まっさらにする

LS-QL

セキュリティホールをまっさらな状態から確認してみる。
今度は LS-QL

まっさらな状態にするには

まっさらな状態にするには、
パーティションを削除して
tftpboot して、
ファームウェアアップデート
する。

uImage.buffalo, uboot.buffalo の吸出し

まずは、tftpboot するために、標準ファームの HDD を tftp サーバである旧型 LS-GL に接続し、 標準ファームの HDD の /boot にある uImage.buffalo, uboot.buffalo を 旧型 LS-GL の /srv/tftp に置く。

標準ファームの HDD を USB で旧型 LS-GL に接続

ude:~# tail -f /var/log/messages
	:
	:
Mar 27 15:14:23 ude kernel:  Vendor: SAMSUNG   Model: J9AQC00304        Rev: 1114
Mar 27 15:14:23 ude kernel:  Type:   Direct-Access                      ANSI SCSI revision: 02
Mar 27 15:14:23 ude kernel: SCSI device sdb: 1953525168 512-byte hdwr sectors (1000205 MB)
Mar 27 15:14:23 ude kernel: sdb: Write Protect is off
Mar 27 15:14:23 ude kernel: SCSI device sdb: 1953525168 512-byte hdwr sectors (1000205 MB)
Mar 27 15:14:23 ude kernel: sdb: Write Protect is off
Mar 27 15:14:23 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 >
Mar 27 15:14:23 ude kernel: sd 2:0:0:0: Attached scsi disk sdb
Mar 27 15:14:23 ude kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0
	:
	:
正常に、sdb と認識された。

マウント

/tmp/boot にマウント
ude:~# mkdir /tmp/root
ude:~# mount /dev/sdb1 /tmp/root
mount: unknown filesystem type 'mdraid'
ude:~#
あー、これも RAID か。

標準ファームで起動

HDD を LS-QL に戻して標準ファームで起動

標準ファームにログイン

BUFFALO INC. LinkStation series
LS-QL233 login: root
No mail.
root@LS-QL233:~#

ftp put

root@LS-QL233:~# which ftp
/usr/local/bin/ftp
root@LS-QL233:~#
LS-QL には ftp コマンドがあった。
ftp で put する。
root@LS-QL233:~# cd /boot
root@LS-QL233:/boot# ls
conf_save.tgz                   u-boot.buffalo
hddrootfs.buffalo.updated.done  u-boot.buffalo.org
initrd.buffalo                  uImage.buffalo
root@LS-QL233:/boot# ftp ude.yamasita.jp
Connected to ude.yamasita.jp.
220 ude FTP server (GNU inetutils 1.5) ready.
500 'AUTH GSSAPI': command not understood.
500 'AUTH KERBEROS_V4': command not understood.
KERBEROS_V4 rejected as an authentication type
Name (ude.yamasita.jp:root): yasunari
331 Password required for yasunari.
Password:
230- Linux ude 2.6.16.16-arm1 #37 Tue May 20 10:01:57 JST 2008 armv5tejl
230-
230- The programs included with the Debian GNU/Linux system are free software;
230- the exact distribution terms for each program are described in the
230- individual files in /usr/share/doc/*/copyright.
230-
230- Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
230- permitted by applicable law.
230 User yasunari logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /srv/tftp
250 CWD command successful.
ftp> mkdir LS-QL_1.07b
257 (unknown absolute name) new directory created.
ftp> cd LS-QL_1.07b
250 CWD command successful.
ftp> bin
200 Type set to I.
ftp> hash
Hash mark printing on (1024 bytes/hash mark).
ftp> put initrd.buffalo
local: initrd.buffalo remote: initrd.buffalo
200 PORT command sucessful.
150 Opening BINARY mode data connection for 'initrd.buffalo'.
###########################################(略)
226 Transfer complete.
7048407 bytes sent in 0.45 seconds (1.5e+04 Kbytes/s)
ftp> put uI
local: uI remote:
local: uI: No such file or directory
ftp> put uImage.buffalo
local: uImage.buffalo remote: uImage.buffalo
200 PORT command sucessful.
150 Opening BINARY mode data connection for 'uImage.buffalo'.
###########################################(略)
226 Transfer complete.
2115640 bytes sent in 0.13 seconds (1.5e+04 Kbytes/s)
ftp> bye
221 Goodbye.
root@LS-QL233:/boot#

