totally weird - lost root on hacked mbwe2 - please help!

Summary:

no more smb acces to mbwe2 after hacking - i need your help.

totally weird - lost root on hacked mbwe2 - please help!

digitalsalat 30 Aug 2008 19:16

hi there!

following problem occured:

- i hacked my mbwe2 1TB which is running in RAID1
- i gained ssh access
- i fooled around a bit - damn i should first have learned unix
- now the /etc/passwd is with root commented out "#root bla bla bla"

here is what's up now:

- smb access doesn't work any more
- ssh and sftp access still works
- web-interface works but i can't create new users / delete users
- i cannot upgrade the firmware - the interface says "It appears that one of your drives is faulty or in an inconsistent state. Please make sure your drives are OK before retrying."
- the data is still available over sftp
- i can login via ssh but cannot "su"
- so i cannot edit /etc/passwd

what can i do? hardware reset over the reset button didn't work - it reset the admin but nothing else changed…
i can live with loosing the data cuz i got it a second time on a usb hdd, so please give me a hint what to do - i just want to get back delivery state of the mbwe2

EDIT:
- found that the powerup button does not work any more
- mounts are:

/dev/root on / type ext3 (rw,noatime,data=ordered)
proc on /proc type proc (rw)
devpts on /dev/pts type devpts (rw)
sys on /sys type sysfs (rw)
/dev/md3 on /var type ext3 (rw,noatime,data=ordered)
/dev/md4 on /shares/internal type ext3 (rw,noatime,data=ordered)
usbfs on /proc/bus/usb type usbfs (rw)

Last edited on 31 Aug 2008 09:27 by digitalsalat Show more

Re: totally weird - lost root on hacked mbwe2 - please help!

WorldBook 31 Aug 2008 12:55

Okay, so you accidentally commented out the root user in /etc/passwd, hmm that's a good one!

Firstly, you still say you can log in as another user. By any chance when you created this other user, did you give it root permissions?
I'm thinking the answer is no, but just in case, list your /etc/passwd, and see if any of the other users listed are members of the root group. If they are, you could just su as that user and edit the /etc/passwd file to reinstate the root user. It's a long shot… but easy solution -if you're lucky.

Failing that, I think I might have a possible work around.

What you could attempt, it to alter the ssh hack, that allowed you to turn on ssh to begin with. When you think about it, it's the same
problem we all had when we bought our MBWEs, ssh was enabled but commented out in /etc/inetd.conf

What you would need to do is replace /etc/inetd.conf in the script, with /etc/passwd,
and also on the sed line replace ssh with root.

i.e. the existing ssh script simply replaces "#ssh" with "ssh" in /etc/inetd.conf
and what you want/need is to replace "#root" with "root" in /etc/passwd

If I have time later on, I'll try this out on my machine - but not with the root user!! :-)
(If anyone else would like to try, what I would proposed to do is : create an additional normal user like "fred" and comment it out in my /etc/password and edit the script to replace #fred with fred) The only trouble though, is that I think the ssh hack script probably runs as root user…hmmm?

Last edited on 31 Aug 2008 13:41 by WorldBook Show more

Re: totally weird - lost root on hacked mbwe2 - please help!

digitalsalat 31 Aug 2008 13:59

eeerm no, i didn't set up another root // bang my head on the desk //

i tried to run the firmware upgrade script but

- i cannot upgrade the firmware - the interface says "It appears that one of your drives is faulty or in an inconsistent state. Please make sure your drives are OK before retrying."

via ssh i only got read access…

i really got too less idea about what we're talking here, but i assume that one is pretty unsolvable. right now i am thinking about doing a RMA via WD and keep the next one in initial state.