy something to it, however, it will be lost when you power it down. To save something permanently, you have to copy into one of the USB drives (if you have any connected to it, that is).

To find out how to access that usb disk, type  'df'   or 'more /etc/mtab'. You should se something like /tmp/usb..../sda1.  That will be the only place that you can permanently create something.

 

[My apologies, if that is already known to you... nevertheless, it may be helpful to someone else].

 

 

 

 

Zettabyte
Tinwable
Posts: 644
Registered: ‎12-27-2009
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

Sorry, what I meant is if you try to do something like:

 

cd /dev/root     -you get

-sh:  cd:  can't cd to /dev/root

 

As, for placing something permanently, creating something @ /tmp/usb.../sda1 is not the only place that you can do this.  As I said, I was successful in permanently extracting the tar ball for Oleg Optware in /usr/local/etc, by doing:

 

cd /usr/local/etc

mkdir /oleg-optware

   now I can

cd /usr/local/etc/oleg-optware

  then by copying the ipkg-cl.tar to a usb & pluging that into the FAT+ I can

cp /tmp/usbmounts/sda1/ipkg-cl.tar /usr/local/etc/oleg-optware

  now I have the directory

/usr/local/etc/oleg-optware

  and if I 

ls -all

  I get

drwxr-xr-x      1 root            root             2048   Oct  27  07:58  .

drwxr-xr-x      1 root            root             2048   Oct  27  04:57  ..

-rwxr-xr-x       1 root            root          243904  Mar   6   2009   ipkg-cl

-rwxr-xr-x       1 root            root          245760  Oct  27  07:57  ipkg-cl.tar

 

As I said, I don't know what can be done with this or if it is helpful, but it is possible to write to the FAT+ @ /usr/local/etc. 

Megabyte
wig_out
Posts: 96
Registered: ‎07-10-2010

Re: Nmap & telnet: firmware 2.2

Tinwable (hope I spelled that right):

 

Firmware 1.55 and up use squashfs for the root file system.

 

A squashfs is not writable. The pluses for squashfs are that it is hard to corrupt the filesystem and it is very compact- a squashfs.img is 1/2 to 1/3 the size of a yaffs2.img.

 

Not being writable is trouble however.

The /etc/init.d/ is where all of the startup stuff happens.

It is on the non-writable root-filesystem. At present, this means you'll never be able to have anything happen automatically at startup.

 

I don't know alot about playdude's implementation of dropbear for the fat+

 

As long as you can't write to the root-filesystem, you won't be able to get optware to run- it needs the /opt/ directory on the root filesystem.

 

There's three alternatives:

chroot your way into a writable root directory

install an optware like system that does not depend on the rootfilesystem having the /opt directory

use statically compiled binaries and your own scripting to do what you want.

 

The easiest and least problematic way is probably the last.

Here's a few excellent precompiled binaries that run well on all of the realtek rtd1073dd players:

http://impactlinux.com/fwl/downloads/binaries/extras/busybox-mipsel

http://impactlinux.com/fwl/downloads/binaries/extras/dropbearmulti-mipsel

http://impactlinux.com/fwl/downloads/binaries/extras/strace-mipsel

 

Here's from the README from the same site:

busybox-$ARCH

This is a prebuilt static busybox binary for the given target, implementing numerous standard command line utilities.

To use, copy it to a target system (perhaps via wget), set the executable bit, and create the appropriate symlinks to it.

Run ./busybox-$ARCH to see the list of supported commands. It provides the default configuration ("make defconfig") of busybox.

dropbearmulti-$ARCH

This is a prebuilt static dropbear binary for the given target, implementing an ssh server, ssh client, and associated utilities such as scp.

To use, copy it to a target system (perhaps via wget), set the executable bit, and create the appropriate symlinks to it.

Run ./dropbearmulti-$ARCH to see the list of supporte commands.

strace-$ARCH

This is a prebuilt static strace binary for the given target, providing a debugging tool listing all the system calls made by another program.

To use, copy it to a target system (perhaps via wget) and set the executable bit.

