Category:Network Space

From NAS-Central Lacie Wiki
Revision as of 19:04, 10 March 2009 by Daan (Talk | contribs) (When accessed through ssh or telnet after hacking)

Jump to: navigation, search
This article is currently a stub. You can help this Wiki by expanding it

. This template will categorize articles that include it into Category:Stubs.

Network Space.jpg
Space Network
CPU ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
RAM 2 x 8MB = 16MB
Flash ROM
Other Marvell Development Board (LSP Version 2.2.2_NAS_GDP)-- RD-88F6082-NAS-PH Soc: MV88F6082 Rev 1
NIC
USB USB Universal Host Controller Interface driver v2.2
internal HDD Vendor: SAMSUNG Model: HD103UJ Rev: 1AA0
IDE Controller
Drive Capacity 500GB or 1TB
Fan None
OS Linux version 2.6.12.6-arm1 (jrichefeu@grp-horus) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #2 Thu Aug 14 16:36:28 CEST 2008

Without dissembling

Log file downloaded through the web interface

$ cat edmini_log.txt 
Jan  1 00:00:23 (none) syslog.info syslogd started: BusyBox v1.1.0 (2006.11.03-14:53+0000)
Jan  1 00:00:24 (none) user.notice kernel: klogd started: BusyBox v1.1.0 (2006.11.03-14:53+0000)
Jan  1 00:00:24 (none) user.notice kernel: Linux version 2.6.12.6-arm1 (jrichefeu@grp-horus) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #2 Thu Aug 14 16:36:28 CEST 2008
Jan  1 00:00:24 (none) user.warn kernel: CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
Jan  1 00:00:24 (none) user.warn kernel: CPU0: D VIVT write-back cache
Jan  1 00:00:24 (none) user.warn kernel: CPU0: I cache: 16384 bytes, associativity 1, 32 byte lines, 512 sets
Jan  1 00:00:24 (none) user.warn kernel: CPU0: D cache: 16384 bytes, associativity 1, 32 byte lines, 512 sets
Jan  1 00:00:24 (none) user.warn kernel: Machine: Feroceon
Jan  1 00:00:24 (none) user.warn kernel: Using UBoot passing parameters structure
Jan  1 00:00:24 (none) user.warn kernel: Memory policy: ECC disabled, Data cache writeback
Jan  1 00:00:24 (none) user.debug kernel: On node 0 totalpages: 4096
Jan  1 00:00:24 (none) user.debug kernel:   DMA zone: 4096 pages, LIFO batch:1
Jan  1 00:00:24 (none) user.debug kernel:   Normal zone: 0 pages, LIFO batch:1
Jan  1 00:00:24 (none) user.debug kernel:   HighMem zone: 0 pages, LIFO batch:1
Jan  1 00:00:24 (none) user.warn kernel: Built 1 zonelists
Jan  1 00:00:24 (none) user.notice kernel: Kernel command line: console=ttyS0,115200 root=/dev/sda7 ro boardType=mv88F6082 productType=Aston reset=0
Jan  1 00:00:24 (none) user.warn kernel: mvBoardGpioIntMaskGet:Board intsGppMask 0
Jan  1 00:00:24 (none) user.warn kernel: PID hash table entries: 128 (order: 7, 2048 bytes)
Jan  1 00:00:24 (none) user.warn kernel: Console: colour dummy device 80x30
Jan  1 00:00:24 (none) user.warn kernel: Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Jan  1 00:00:24 (none) user.warn kernel: Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Jan  1 00:00:24 (none) user.info kernel: Memory: 8MB 8MB 0MB 0MB = 16MB total
Jan  1 00:00:24 (none) user.notice kernel: Memory: 13408KB available (2278K code, 385K data, 84K init)
