|
まずは、SATA2 の HDD
root@ls410d:~# tail -f /var/log/messages : : Dec 8 18:18:58 ls410d kernel: usb 1-1: new high-speed USB device number 4 using ehci_marvell Dec 8 18:18:58 ls410d kernel: scsi4 : usb-storage 1-1:1.0 Dec 8 18:18:59 ls410d kernel: scsi 4:0:0:0: Direct-Access ViPowER VP-89118(SD1) 2.10 PQ: 0 ANSI: 4 Dec 8 18:18:59 ls410d kernel: sd 4:0:0:0: Attached scsi generic sg1 type 0 Dec 8 18:18:59 ls410d kernel: sd 4:0:0:0: [sdd] 78165360 512-byte logical blocks: (40.0 GB/37.2 GiB) Dec 8 18:18:59 ls410d kernel: sd 4:0:0:0: [sdd] Write Protect is off Dec 8 18:18:59 ls410d kernel: sdd: sdd1 sdd2 sdd3 sdd4 sdd5 sdd6 Dec 8 18:18:59 ls410d kernel: sd 4:0:0:0: [sdd] Attached SCSI disk ^C root@ls410d:~# parted -s /dev/sdd print Model: ViPowER VP-89118(SD1) (scsi) Disk /dev/sdd: 40.0GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 1049kB 1026MB 1024MB ext3 primary 2 1026MB 6146MB 5120MB primary 3 6146MB 6147MB 1049kB primary 4 6147MB 6148MB 1049kB primary 5 6148MB 7172MB 1024MB primary 6 7172MB 32.0GB 24.8GB primary root@ls410d:~# parted -s /dev/sdd rm 6 root@ls410d:~# ^6^5 parted -s /dev/sdd rm 5 root@ls410d:~# ^5^4 parted -s /dev/sdd rm 4 root@ls410d:~# ^4^3 parted -s /dev/sdd rm 3 root@ls410d:~# ^3^2 parted -s /dev/sdd rm 2 root@ls410d:~# ^2^1 parted -s /dev/sdd rm 1 root@ls410d:~# fdisk -l /dev/sdd WARNING: GPT (GUID Partition Table) detected on '/dev/sdd'! The util fdisk doesn't support GPT. Use GNU Parted. Disk /dev/sdd: 40.0 GB, 40020664320 bytes 255 heads, 63 sectors/track, 4865 cylinders, total 78165360 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sdd1 1 78165359 39082679+ ee GPT root@ls410d:~# fdisk /dev/sdd WARNING: GPT (GUID Partition Table) detected on '/dev/sdd'! The util fdisk doesn't support GPT. Use GNU Parted. Command (m for help): d Selected partition 1 Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. root@ls410d:~# !tail tail -f /var/log/messages : : Dec 8 18:22:09 ls410d kernel: usb 1-1: USB disconnect, device number 4続いて、SATA1 の HDD
Dec 8 18:23:17 ls410d kernel: usb 1-1: new high-speed USB device number 5 using ehci_marvell Dec 8 18:23:17 ls410d kernel: scsi5 : usb-storage 1-1:1.0 Dec 8 18:23:18 ls410d kernel: scsi 5:0:0:0: Direct-Access ViPowER VP-89118(SD1) 2.10 PQ: 0 ANSI: 4 Dec 8 18:23:18 ls410d kernel: sd 5:0:0:0: Attached scsi generic sg1 type 0 Dec 8 18:23:18 ls410d kernel: sd 5:0:0:0: [sdd] 78165360 512-byte logical blocks: (40.0 GB/37.2 GiB) Dec 8 18:23:18 ls410d kernel: sd 5:0:0:0: [sdd] Write Protect is off Dec 8 18:23:18 ls410d kernel: sdd: sdd1 sdd2 sdd3 sdd4 sdd5 sdd6 Dec 8 18:23:18 ls410d kernel: sd 5:0:0:0: [sdd] Attached SCSI disk root@ls410d:~# parted -s /dev/sdd print Model: ViPowER VP-89118(SD1) (scsi) Disk /dev/sdd: 40.0GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 1049kB 1026MB 1024MB ext3 primary 2 1026MB 6146MB 5120MB xfs primary 3 6146MB 6147MB 1049kB primary 4 6147MB 6148MB 1049kB primary 5 6148MB 7172MB 1024MB primary 6 7172MB 32.0GB 24.8GB primary root@ls410d:~# parted -s /dev/sdd rm 6 root@ls410d:~# ^6^5 parted -s /dev/sdd rm 5 root@ls410d:~# ^5^4 parted -s /dev/sdd rm 4 root@ls410d:~# ^4^3 parted -s /dev/sdd rm 3 root@ls410d:~# ^3^2 