 

 

An alternative to optware can be explored:

These guys are making an alternative "podware" for the rtd1073dd devices:

Here's the main page describing it and how to install:
http://playonhd.ucoz.ru/publ/prodvinutye_manualy/kompiljacija/naitivnaja_kompiljacija_na_pleere_repo...
http://translate.google.com/translate?u=http%3A%2F%2Fplayonhd.ucoz.ru%2Fpubl%2Fprodvinutye_manualy%2...


here's the list of packages::
http://playonhd.ucoz.ru/load/fajly_dlja_opytnykh/drugie_materjaly/indeks_repozitorija/3-1-0-14

http://translate.google.com/translate?u=http%3A%2F%2Fplayonhd.ucoz.ru%2Fload%2Ffajly_dlja_opytnykh%2...

In this reincarnation of podware they're attempting to utilize the rtd1073dd processor and options to the hilt- and designing it to be installable on most squashfs firmwares by relying on the /usr/local/etc/profile /usr/local/etc/rcS -- unlike optware which is locked into to a root /opt configuration.

This project seems young but very interesting.

 

 

Chroot:

is covered here

I will add that you could do:

mkdir /usr/local/etc/newroot

cd /usr/local/etc/newroot

mkdir bin dev etc lib mnt proc sbin sys tmp tmp_orig usr var opt

touch Test.fat

touch linuxrc

mount -o bind /bin bin

mount -o bind /dev dev

mount -o bind /etc etc

mount -o bind /lib lib

mount -o bind /mnt mnt

mount -o bind /proc proc

mount -o bind /sbin sbin

mount -o bind /tmp tmp

mount -o bind /tmp_orig tmp_orig

mount -o bind /usr usr

mount -o bind /var var

mount -o bind /Test.fat Test.fat

mount -o bind /linuxrc linuxrc

mount -o bind opt /path/to/you/opt/location

cd /usr/local/etc

chroot newroot

 

And voila, you have /opt on the root of your chroot-ed filesystem

unfortunately, none of this can be automatic at startup- you still need to telnet in and execute a script to get things going under firmwares 1.55 and higher.

 

I'd use the statically compiled binaries to get what I wanted if it was me.

 

-wigout

 


Don't you see that the whole aim of Newspeak is to narrow the range of thoght? In the end we shall make thoughtcrime literally impossible, because there will be no words in which to express it.
1984 (Nineteen Eighty-Four)

http://minimodding.com
- a place to discuss modifying embedded devices.
Zettabyte
Tinwable
Posts: 644
Registered: ‎12-27-2009
0

Re: Nmap & telnet: firmware 2.2

wig_out,

 

Thanks.  As I said, this is not my fortay, but I was aware that squashfs wasn't writable & there was no way to access the startup.  I mainly was just trying to make anyone, such as yourself, who was better at this then myself, aware that there was a writable directory if it wasn't already know.

 

I appreciate the link to the playonhd site, I gave it a glance & try to look at it more when I have the time.  As for optware, the only reason that I did it was just to see if it could be done, once again this is something that I don't know a lot about, I'm really just trying to learn as I go, without breaking something,  but I do appreciate that your explaination.

Gigabyte
playdude
Posts: 149
Registered: ‎12-28-2009
0

Re: Nmap & telnet: firmware 2.2

Thank you daemontsai for "accidentally" allowing non password login. You're my hero :smileyhappy:.

 

Tinwable, that can be done. I can't pack a working firmware image for version 2.2 but since telnet login is possible, I can write a script that grab all the required components for a working optware system and hopefully bring all the features I added to 1.45 to 2.2.

 

Better get working now!

Zettabyte
Tinwable
Posts: 644
Registered: ‎12-27-2009
0

Re: Nmap & telnet: firmware 2.2

playdude,

 

Glad to see you back.  I hope that it's possible to get those features back, that would be great.  If you get something put together let me know and I'll try to get it up and running on my FAT+.

 

Don't you just love those little "accidents"! :smileywink:

Yottabyte
bodhi78
Posts: 1,040
Registered: ‎06-04-2009
0

Re: Nmap & telnet: firmware 2.2

 


playdude wrote:

Thank you daemontsai for "accidentally" allowing non password login. You're my hero :smileyhappy:.

 

Tinwable, that can be done. I can't pack a working firmware image for version 2.2 but since telnet login is possible, I can write a script that grab all the required components for a working optware system and hopefully bring all the features I added to 1.45 to 2.2.

 

Better get working now!