Jan  1 00:00:24 (none) user.debug kernel: Calibrating delay loop... 219.54 BogoMIPS (lpj=1097728)
Jan  1 00:00:24 (none) user.warn kernel: Mount-cache hash table entries: 512
Jan  1 00:00:24 (none) user.info kernel: CPU: Testing write buffer coherency: ok
Jan  1 00:00:24 (none) user.info kernel: NET: Registered protocol family 16
Jan  1 00:00:24 (none) user.warn kernel: mvBoardMppGet mppGroupNum 0 mppGroup 4096
Jan  1 00:00:24 (none) user.warn kernel: mvBoardMppGet mppGroupNum 1 mppGroup 17
Jan  1 00:00:24 (none) user.warn kernel: Sys Clk = 166666667, Tclk = 133333333
Jan  1 00:00:24 (none) user.warn kernel: 
Jan  1 00:00:24 (none) user.warn kernel: CPU Interface
Jan  1 00:00:24 (none) user.warn kernel: -------------
Jan  1 00:00:24 (none) user.warn kernel: SDRAM_CS0 ....base 00000000, size   8MB 
Jan  1 00:00:24 (none) user.warn kernel: SDRAM_CS1 ....base 00800000, size   8MB 
Jan  1 00:00:24 (none) user.warn kernel: PEX0_MEM ....base e0000000, size 128MB 
Jan  1 00:00:24 (none) user.warn kernel: PEX0_IO ....base f2000000, size   1MB 
Jan  1 00:00:24 (none) user.warn kernel: INTER_REGS ....base f1000000, size   1MB 
Jan  1 00:00:24 (none) user.warn kernel: NFLASH_CS ....base f9000000, size   2MB 
Jan  1 00:00:24 (none) user.warn kernel: MFLASH_CS ....base f8000000, size 256KB 
Jan  1 00:00:24 (none) user.warn kernel: SPI_CS ....base fa000000, size   8MB 
Jan  1 00:00:24 (none) user.warn kernel: BOOT_ROM_CS ....base fc000000, size   1MB 
Jan  1 00:00:24 (none) user.warn kernel: DEV_BOOTCS ....base fc000000, size   1MB 
Jan  1 00:00:24 (none) user.warn kernel: CRYPT_ENG ....base f0000000, size  64KB 
Jan  1 00:00:24 (none) user.warn kernel: 
Jan  1 00:00:24 (none) user.warn kernel:   Marvell Development Board (LSP Version 2.2.2_NAS_GDP)-- RD-88F6082-NAS-PH  Soc: MV88F6082 Rev 1
Jan  1 00:00:24 (none) user.warn kernel: 
Jan  1 00:00:24 (none) user.warn kernel:  Detected Tclk 133333333 and SysClk 166666667 
Jan  1 00:00:24 (none) user.warn kernel: Marvell USB EHCI Host controller #0: c031eb00
Jan  1 00:00:24 (none) user.info kernel: PCI: bus0: Fast back to back transfers enabled
Jan  1 00:00:24 (none) user.notice kernel: SCSI subsystem initialized
Jan  1 00:00:24 (none) user.info kernel: usbcore: registered new driver usbfs
Jan  1 00:00:24 (none) user.info kernel: usbcore: registered new driver hub
Jan  1 00:00:24 (none) user.warn kernel: Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
Jan  1 00:00:24 (none) user.info kernel: inotify device minor=63
Jan  1 00:00:24 (none) user.warn kernel: Registering unionfs 1.1.5
Jan  1 00:00:24 (none) user.info kernel: Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
Jan  1 00:00:24 (none) user.warn kernel: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
Jan  1 00:00:24 (none) user.info kernel: io scheduler noop registered
Jan  1 00:00:24 (none) user.warn kernel: Marvell Ethernet Driver 'mv_ethernet':
Jan  1 00:00:24 (none) user.warn kernel:   o Uncached descriptors in DRAM