parted -s /dev/sdd rm 2 root@ls410d:~# ^2^1 parted -s /dev/sdd rm 1 root@ls410d:~# !?print parted -s /dev/sdd print Model: ViPowER VP-89118(SD1) (scsi) Disk /dev/sdd: 40.0GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags root@ls410d:~# fdisk -l /dev/sdd WARNING: GPT (GUID Partition Table) detected on '/dev/sdd'! The util fdisk doesn't support GPT. Use GNU Parted. Disk /dev/sdd: 40.0 GB, 40020664320 bytes 255 heads, 63 sectors/track, 4865 cylinders, total 78165360 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sdd1 1 78165359 39082679+ ee GPT root@ls410d:~# fdisk /dev/sdd WARNING: GPT (GUID Partition Table) detected on '/dev/sdd'! The util fdisk doesn't support GPT. Use GNU Parted. Command (m for help): d Selected partition 1 Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. root@ls410d:~#
yasunari@qube:~$ cd /srv/tftp/ yasunari@qube:/srv/tftp$ ls HS-DHGL_1.20 LS-LGL_2.01 LS-XHL_1.02+telnet ls_series-157 LS-CHL_1.10 LS-QL_1.05+telnet LS-XHL_1.04b ls_series-160 LS-CHL_1.20 LS-QL_1.07b LS-XHL_1.10 ls_series-160_88f5182 LS-CHL_1.21 LS-QL_1.10b SheevaPlug_1.2 ls_series-168 LS-CL+HackKit LS-SL_1.11 TS-WXL_1.06 ls_series-168_88f5182 LS-CL_1.07 LS-SL_1.24 initrd.buffalo uImage.buffalo LS-CL_1.11 LS-VL+X ls400-111 LS-GL_1.15 LS-WSGL_1.06 ls400-111en LS-HGL_1.07b LS-XHL_1.02 ls_series-156 yasunari@qube:/srv/tftp$ rm initrd.buffalo yasunari@qube:/srv/tftp$ rm uImage.buffalo yasunari@qube:/srv/tftp$ ln ls_series-168/initrd.buffalo . yasunari@qube:/srv/tftp$ ln ls_series-168/uImage.buffalo . yasunari@qube:/srv/tftp$
Dec 8 18:27:57 qube in.tftpd[3184]: connect from 192.168.11.150 (192.168.11.150) Dec 8 18:27:57 qube tftpd[3185]: tftpd: trying to get file: uImage.buffalo Dec 8 18:27:57 qube tftpd[3185]: tftpd: serving file from /srv/tftp Dec 8 18:27:58 qube in.tftpd[3186]: connect from 192.168.11.150 (192.168.11.150) Dec 8 18:27:58 qube tftpd[3187]: tftpd: trying to get file: initrd.buffalo Dec 8 18:27:58 qube tftpd[3187]: tftpd: serving file from /srv/tftp取りに来た。
しばらくして LED が点灯に。
途中で、いつもどおり tftp Boot をもう一回。
しばらくして、更新完了。
しばらくして「共有フォルダー」に戻るので、
「システム」→「ディスク」で、RAIDアレイ1が「未設定」であることを確認。
続いて、「ディスク２」を選択して「ディスクの取り外し」。 ダイアログで警告に応答。
しばらくして「共有フォルダー」に戻るので、
「システム」→「ディスク」で、ディスク2が「取り外し済」であることを確認。
電源 OFF
root@ls410d:~# tail -f /var/log/messages : : Dec 8 21:30:56 ls410d kernel: usb 1-1: new high-speed USB device number 2 using ehci_marvell Dec 8 21:30:56 ls410d kernel: scsi2 : usb-storage 1-1:1.0 Dec 8 21:30:57 ls410d kernel: scsi 2:0:0:0: Direct-Access ViPowER VP-89118(SD1) 2.10 PQ: 0 ANSI: 4 Dec 8 21:30:57 ls410d kernel: sd 2:0:0:0: [sdb] 78165360 512-byte logical blocks: (40.0 GB/37.2 GiB) Dec 8 21:30:57 ls410d kernel: sd 2:0:0:0: [sdb] Write Protect is off Dec 8 21:30:57 ls410d kernel: sd 0:0:0:0: Attached scsi generic sg0 type 0 Dec 8 21:30:57 ls410d kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0 Dec 8 21:30:57 ls410d kernel: sdb: unknown partition table Dec 8 21:30:57 ls410d kernel: sd 2:0:0:0: [sdb] Attached SCSI diskこちらにはパーティションはない。
続いて SATA2 の HDD を USB で LS410D に接続