LS-QL をシャットダウン

tftp サーバの準備

tftp サーバである旧型 LS-GL で tftpboot できるよう準備する。

モードの確認

ude:~# cd /srv/tftp/LS-QL_1.07b/
ude:/srv/tftp/LS-QL_1.07b# ls -l
total 8952
-rw-r----- 1 yasunari root 7048407 Mar 27 15:24 initrd.buffalo
-rw-r----- 1 yasunari root 2115640 Mar 27 15:25 uImage.buffalo
ude:/srv/tftp/LS-QL_1.07b#
モードを変更する。
ude:/srv/tftp/LS-QL_1.07b# chmod 664 *
ude:/srv/tftp/LS-QL_1.07b#

リンク

LS-QL 用にリンクを張りなおす。
ude:/srv/tftp# ls -l
total 7288
drwxr-s--- 2 yasunari root      48 Mar 22 10:12 HS-DHGL_1.20
drwxrwxr-x 2 root     root      48 Jan 24 09:31 LS-CL+HackKit
drwxr-sr-x 2 root     root      48 Mar 23 17:44 LS-CL_1.07
drwxrwxr-x 2 yasunari root      48 Mar 20 14:32 LS-GL_1.15
drwxr-sr-x 2 root     root      48 Mar 23 14:22 LS-HGL_1.07b
drwxr-sr-x 2 root     root      48 Mar 23 13:31 LS-LGL_2.01
drwxrwxr-x 2 root     root      48 Feb 20 12:00 LS-QL_1.05+telnet
drwxr-s--- 2 yasunari root      48 Mar 27 15:25 LS-QL_1.07b
drwxr-sr-x 2 yasunari root      48 Mar 25 21:04 LS-WSGL_1.06
drwxrwxr-x 2 root     root      48 Jan 24 18:00 LS-XHL_1.02
drwxrwxr-x 2 root     root      64 Jan 24 22:17 LS-XHL_1.02+telnet
-rw-r--r-- 2 yasunari root 5697905 Mar 25 21:04 initrd.buffalo
-rw-r--r-- 2 yasunari root 1757604 Mar 25 21:04 uImage.buffalo
ude:/srv/tftp# rm initrd.buffalo uImage.buffalo
ude:/srv/tftp# ln LS-QL_1.07b/* .
ude:/srv/tftp#

まっさらな HDD の用意

実験用 HDD として、今回も MAXTOR DiamondMax Plus 9 160GB を使う。

USB で接続

旧形 LS-GL に USB で接続

パーティションの削除

取り外し

USB ケーブルを抜き、HDD への電源を絶つ。

まっさらな HDD の接続

パーティションを削除した MAXTOR DiamondMax Plus 9 160GB を LS-QL のトレイに収め、LS-QL にセットする。

tftpboot

LS-QL に AC アダプタを刺す。
Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== CPU-ID       : 0x00005182 ===
=== Strap status : 0x00801030 ===
=== H/W boardId  :       0x2b ===
=== boardId      :       0x1f ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-QL/R5 U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_QL_R5 LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (Jan 27 2009 - 15:37:01) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.24-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 200Mhz , TClock = 166Mhz


USB 0: host mode
Net:   egiga0 [PRIME]
Using 88E1118 phy

Marvell Serial ATA Adapter
Integrated Sata device found
found port multi device 0
PM found

buffalo_change_power_status > Read 0x5c
buffalo_IsStopAtUbootStatus > MagicKey=0x5c
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...
電源 SW を ON にする。
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a
HDD1 Power ON
HDD2 Power ON
HDD3 Power ON
HDD4 Power ON