Jan  1 00:00:24 (none) user.warn kernel:   o DRAM SW cache-coherency
Jan  1 00:00:24 (none) user.warn kernel:   o TCP segmentation offload enabled
Jan  1 00:00:24 (none) user.warn kernel:   o Checksum offload enabled
Jan  1 00:00:24 (none) user.warn kernel:   o Rx desc: 64
Jan  1 00:00:24 (none) user.warn kernel:   o Tx desc: 128
Jan  1 00:00:24 (none) user.warn kernel:   o Loading network interface 'egiga0' 'egiga1' 
Jan  1 00:00:24 (none) user.info kernel: ipddp.c:v0.01 8/28/97 Bradford W. Johnson <johns393@maroon.tc.umn.edu>
Jan  1 00:00:24 (none) user.warn kernel: ipddp0: Appletalk-IP Encap. mode by Bradford W. Johnson <johns393@maroon.tc.umn.edu>
Jan  1 00:00:24 (none) user.warn kernel: Intergrated Sata device found
Jan  1 00:00:24 (none) user.info kernel: scsi0 : Marvell SCSI to SATA adapter
Jan  1 00:00:24 (none) user.notice kernel:   Vendor: SAMSUNG   Model: HD103UJ           Rev: 1AA0
Jan  1 00:00:24 (none) user.notice kernel:   Type:   Direct-Access                      ANSI SCSI revision: 03
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sda: 1953525168 512-byte hdwr sectors (1000205 MB)
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sda: drive cache: write back
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sda: 1953525168 512-byte hdwr sectors (1000205 MB)
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sda: drive cache: write back
Jan  1 00:00:24 (none) user.info kernel:  sda: sda1 < sda5 sda6 sda7 sda8 sda9 sda10 > sda2
Jan  1 00:00:24 (none) user.notice kernel: Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
Jan  1 00:00:24 (none) user.notice kernel: Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0,  type 0
Jan  1 00:00:24 (none) user.info kernel: ehci_platform ehci_platform.70059: EHCI Host Controller
Jan  1 00:00:24 (none) user.info kernel: ehci_platform ehci_platform.70059: new USB bus registered, assigned bus number 1
Jan  1 00:00:24 (none) user.info kernel: ehci_platform ehci_platform.70059: irq 17, io mem 0x00000000
Jan  1 00:00:24 (none) user.info kernel: ehci_platform ehci_platform.70059: park 0
Jan  1 00:00:24 (none) user.info kernel: ehci_platform ehci_platform.70059: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004
Jan  1 00:00:24 (none) user.info kernel: hub 1-0:1.0: USB hub found
Jan  1 00:00:24 (none) user.info kernel: hub 1-0:1.0: 1 port detected
Jan  1 00:00:24 (none) user.debug kernel: ntroller (OHCI) Driver (PCI)
Jan  1 00:00:24 (none) user.info kernel: USB Universal Host Controller Interface driver v2.2
Jan  1 00:00:24 (none) user.info kernel: Initializing USB Mass Storage driver...
Jan  1 00:00:24 (none) user.info kernel: usbcore: registered new driver usb-storage
Jan  1 00:00:24 (none) user.info kernel: USB Mass Storage support registered.
Jan  1 00:00:24 (none) user.info kernel: usbcore: registered new driver usbhid
Jan  1 00:00:24 (none) user.info kernel: drivers/usb/input/hid-core.c: v2.01:USB HID core driver
Jan  1 00:00:24 (none) user.info kernel: mice: PS/2 mouse device common for all mice
Jan  1 00:00:24 (none) user.warn kernel: DATA IN REG=28E1