Good to see you back, playdude! and yes, a big thanks to that person too :smileyhappy:

 

-------------
Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
Gigabyte
dm
Posts: 191
Registered: ‎08-18-2010
0

Re: Nmap & telnet: firmware 2.2

intersting reference material if anyone wants to compare devices

http://www.mips.com/everywhere/mips-based-products/

Byte
danyim
Posts: 13
Registered: ‎11-05-2010
0

Re: Nmap & telnet: firmware 2.2

I am in the process of writing and testing a telnet session with an expect script.. I'll post details soon.

Byte
danyim
Posts: 13
Registered: ‎11-05-2010
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

Run this from any *nix machine by saving the following into a file (we'll call it fatty in this post):

Save this into fatty
 
#!/usr/bin/expect
##########################################################################
# Written by danyim for the Seagate FreeAgent Theater+ Community Forums
# Resources:
##########################################################################
# Procedure to attempt a connection; Return 0 if OK, 1 otherwise
proc connect {usr} {
    expect {
        "Venus login:" { 
            send "$usr\r"
            expect {
                "#*" {
                    return 0
                }  
            }
        }
    }
    # Timed out
    return 1
}
############### CHANGE THESE VALUES WITH YOUR INFORMATION ################
# FAT+'s local LAN address
set host "1.2.3.4"
# Default port for telnet connections
set port 23
##########################################################################
# The username (default user is root for FAT+ v2.20)
set usr "root"
# The flash drive device name (via script arg)
set usb [lindex $argv 0]
# Check the arguments
if { $usb == ""  } {
     puts "Usage: fatty [USB device name (sda0, sda1, ...)]\n"
     exit 1
}
# Spawn a telnet process and attempt a connection
spawn telnet $host $port
# Call the connect procedure to see if the connection was successful
set fatty [connect $usr]
if { $fatty == 0 } {
    send "echo Performing rcS2 bind mount\r"
    expect "#"
    send "cp /etc/init.d/rcS2 /tmp/usbmounts/$usb/rcS2\r"
    expect "#"
    send "mount -o /tmp/usbmounts/$usb/rcS2 /etc/init.d/rcS2\r"
    expect "#"
    send "echo Executing the startup script...\r"
    send "/etc/init.d/rcS2\r"
    expect "#"
    send "exit\r"
    expect eof
    exit 0
}
puts "\nError connecting to the FAT+ device ($host).\nMake sure this is the right address.\n"
exit 1

Then enter this into the shell:
chmod 775 fatty
./fatty sda1
where sda1 is whatever the device name of your USB device is. (to do this, probe around via the ls /tmp/usbmounts -al command and find your thumb drive!)
I just loosely followed what wig_out has mentioned. At the moment, I don't think running this will really do anything except for rebooting the system, but I wanted to give you guys a working script that automates most of this. You can easily run ./fatty sda1 from any shell, and it will automatically mount/copy files/do whatever you want!
I hope this will help guide our project in the right direction.

 

Gigabyte
dm
Posts: 191
Registered: ‎08-18-2010
0

Re: Nmap & telnet: firmware 2.2

I was thinking of doing somting like that but with windows scripting.

Ie, make a small program that just has a list of common commands and let people send them at certain timeslike if it reboots..etc.

 

I found this script as a sample and use it for dmesg when it boots  for testing.

 

this was from another device actually but still works

 

echo off
echo Set objShell = WScript.CreateObject("WScript.Shell") > asusrescue.vbs
echo Set objExecObject = objShell.Exec("cmd /c ping -t -w 1 192.168.1.33") >> asusrescue.vbs
echo Wscript.Echo "Now, start your O!Play..." >> asusrescue.vbs
echo Do While Not objExecObject.StdOut.AtEndOfStream >> asusrescue.vbs
echo     strText = objExecObject.StdOut.ReadLine() >> asusrescue.vbs
echo     Wscript.Echo strText >> asusrescue.vbs
echo     If Instr(strText, "Reply") > 0 Then >> asusrescue.vbs
echo         Exit Do >> asusrescue.vbs
echo     End If >> asusrescue.vbs
echo Loop >> asusrescue.vbs
echo objShell.Run("telnet 192.168.1.33") >> asusrescue.vbs
echo Do Until Success = True >> asusrescue.vbs
echo     Success = objShell.AppActivate("telnet") >> asusrescue.vbs
echo Loop >> asusrescue.vbs
echo Wscript.Sleep 300 >> asusrescue.vbs
echo Success = objShell.AppActivate("telnet") >> asusrescue.vbs
echo objShell.SendKeys "root" >> asusrescue.vbs
echo objShell.SendKeys "{ENTER}" >> asusrescue.vbs
echo objShell.SendKeys "dmesg" >> asusrescue.vbs
echo objShell.SendKeys "{ENTER}" >> asusrescue.vbs
echo Wscript.Echo "Done... You can close this window." >> asusrescue.vbs
rem echo Wscript.Quit >> asusrescue.vbs