Dec 8 21:32:39 ls410d kernel: usb 1-1: new high-speed USB device number 3 using ehci_marvell Dec 8 21:32:39 ls410d kernel: scsi3 : usb-storage 1-1:1.0 Dec 8 21:32:40 ls410d kernel: scsi 3:0:0:0: Direct-Access ViPowER VP-89118(SD1) 2.10 PQ: 0 ANSI: 4 Dec 8 21:32:40 ls410d kernel: sd 3:0:0:0: Attached scsi generic sg1 type 0 Dec 8 21:32:40 ls410d kernel: sd 3:0:0:0: [sdb] 78165360 512-byte logical blocks: (40.0 GB/37.2 GiB) Dec 8 21:32:40 ls410d kernel: sd 3:0:0:0: [sdb] Write Protect is off Dec 8 21:32:40 ls410d kernel: sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6 Dec 8 21:32:40 ls410d kernel: sd 3:0:0:0: [sdb] Attached SCSI diskこちらにはパーティションがある。
どうするのが正しいんだろう？？？
root@ls410d:~# mdadm --assemble -scan mdadm: /dev/md/LS-WSXLE75:21 has been started with 1 drive (out of 2). mdadm: /dev/md/LS-WSXL-EME75:10 has been started with 1 drive (out of 2). mdadm: /dev/md/LS-WSXL-EME75:1 has been started with 1 drive (out of 2). mdadm: failed to add /dev/sdb3 to /dev/md/1_0: Invalid argument mdadm: failed to RUN_ARRAY /dev/md/1_0: Invalid argument mdadm: /dev/md/0_0 has been started with 1 drive (out of 2). mdadm: failed to add /dev/sdb3 to /dev/md/1_0: Invalid argument mdadm: failed to RUN_ARRAY /dev/md/1_0: Invalid argument root@ls410d:~# ls -l /dev/md* brw-rw---T 1 root disk 9, 123 12月 8 21:33 /dev/md123 brw-rw---T 1 root disk 9, 124 12月 8 21:33 /dev/md124 brw-rw---T 1 root disk 9, 125 12月 8 21:33 /dev/md125 brw-rw---T 1 root disk 9, 126 12月 8 21:33 /dev/md126 brw-rw---T 1 root disk 9, 127 12月 8 21:33 /dev/md127 /dev/md: 合計 0 lrwxrwxrwx 1 root root 8 12月 8 21:33 0_0 -> ../md124 lrwxrwxrwx 1 root root 8 12月 8 21:33 LS-WSXL-EME75:1 -> ../md125 lrwxrwxrwx 1 root root 8 12月 8 21:33 LS-WSXL-EME75:10 -> ../md126 lrwxrwxrwx 1 root root 8 12月 8 21:33 LS-WSXLE75:21 -> ../md127 root@ls410d:~#
root@ls410d:~# mkdir /tmp/root root@ls410d:~# mount /dev/md125 /tmp/root root@ls410d:~# ls /tmp/root bin dev home lib mnt resources sbin tmp var boot etc initrd lost+found proc root sys usr www root@ls410d:~#
root@ls410d:~# cd /tmp/root/etc/ root@ls410d:/tmp/root/etc# grep root shadow root::11009:0:99999:7::: root@ls410d:/tmp/root/etc#付いていない。。。
root@ls410d:/tmp/root/etc# mv sshd_config{,.orig}
root@ls410d:/tmp/root/etc# cp sshd_config{.orig,}
root@ls410d:/tmp/root/etc# patch < /mnt/share/sshd_config.diff
patching file sshd_config
root@ls410d:/tmp/root/etc# !cp:s/cp/diff -u/
diff -u sshd_config{.orig,}
--- sshd_config.orig 2011-01-06 11:07:39.000000000 +0900
+++ sshd_config 2013-12-08 21:35:36.000000000 +0900
@@ -20,7 +20,7 @@
# HostKeys for protocol version 2
#HostKey /etc/ssh_host_rsa_key
#HostKey /etc/ssh_host_dsa_key
-HostKey /etc/apache/server.key
+#HostKey /etc/apache/server.key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
@@ -34,8 +34,8 @@
# Authentication:
#LoginGraceTime 2m
-#PermitRootLogin yes
-PermitRootLogin no
+PermitRootLogin yes
+#PermitRootLogin no
#StrictModes yes
#RSAAuthentication yes
@@ -55,6 +55,7 @@
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
+PermitEmptyPasswords yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
@@ -71,7 +72,8 @@
# Set this to 'yes' to enable PAM authentication (via challenge-response)
# and session processing. Depending on your PAM configuration, this may
# bypass the setting of 'PasswordAuthentication'
-UsePAM yes