Jan  1 00:00:24 (none) user.info kernel: aston_power 1.0 initialised
Jan  1 00:00:24 (none) user.info kernel: i2c /dev entries driver
Jan  1 00:00:24 (none) user.info kernel: rs5c372 0-0032: Oscillator halt detected, reseting clock to 01/01/2000
Jan  1 00:00:24 (none) user.info kernel: NET: Registered protocol family 2
Jan  1 00:00:24 (none) user.info kernel: IP: routing cache hash table of 512 buckets, 4Kbytes
Jan  1 00:00:24 (none) user.warn kernel: TCP established hash table entries: 1024 (order: 1, 8192 bytes)
Jan  1 00:00:24 (none) user.warn kernel: TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
Jan  1 00:00:24 (none) user.info kernel: TCP: Hash tables configured (established 1024 bind 1024)
Jan  1 00:00:24 (none) user.info kernel: NET: Registered protocol family 1
Jan  1 00:00:24 (none) user.info kernel: NET: Registered protocol family 17
Jan  1 00:00:24 (none) user.info kernel: NET: Registered protocol family 5
Jan  1 00:00:24 (none) user.info kernel: Loading I2C based RTC driver device interface.
Jan  1 00:00:24 (none) user.info kernel: Found TWSI adapter with id: 0
Jan  1 00:00:24 (none) user.info kernel: Found I2C RTC rs5c372 @ 0x32
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:24 (none) user.warn kernel: VFS: Mounted root (ext3 filesystem) readonly.
Jan  1 00:00:24 (none) user.info kernel: Freeing init memory: 84K
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3 FS on sda9, internal journal
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:24 (none) user.info kernel: SGI XFS with large block numbers, no debug enabled
Jan  1 00:00:24 (none) user.info kernel: usb 1-1: new high speed USB device using ehci_platform and address 2
Jan  1 00:00:24 (none) user.info kernel: scsi1 : SCSI emulation for USB Mass Storage devices
Jan  1 00:00:24 (none) user.debug kernel: usb-storage: device found at 2
Jan  1 00:00:24 (none) user.debug kernel: usb-storage: waiting for device to settle before scanning
Jan  1 00:00:24 (none) user.info kernel: input: USB HID v1.11 Device [OEM Mass Storage Plus] on usb-ehci_platform.70059-1
Jan  1 00:00:24 (none) user.err kernel: VFS: Can't find ext3 filesystem on dev sda2.
Jan  1 00:00:24 (none) user.err kernel: FAT: bogus number of FAT structure
Jan  1 00:00:24 (none) user.info kernel: VFS: Can't find a valid FAT filesystem on dev sda2.
Jan  1 00:00:24 (none) user.err kernel: FAT: bogus number of FAT structure
Jan  1 00:00:24 (none) user.info kernel: VFS: Can't find a valid FAT filesystem on dev sda2.
Jan  1 00:00:24 (none) user.warn kernel: HFS+-fs: unable to find HFS+ superblock
Jan  1 00:00:24 (none) user.notice kernel: XFS mounting filesystem sda2
Jan  1 00:00:24 (none) user.debug kernel: Ending clean XFS mount for filesystem: sda2
Jan  1 00:00:24 (none) user.notice kernel:   Vendor: Ext Hard  Model:  Disk             Rev:     
Jan  1 00:00:24 (none) user.notice kernel:   Type:   Direct-Access                      ANSI SCSI revision: 04
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