CALL CScript asusrescue.vbs
del asusrescue.vbs

 

 

 

Perhaps it would be good to start collecting command lists for various functions or cool things that people can do :smileyhappy:

 

 

Byte
danyim
Posts: 13
Registered: ‎11-05-2010
0

Re: Nmap & telnet: firmware 2.2

That vbscript seems interesting... I could definitely use its idea for listening to a ping packet to monitor if the device has been restarted--and then remount the custom root directory structure when triggered.

Kilobyte
capatty
Posts: 31
Registered: ‎08-10-2010
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

I've been busy with work lately and got some time yesterday/today to mess around.  Glad to see that someone is messing around with Expect/TCL, since it allows for accurate telnet scripting.  Ping would be useful but unnecessary in this case because you can just throw a CR or include another expect command to check for a hot connection.

 

Actually, the easiest solution for writing your own custom firmware might be to write an expect script that kills all proccesses, put a custom image onto a USB drive, erase the squashfs partition, then write the custom image back to flash.  It could probably work similar to this process for OpenWRT: http://www.cs.cmu.edu/~ecc/dockstar-howto.html

Byte
danyim
Posts: 13
Registered: ‎11-05-2010
0

Re: Nmap & telnet: firmware 2.2

That is an excellent idea, capatty. I'd love to contribute to the cause, but I personally have never done any embedded systems programming/reflashing. If the other gurus chime in, I think we can make a workable mod sometime soon.

Yottabyte
bodhi78
Posts: 1,040
Registered: ‎06-04-2009
0

Re: Nmap & telnet: firmware 2.2

Alan,

 

This is an excellent thread. Could you make it a sticky so that enhancements to FW 2.20 are more visible?

 

Thanks,

bodhi

-------------
Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
Yottabyte
bodhi78
Posts: 1,040
Registered: ‎06-04-2009
0

Re: Nmap & telnet: firmware 2.2

[ Edited ]

Can you compile or install XBMC on the FAT+ FW 2.20?

 

Is this possible? how much effort will it take? this thread on  XBMC forum describes how to install XBMC on Debian Lenny:

 

http://forum.xbmc.org/showthread.php?t=41582&highlight=debian+build

-------------
Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
Kilobyte
babie
Posts: 19
Registered: ‎10-22-2010
0

Re: Nmap & telnet: firmware 2.2

what are the telnet commands to share out "/tmp/usbmounts/sda1/" and access it (read and write) with windows? thanks

Gigabyte
dm
Posts: 191
Registered: ‎08-18-2010
0

Re: Nmap & telnet: firmware 2.2

/tmp/usbamounts/sda is the usb drive. or the first one perhaps

 

it is not shareable after that when in the system

you need to FTP to it but youneed to start the FTP server first.

 

see my thread "adding to the internet gui" or something bellow.

 

just start the ftp server with th root /tmp/usbmounts/sda1 and ftp in with anonymous

 

Gigabyte
dm
Posts: 191
Registered: ‎08-18-2010
0

Re: Nmap & telnet: firmware 2.2

I just found the location of how the firmware checks to see if the partition has been modified.

If someone can figure this out perhaps we can fix it up so we can boot our own burned image?

 

see firmware sources 2.2 

  1.  linux/init/main.c

 

http://pastebin.com/Hygwce0F

 

...

  1. /* Now we only support secure boot on partition /dev/mtdblock/1. If /dev/mtdblock/1 has been modified after installation, Linux kernel will know that and do reboot. */
  2. #ifdef CONFIG_REALTEK_SECURE_BOOT_PARTITION

...