+#UsePAM yes
+UsePAM no
#AllowTcpForwarding yes
#GatewayPorts no
root@ls410d:/tmp/root/etc#
the device is found by lsof(8) or fuser(1))
root@ls410d:/tmp/root/etc# cd /
root@ls410d:/# umount /tmp/root
root@ls410d:/#
エクスプローラで \\lswsxl\share をアクセス
hackkit というフォルダーを作成。
ハックキットのファイルを置く
念のため、ssh でログインして確認
root@LS-WSXLE75:~# ls -l /mnt/disk1/share/hackkit/ -rwxrw-rw- 1 nobody nogroup 646596 Nov 22 2009 busybox-telnetd_static* -rwxrw-rw- 1 nobody nogroup 102307216 Nov 4 18:10 hackkit_wheezy_armel_131104.tar.gz* -rwxrw-rw- 1 nobody nogroup 2254 Nov 4 17:41 makehackkit_131104.sh* -rwxrw-rw- 1 nobody nogroup 15920 Oct 26 2008 mkimage* -rwxrw-rw- 1 nobody nogroup 1144 Nov 28 2009 ramroot_091128.sh* root@LS-WSXLE75:~#スタティックリンクした busybox-telnetd_static も置く
root@LS-WSXLE75:/mnt/disk1/share/hackkit# ls busybox-telnetd_static* mkimage* hackkit_wheezy_armel_131104.tar.gz* ramroot_091128.sh* makehackkit_131104.sh* root@LS-WSXLE75:/mnt/disk1/share/hackkit# cp ramroot_091128.sh ramroot_131208.sh root@LS-WSXLE75:/mnt/disk1/share/hackkit# vi !$ : : root@LS-WSXLE75:/mnt/disk1/share/hackkit# !cp:s/cp/diff/ diff ramroot_091128.sh ramroot_131208.sh --- ramroot_091128.sh Sat Nov 28 15:20:00 2009 +++ ramroot_131208.sh Sun Dec 8 16:32:49 2013 @@ -32,6 +32,10 @@ sed -e 's/^ANSWER=.*$/ANSWER=1/' -e '/-RamdiskRoot-/a/usr/sbin/telnetd' linuxrc.orig > linuxrc chmod 700 linuxrc +echo "copying telnetd..." +cp /mnt/disk1/share/hackkit/busybox-telnetd_static usr/sbin/telnetd +chmod +x usr/sbin/telnetd + echo "clearing root's password..." cd /tmp/root/etc root@LS-WSXLE75:/mnt/disk1/share/hackkit#おお。。diff できる
root@LS-WSXLE75:/mnt/disk1/share/hackkit# sh ramroot_131208.sh Extracting initrd... 150736+1 records in 150736+1 records out mounting initrd... editing linuxrc... copying telnetd... clearing root's password... rebuilding initrd.buffalo... gziping initrd ... wait 5 minutes Image Name: initrd Created: Sun Dec 8 22:01:47 2013 Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 9923766 Bytes = 9691.18 kB = 9.46 MB Load Address: 0x00000000 Entry Point: 0x00000000 root@LS-WSXLE75:/mnt/disk1/share/hackkit#できたかな？？
yasunari@sil:~$ telnet lswsxl Trying 192.168.2.58... Connected to lswsxl. Escape character is '^]'. BUFFALO INC. LinkStation series sh-3.2#
sh-3.2# date Sun Dec 8 22:04:57 JST 2013 sh-3.2#あってる
sh-3.2# mkdir /mnt/disk1 sh-3.2# mount /dev/sda6 /mnt/disk1 mount: mounting /dev/sda6 on /mnt/disk1 failed: Invalid argument sh-3.2#あれ？
sh-3.2# fdisk -l /dev/sda Disk /dev/sda: 40.0 GB, 40020664320 bytes 255 heads, 63 sectors/track, 4865 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 1 4866 39082679+ ee EFI GPT sh-3.2# parted -s /dev/sda print Model: Hitachi HTS541040G9SA00 (scsi) Disk /dev/sda: 40.0GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 1049kB 1026MB 1024MB ext3 primary 2 1026MB 6146MB 5120MB primary 3 6146MB 6147MB 1049kB primary 4 6147MB 6148MB 1049kB primary 5 6148MB 7172MB 1024MB primary 6 7172MB 32.0GB 24.8GB primary sh-3.2#パーティションはあるのに、、、
|
|
← RAM root に telnet |
ハックの記録 LinkStation／玄箱 をハックしよう |
→ sda6 のマウント |
Copyright (C) 2003-2013 Yasunari Yamashita. All Rights Reserved.
yasunari ＠ yamasita.jp 山下康成＠京都府向日市