Jan  1 00:00:24 (none) user.err kernel: sdb: assuming drive cache: write through
Jan  1 00:00:24 (none) user.notice kernel: SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
Jan  1 00:00:24 (none) user.err kernel: sdb: assuming drive cache: write through
Jan  1 00:00:24 (none) user.info kernel:  sdb: sdb1
Jan  1 00:00:24 (none) user.notice kernel: Attached scsi disk sdb at scsi1, channel 0, id 0, lun 0
Jan  1 00:00:24 (none) user.notice kernel: Attached scsi generic sg1 at scsi1, channel 0, id 0, lun 0,  type 0
Jan  1 00:00:24 (none) user.debug kernel: usb-storage: device scan complete
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:24 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:24 (none) user.info kernel: EXT3 FS on sda9, internal journal
Jan  1 00:00:24 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:25 (none) user.info kernel: SGI XFS with large block numbers, no debug enabled
Jan  1 00:00:25 (none) user.warn kernel: fuse init (API version 7.8)
Jan  1 00:00:25 (none) user.warn kernel: fuse distribution version: 2.7.3
Jan  1 00:00:26 (none) user.info kernel: Adding 128448k swap on /dev/sda5.  Priority:-1 extents:1
Jan  1 00:00:27 (none) user.notice kernel: XFS mounting filesystem sda2
Jan  1 00:00:27 (none) user.debug kernel: Ending clean XFS mount for filesystem: sda2
Jan  1 00:00:30 (none) local0.info udhcpc[598]: udhcpc (v0.9.9-pre) started
Jan  1 00:00:30 (none) user.notice kernel: egiga0: link down
Jan  1 00:00:32 (none) user.notice kernel: egiga0: link up, full duplex, speed 100 Mbps
Jan  1 00:00:34 (none) local0.info udhcpc[598]: Lease of 192.168.1.9 obtained, lease time 172800
Jan  1 00:00:42 (none) daemon.info ifplugd(egiga0)[770]: ifplugd 0.28 initializing.
Jan  1 00:00:42 (none) daemon.info ifplugd(egiga0)[770]: Using interface egiga0/00:D0:4B:86:23:B0 with driver <egiga> (version: )
Jan  1 00:00:42 (none) daemon.info ifplugd(egiga0)[770]: Using detection mode: SIOCETHTOOL
Jan  1 00:00:42 (none) daemon.info ifplugd(egiga0)[770]: Initialization complete, link beat detected.
Jan  1 00:00:42 (none) daemon.info ifplugd(egiga0)[770]: Executing '/etc/ifplugd/ifplugd.action egiga0 up'.
Jan  1 00:00:42 (none) daemon.warn ifplugd(egiga0)[770]: client: route: SIOC[ADD|DEL]RT: No such process
Jan  1 00:00:43 (none) daemon.info ifplugd(egiga0)[770]: Program executed successfully.
Jan  1 00:00:44 (none) user.info ipconfd[817]: daemon started 
Jan  1 00:00:46 (none) authpriv.debug httpd: pam_unix(httpd:account): account admin has password changed in future
Jan  1 00:00:46 (none) authpriv.info httpd: pam_unix(httpd:session): session opened for user admin by (uid=0)
Jan  1 00:00:46 (none) authpriv.info httpd: pam_unix(httpd:session): session closed for user admin
Jan  1 00:00:49 (none) authpriv.debug httpd: pam_unix(httpd:account): account admin has password changed in future
Jan  1 00:00:49 (none) authpriv.info httpd: pam_unix(httpd:session): session opened for user admin by (uid=0)
Jan  1 00:00:49 (none) authpriv.info httpd: pam_unix(httpd:session): session closed for user admin