  1. /* Here we check the hash value of some partition, which is passed from bootloader, to make sure that partition is not modified.
  2.     The format of that bootloader variable is partition_hash="[partition num]:[partition size]:[hash value]". Exp: go 0x80100000 ... partition_hash="1:1234:12341234123412341234123412341234" */
  3. #ifdef CONFIG_REALTEK_SECURE_BOOT_PARTITION

 

 

hmm

 

/* For secure boot, only squashfs-root is supported, and it is scrambled before doing hash. */

  •                         /* Unscramble */
  •                         MCP_AES_ECB_Decryption(platform_info.AES_IMG_KEY, pBuff->data, pBuff->data, len);
  •                         /* Calculate hash value */
  • //                      MCP_AES_H_DataHash(hash_buffer, singlecount, hash_array, 512*1024, firstblock);
  •                         hashcount+=singlecount;
  •  

     

    Kilobyte
    babie
    Posts: 19
    Registered: ‎10-22-2010

    Re: Nmap & telnet: firmware 2.2

    keep up the good work!

    Visitor
    tedbone
    Posts: 5
    Registered: ‎01-10-2011
    0

    Re: Nmap & telnet: firmware 2.2

    bodhi78:

    any more word on this...anyone else?? This is what I've been hoping for in the last year with my FAT+

     

    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

     


    tedbone wrote:

    bodhi78:

    any more word on this...anyone else?? This is what I've been hoping for in the last year with my FAT+

     


    None. Looks like FAT+ modding is no longer interesting to the Linux experts. I think it's too much trouble and not much benefit with encrypted FW.

     

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

     


    dm wrote:

    /tmp/usbamounts/sda is the usb drive. or the first one perhaps

     

    it is not shareable after that when in the system

    you need to FTP to it but youneed to start the FTP server first.

     

    see my thread "adding to the internet gui" or something bellow.

     

    just start the ftp server with th root /tmp/usbmounts/sda1 and ftp in with anonymous

     


     

    Anybody still looking at ways to share the local USB drive attached to the FAT?

     

    Is ftp the only way to transfer files to the FAT+? samba is not installed on FAT+? if not, how do we install it after chroot to a new root?

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Gigabyte
    dm
    Posts: 191
    Registered: ‎08-18-2010

    Re: Nmap & telnet: firmware 2.2

    Nope, because Seagate is lame and Is not doing anything cool with the box. It does what it does and thats it. They also locked out the box from telnet again so to much trouble unless you go back one version.

     

    I've managed to put a customer rss menu in and them upgrade to the newest but still. Pain in the but.

     

    If you want a cool box buy another companies product.

     

    I have 3 gig of firmwares and files for the goflex and other players and after 2 weeks of work on it, realized noone cares and including seagate.

    Even after the past firmware was decrypted.nada... o well.

     

    Atleast it plays my DVD folder dumps.

     

     

    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

    [ Edited ]

    I know what you meant. However, we're stuck with it, so might as well get it to at least share the attached USB drive? Do you know where can I get static binary for samba that can be installed at the FAT+ (after chroot as described by wigout)?

     

    Also, may be run a cron job to keep it from automatically shutdown.

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Gigabyte
    dm
    Posts: 191
    Registered: ‎08-18-2010

    Re: Nmap & telnet: firmware 2.2

    been out of it to long. i forget even where stuff is.

     

    on a side note , MOservices seems to sorta work, got ftp to work with it. not sure about anythign else since this is not an asus box. I tried both samba servers and none worked.

    I had a collection of binaries and then accidentally RM-r them :smileyhappy:

     

    Basically, what i did for binaries is look through other firmwares from boxes that use the same chipset , and then took them out of the firmwares , telnetted and ran them from my USB harddisk.

     

    then again, the only thing usefull i can see is replacing the current menu  and adding 1 RSS item that points to a RSS menu on your USB stick. then you can d anything from that menu even if you  reflash to 223. the /usr/loca/tmp seems to stay intact.

    to bad they disabled telnet on the new firmware...LAME

     

    i think there may even be some samba binaries in this firmware 220 but i cant recall.

    i never figured out the commands to run them.

     

    google moServices.

     

    if anyone wanted im sure we could make a new firmware. i just didnt have time.

     

     

     

     

    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

    [ Edited ]

     


    dm wrote:

    been out of it to long. i forget even where stuff is.