nmap port scan

# nmap 192.168.1.64 -p- -sV

Starting Nmap 4.62 ( http://nmap.org ) at 2009-02-06 22:07 CET
Interesting ports on 192.168.1.64:
Not shown: 65528 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         ProFTPD 1.3.2rc1
80/tcp   open  http?
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
548/tcp  open  afp?
3689/tcp open  http        mt-daapd httpd 0.2.4.1
9000/tcp open  unknown
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
[...]

Port 80 is used for web based configuration of the Network Space provided by LaCie. Web browsing through port 3689 should get you to the mt-daapd configuration pages, but the admin account that works on port 80 does not work here. Interesting is the service at port 9000. It is TwonkyVision media server version 4.4.6. http://192.168.1.64:9000/webbrowse lets you browse and stream your media from a web page. http://192.168.1.64:9000/webbrowse-e61 and http://192.168.1.64:9000/webbrowse-n95 do the same for mobile devices with a small screen. These features are not mentioned in the manual provided by LaCie.

Accessing the web config pages of the Twonky media server

Browsing to http://192.168.1.64:9000 normally gives a red page saying "Access is restricted to MediaServer configuration!". However, you can access the configuration pages by exploiting a bug in the Twonky server 4.4.6. Change the IP address of the machine you are connecting from, or of the Network Space, or of both, as in these examples:

your machine: 192.168.1.6; NAS: 192.168.1.64
your machine: 192.168.1.6; NAS: 192.168.1.66
your machine: 192.168.1.7; NAS: 192.168.1.77
your machine: 192.168.0.2; NAS: 192.168.0.22

These have been reported to work, others probably work too. After setting the ip's like this, browsing to e.g. http://192.168.1.64:9000 should get you to a page from which you can click to the Twonky server configuration pages.

It seems that the IP-validation is not 100% waterproof. They do not check wether the ip length of the machine (PC) equals that of the server (NAS). Then they validate only the length of the ip of the machine (PC). So for example:

Your machine: 192.168.100.1
Would match a NAS on: 192.168.100.1xx, with x being any number or not set.
So 192.168.100.10, 192.168.100.19, 192.168.100.133 etc...

my subnet is in the 192.168.254.x-range and i have performed some tests that confirm this theory. After being able to access the config pages once you will be able to change the configuration from any system (authentication with admin required), so you are not required to be in the special IP-range anymore.

Note: I succeeded in crashing the Twonky webserver (other services stayed up and running). By browsing through the content i 'found' a folder with lots of content in it (actually: 90% of all images contained no 'date taken' info and was mapped to the same day. Opening that folder caused the server to stop responding to any other request. Pagination is required (but not yet available)!

Accessing the web config pages of the mt-daapd media server (FireFly Media Server)

mt-daapd stands for Multi-Threaded DAAP Daemon, from the SourceForge project page:

"A multi-threaded DAAP server for Linux and other POSIX type systems. Allows a Linux box to share audio files with iTunes users on Windows or Mac."

At port 3689 the user is greeted with a login pop-up window for the mt-daapd media server. As of firmware version 1.1.6 on the NetworkSpace, mt-daapd 0.2.4.1 is used. Using the following for logging in will get full access to the mt-daapd configuration webpages:

username: admin
password: L@CieD@@pd

The config file for the mt-daapd server:

#
# mt-daapd.conf
#
# Edited: Mon Mar 17 08:24:05 2008
# By: admin
#
web_root /usr/share/mt-daapd/admin-root
port 3689
admin_pw L@CieD@@pd
mp3_dir /home/openshare
servername NetworkSpace
runas root
playlist /etc/mt-daapd/mt-daapd.playlist
extensions .mp3,.m4a,.m4p,.wav,.aac
db_dir /var/cache/mt-daapd
rescan_interval 3600
scan_type 0
always_scan 0
logfile /var/log/mt-daapd.log
process_m3u 1
compress 0

As you see the web-root folder CAN be modified, so it even would be located in the shared area. Of course it would be preferred to place it in a (subfolder in the) myshare-area preventing the configuration to be world-editable. This way you would be able to edit the layout and markup of the config pages and so on. It is not (yet) possible to inject functionality (shell commands for example) into the server. The server is a bunch of compiled c-sources (library). No scripting what so ever... (source code available, earlier mentioned link)

With dissembling

The plastic top of the device can be dissembled form the metal bottom. There are 3 tabs in the plastic cover on both long sides. You will need to push away those tabs. To prevent a tab from popping back when working on another tab, you can use a few thin knives. One for every tab. Open one side a bit first, than the other side a bit and last both sides together. After removing the cover, unscrew the four screws of the hard disk and pull it out straight and level in the direction of the blue LED.

You can hack the Network Space using instructions for the LaCie EDmini version 2:

http://jebimony.com/blog/content/add-ssh-lacie-edmini-v2

For getting ssh to work using the above instructions, only the packages openssh, openssl and tcp-wrapper are needed.

When hooked up to a desktop

After getting the hard disk out, you can hook it up to your computer through a SATA to USB adapter or simply build it in to your desktop pc. You need a Linux operating system for this. If you don't have Linux installed you can use a Linux live cd like Knoppix.

# fdisk -l /dev/sdb

Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1         125     1004031    5  Extended
/dev/sdb2             126      121601   975755970   83  Linux
/dev/sdb5               1          16      128457   82  Linux swap / Solaris
/dev/sdb6              17          17        8001   83  Linux
/dev/sdb7              18          18        8001   83  Linux
/dev/sdb8              19          40      176683+  83  Linux
/dev/sdb9              41         124      674698+  83  Linux
/dev/sdb10            125         125        8001   83  Linux
# file -sL /dev/sdb*
/dev/sdb:   x86 boot sector; partition 1: ID=0x5, starthead 1, startsector 63, 2008062 sectors; partition 2: ID=0x83, starthead 0, startsector 2008125, 1951511940 sectors
/dev/sdb1:  x86 boot sector; partition 1: ID=0x82, starthead 2, startsector 63, 256914 sectors; partition 2: ID=0x5, starthead 0, startsector 256977, 16065 sectors
/dev/sdb10: data
/dev/sdb2:  SGI XFS filesystem data (blksz 4096, inosz 256, v2 dirs)
/dev/sdb5:  Linux/i386 swap file (new style), version 1 (4K pages), size 32113 pages, no label, UUID=0-0-0-0-00
/dev/sdb6:  u-boot/PPCBoot image
/dev/sdb7:  Linux rev 1.0 ext3 filesystem data, UUID=eec3d367-ddc-4dfd-96e0-d6b8228a6abd (needs journal recovery)
/dev/sdb8:  Linux rev 1.0 ext3 filesystem data, UUID=133b35ca-4c3b-4895-95e2-8dfdcfa6875e (needs journal recovery)
/dev/sdb9:  Linux rev 1.0 ext3 filesystem data, UUID=a1204eb0-6e57-4b60-a979-fbc05ae55a76 (needs journal recovery)

Partition numbers 2, 7, 8 and 9 are mountable, number 2 being of type xfs and the other three of type ext3.

# mkdir /mnt/sdb2 /mnt/sdb7 /mnt/sdb8 /mnt/sdb9
# mount -t xfs /dev/sdb2 /mnt/sdb2
# mount -t ext3 /dev/sdb7 /mnt/sdb7
# mount -t ext3 /dev/sdb8 /mnt/sdb8
# mount -t ext3 /dev/sdb9 /mnt/sdb9
# ls /mnt/sdb*
/mnt/sdb2:
myshare  openshare

/mnt/sdb7:
bin  boot  dev	etc  home  include  lib  linuxrc  lost+found  mnt  opt	proc  root  sbin  snapshots  sys  tmp  usr  var

/mnt/sdb8:
bin  boot  dev	etc  home  lib	linuxrc  log  lost+found  mnt  opt  proc  root	sbin  shutdown	sys  tmp  usr  var  www

/mnt/sdb9:
EDMINI	lost+found  snaps

When accessed through ssh or telnet after hacking

# cat /etc/fstab
# Swap partition entry
/dev/sda5	swap	swap	defaults	0 0

# Mount the ROOT filesystem from the hard drive
/dev/sda7	/	ext3	defaults,ro	1 1	

# Mount the virtual proc filesystem
none	/proc	proc	defaults	0 0

#UserData
/dev/sda2	/home	xfs	defaults,rw	1 2
# cat /etc/mtab
none /sys sysfs rw 0 0
none /proc/bus/usb usbfs rw 0 0
/dev/sda2 /home xfs rw 0 0
/dev/sda9 /oldroot/snapshots ext3 rw 0 0

top gives

Mem: 12832K used, 684K free, 0K shrd, 76K buff, 912K cached
Load average: 2.40, 2.46, 2.44    (State: S=sleeping R=running, W=waiting)