     

    on a side note , MOservices seems to sorta work, got ftp to work with it. not sure about anythign else since this is not an asus box. I tried both samba servers and none worked.

    I had a collection of binaries and then accidentally RM-r them :smileyhappy:

     

    Basically, what i did for binaries is look through other firmwares from boxes that use the same chipset , and then took them out of the firmwares , telnetted and ran them from my USB harddisk.

     

    then again, the only thing usefull i can see is replacing the current menu  and adding 1 RSS item that points to a RSS menu on your USB stick. then you can d anything from that menu even if you  reflash to 223. the /usr/loca/tmp seems to stay intact.

    to bad they disabled telnet on the new firmware...LAME

     

    i think there may even be some samba binaries in this firmware 220 but i cant recall.

    i never figured out the commands to run them.

     

    google moServices.

     

    if anyone wanted im sure we could make a new firmware. i just didnt have time.

     

     

     

     


    dm, thanks for info. moServices did not work for me either. I think because it needs to be rebooted to take effect with all the "lib.so" files need to load. And after reboot, everything was wiped out. I thought if you still had static binaries, then I could automate the chroot and the commands to start samba (could not find samba in FW 2.20). I think I might as well forget it. Since FW 2.20 does not have a working iPhone app for remote, I'll have to trade that to go back to 2.20 to use other utilties anyway...

     

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

     


    bodhi78 wrote:

     


    dm wrote:

    been out of it to long. i forget even where stuff is.

     

    on a side note , MOservices seems to sorta work, got ftp to work with it. not sure about anythign else since this is not an asus box. I tried both samba servers and none worked.

    I had a collection of binaries and then accidentally RM-r them :smileyhappy:

     

    Basically, what i did for binaries is look through other firmwares from boxes that use the same chipset , and then took them out of the firmwares , telnetted and ran them from my USB harddisk.

     

    then again, the only thing usefull i can see is replacing the current menu  and adding 1 RSS item that points to a RSS menu on your USB stick. then you can d anything from that menu even if you  reflash to 223. the /usr/loca/tmp seems to stay intact.

    to bad they disabled telnet on the new firmware...LAME

     

    i think there may even be some samba binaries in this firmware 220 but i cant recall.

    i never figured out the commands to run them.

     

    google moServices.

     

    if anyone wanted im sure we could make a new firmware. i just didnt have time.

     

     

     

     


    dm, thanks for info. moServices did not work for me either. I think because it needs to be rebooted to take effect with all the "lib.so" files need to load. And after reboot, everything was wiped out. I thought if you still had static binaries, then I could automate the chroot and the commands to start samba (could not find samba in FW 2.20). I think I might as well forget it. Since FW 2.20 does not have a working iPhone app for remote, I'll have to trade that to go back to 2.20 to use other utilties anyway...

     


     

    Just out curiousity, I took another look at moServices. I think we need to chroot first, after that moServices will work when you install it.

     

    What probably happened was: Either the setup for lib .so files (e.g. lib.samba.so.* shared library files) must have been uncessful because of the root squashfs read-only, or moServices did not do that so we'll need to copy those .so files installed by moServices into the /lib directory). Either way it should work after chroot (I have not tried it yet).

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Kilobyte
    hexcide
    Posts: 28
    Registered: ‎02-10-2011
    0

    Re: Nmap & telnet: firmware 2.2


    bodhi78 wrote:

    I know what you meant. However, we're stuck with it, so might as well get it to at least share the attached USB drive? Do you know where can I get static binary for samba that can be installed at the FAT+ (after chroot as described by wigout)?

     

    Also, may be run a cron job to keep it from automatically shutdown.


     

    I've been running samba for two months now - no chroot required. Still working to simplify the installation and operation before I make a release. Sorry to be a tease, but since the subject came up ... :smileyhappy:

     

    Unfortunately (as far as you, dear reader, are concerned), I've had relatives from interstate staying for a few weeks, so either I've been busy or the FAT+ has been busy.

     

    Performance is surprising good with DVDrips though I haven't tried Bluray rips. I can be copying files on to the USB connected drive while playing a movie on the unit AND playing another movie on a computer via samba.

     

    The power-down problem has a manual workaround, but I'd love to find out how the idle time is stored (though it may be local to the screensaverAP)

    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

    [ Edited ]

     


    hexcide wrote:

    bodhi78 wrote:

    I know what you meant. However, we're stuck with it, so might as well get it to at least share the attached USB drive? Do you know where can I get static binary for samba that can be installed at the FAT+ (after chroot as described by wigout)?

     

    Also, may be run a cron job to keep it from automatically shutdown.


     

    I've been running samba for two months now - no chroot required. Still working to simplify the installation and operation before I make a release. Sorry to be a tease, but since the subject came up ... :smileyhappy:

     

    Unfortunately (as far as you, dear reader, are concerned), I've had relatives from interstate staying for a few weeks, so either I've been busy or the FAT+ has been busy.

     

    Performance is surprising good with DVDrips though I haven't tried Bluray rips. I can be copying files on to the USB connected drive while playing a movie on the unit AND playing another movie on a computer via samba.

     

    The power-down problem has a manual workaround, but I'd love to find out how the idle time is stored (though it may be local to the screensaverAP)


    Hey, that'd be great! yeah, I was thinking about moServices that will need chroot to run. But if you have static binaries then there is no need. moServices's samba loads a shared library when it starts samba, transmission, among other things. ftp to the FAT+ is slow, and not user-friendly. So I thought if you can install samba then it's usable for FW 2.20. Then again, Seagate kept introducing new bugs and not letting us telnet to the box so people who want to add functionalities to the FAT+ are stuck with 2.20.

     

    Will the operation be automated using a script?

     

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Kilobyte
    Seb_123
    Posts: 24
    Registered: ‎10-19-2010

    Re: Nmap & telnet: firmware 2.2

    [ Edited ]

    Hi,

    my FAT+ Version 2.23 (EMEA) has Telnet enabled. I changed the SW a little bit, so i was able to execute a script (/usr/local/etc/autorun.sh) at startup.

    All what you need ist Version 2.20 running, because you need telnet to install the tweaked 2.23 SW.

     

    - Put the stick with the new INSTALL.IMG in.

    - telnet to the FAT+

    - type "kill -6 1" --> the FAT+ should install the SW now

    - is the update finished, you should be able to telnet the FAT+ again

    - check the version

    - if an "autorun.sh" existing at /usr/local/etc , the script will be started at startup (don't forget chmod 777 to the script)

     

    Normal Update is not working, only "kill -6 1" will start the update!!!!

     

    You can download the tweaked INSTALL.IMG here: http://ul.to/2xsf8dmo

     

    Seb_123

     

    P.S. the installation is at your own risk!!! and sorry for my bad english

    Yottabyte
    bodhi78
    Posts: 1,040
    Registered: ‎06-04-2009
    0

    Re: Nmap & telnet: firmware 2.2

     


    Seb_123 wrote:

    Hi,

    my FAT+ Version 2.23 (EMEA) has Telnet enabled. I changed the SW a little bit, so i was able to execute a script (/usr/local/etc/autorun.sh) at startup.

    All what you need ist Version 2.20 running, because you need telnet to install the tweaked 2.23 SW.

     

    - Put the stick with the new INSTALL.IMG in.

    - telnet to the FAT+

    - type "kill -6 1" --> the FAT+ should install the SW now

    - is the update finished, you should be able to telnet the FAT+ again

    - check the version

    - if an "autorun.sh" existing at /usr/local/etc , the script will be started at startup (don't forget chmod 777 to the script)

     

    Normal Update is not working, only "kill -6 1" will start the update!!!!

     

    You can download the tweaked INSTALL.IMG here: http://ul.to/2xsf8dmo

     

    Seb_123

     

    P.S. the installation is at your own risk!!! and sorry for my bad english


    Thanks seb_123, can you tell us what you've modified in the Fw 2.23 for EMEA? so we can do the same for the US version.

     

    -------------
    Feedback! when asking for help, please remember to let others know whether the suggested solution has solved the problem or not.

    Need FAT+/GoFlex TV help? see this thread: http://forums.seagate.com/t5/FreeAgent-Theater-and-GoFlexTV/FreeAgent-Theater-product-page-and-other-information/td-p/76254
    Kilobyte
    Seb_123
    Posts: 24
    Registered: ‎10-19-2010
    0

    Re: Nmap & telnet: firmware 2.2

    [ Edited ]

    @ bodhi7,

    I send you a PM.

     

    @all,

    any problems?