  PID USER     STATUS   RSS  PPID %CPU %MEM COMMAND
  958 root     S       6288   953 33.8 46.5 twonkymediaserv
 5422 root     R <      328  4991  2.6  2.4 top
   50 root     SW         0     1  1.9  0.0 kswapd0
  740 root     SW         0     1  0.9  0.0 proftpd
  613 root     S         48     1  0.5  0.3 ifplugd
  928 root     S          8     1  0.5  0.0 mt-daapd
  391 root     SW         0     1  0.3  0.0 xfsbufd
 4986 root     SW<        0  1380  0.3  0.0 sshd
  811 root     S         56     1  0.0  0.4 atalkd
 1168 root     SW         0   770  0.0  0.0 smbd
  759 root     SW         0     1  0.0  0.0 nmbd
  588 root     SW         0     1  0.0  0.0 mDNSResponderPo
   48 root     SW         0     5  0.0  0.0 pdflush
 1060 root     SW<        0  1056  0.0  0.0 utelnetd
 1245 root     SW         0     5  0.0  0.0 pdflush
  249 root     SW         0     1  0.0  0.0 kjournald
 4991 root     SW<        0  4986  0.0  0.0 sh
  389 root     SW<        0     5  0.0  0.0 xfslogd/0
 5218 root     SW         0   770  0.0  0.0 smbd
# ps
  PID  Uid     VmSize Stat Command
    1 root            SW  init       
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
   10 root            SW< [kblockd/0]
   13 root            SW  [khubd]
   48 root            SW  [pdflush]
   51 root            SW< [aio/0]
   50 root            DW  [kswapd0]
  167 root            SW  [scsi_eh_0]
  201 root            SW  [kjournald]
  247 root            SW  [kjournald]
  249 root            SW  [kjournald]
  359 root            SW  syslogd -m 0 
  370 root            SW  klogd -c 2 
  389 root            SW< [xfslogd/0]
  390 root            SW< [xfsdatad/0]
  391 root            SW  [xfsbufd]
  440 root            SW  [xfssyncd]
  588 root            SW  /usr/bin/mDNSResponderPosix -b -f /etc/mDNSResponder.
  599 root            SW< /usr/sbin/httpd -p 80 -h /www -r LaCie LaCie Network 
  613 root         48 S   /usr/sbin/ifplugd -i egiga0 -fwI -u10 -d0 --run=/etc/
  657 root            SW  /usr/bin/ipconfd 
  683 root            SW< /sbin/udevd --daemon 
  740 root            SW  proftpd: (accepting connections)
  759 root            SW  /usr/sbin/nmbd -D 
  770 root            SW  /usr/sbin/smbd -D 
  780 root            SW  /usr/sbin/smbd -D 
  811 root          4 S   /usr/sbin/atalkd 
  886 root            SW  /usr/sbin/papd 
  903 root            SW  /usr/sbin/afpd -g nobody -c 50 -n SpaceNetwork 
  928 root         44 S   /usr/sbin/mt-daapd -m -d 0 -c /etc/mt-daapd/mt-daapd.
  953 root            SW  /usr/local/TwonkyVision/twonkymedia -inifile /usr/loc
  958 root       5524 S   /usr/local/TwonkyVision/twonkymediaserver -inifile /u
 1004 root            SW  /sbin/getty 115200 ttyS0 vt100 
 1055 root            SW< /usr/sbin/httpd -p 80 -h /www -r LaCie LaCie Network 
 1056 root            SW< /bin/sh /www/cgi-bin/admin/webshell
 1060 root            SW< /home/myshare/nas/utelnetd 
 1168 root            SW  /usr/sbin/smbd -D 
 1245 root            SW  [pdflush]
 1380 root            SW< /usr/sbin/sshd 
 4986 root        284 S < sshd: new_root@ttyp0
 4991 root        228 S < -sh 
 5218 root         40 S   /usr/sbin/smbd -D 
 5436 root        708 R < ps
<pre>

Here, the webshell and utelnetd result from the hacking.