Marvell Serial ATA Adapter
Integrated Sata device found
Port Multiplier found @ 0 0. Vendor: 11ab ports: 4
  Device 0 @ 0 0 0:
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

MAC Address on eth0 : 00:1D:73:A5:32:33
MAC Addread read from block device 0 :
SKIP Loading kernel and initrd
This HDD [block device 0] seems to contain other system
** Bad partition 6 **
** Bad partition - 1:0 **
serch_boot_drv (360)>Read error : device 1
SKIP Loading kernel and initrd
This HDD [block device 1] seems to contain other system
** Bad partition 6 **
** Bad partition - 2:0 **
serch_boot_drv (360)>Read error : device 2
SKIP Loading kernel and initrd
This HDD [block device 2] seems to contain other system
** Bad partition 6 **
** Bad partition - 3:0 **
serch_boot_drv (360)>Read error : device 3
SKIP Loading kernel and initrd
This HDD [block device 3] seems to contain other system
** Bad partition 6 **
All devices look like other system
Anyway boot from any device
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 1
Using device ide2, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 2
Using device ide2, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 2
Using device ide3, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 3
Using device ide3, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 3
Lost all init_rd
func SW を押す。
func switch pushed, and exited loop
wait until func switch released.
Already HDD1 Power ON
Already HDD2 Power ON
Already HDD3 Power ON
Already HDD4 Power ON

Marvell Serial ATA Adapter
Integrated Sata device found
Port Multiplier found @ 0 0. Vendor: 11ab ports: 4

MAC Address on eth0 : 00:1D:73:A5:32:33
** Bad partition - 0:0 **
serch_boot_drv (360)>Read error : device 0
SKIP Loading kernel and initrd
This HDD [block device 0] seems to contain other system
** Bad partition 6 **
** Bad partition - 1:0 **
serch_boot_drv (360)>Read error : device 1
SKIP Loading kernel and initrd
This HDD [block device 1] seems to contain other system
** Bad partition 6 **
** Bad partition - 2:0 **
serch_boot_drv (360)>Read error : device 2
SKIP Loading kernel and initrd
This HDD [block device 2] seems to contain other system
** Bad partition 6 **
** Bad partition - 3:0 **
serch_boot_drv (360)>Read error : device 3
SKIP Loading kernel and initrd
This HDD [block device 3] seems to contain other system
** Bad partition 6 **
All devices look like other system
Anyway boot from any device
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 1
Using device ide2, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 2
Using device ide2, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 2
Using device ide3, partition 1
** Bad partition 1 **
serch_boot_drv (410)>No kernel_file 3
Using device ide3, partition 1
** Bad partition 1 **
serch_boot_drv (465)>No init_file 3
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################
done
Bytes transferred = 2115640 (204838 hex)
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'initrd.buffalo'.
Load address: 0x800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############
done
Bytes transferred = 7048407 (6b8cd7 hex)
<<stop_sound>>
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.22.7
   Created:      2009-03-09   8:47:45 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2115576 Bytes =  2 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
   Image Name:   initrd
   Created:      2009-03-09   8:48:49 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    7048343 Bytes =  6.7 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

Starting kernel ...

arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,32M panic=5 BOOTVER=1.24 tftpboot=yes
CONFIG_BUFFALO_PLATFORM ---
Uncompressing Linux..................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.7 (root@build2.dd-hot24.nas.buffalo.local) (gcc version 4.2.0 20070413 (prerelease)) #4 Mon Mar 9 17:47:36 JST 2009
CPU: ARM926EJ-S [41069260] revision 0 (ARMv5TEJ), cr=a0053177
Machine: Feroceon
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists.  Total pages: 32512
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,32M panic=5 BOOTVER=1.24 tftpboot=yes
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 92728KB available (3828K code, 294K data, 120K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
env_format_version = 0x00000006
product_id = 0x00004000
Sys Clk = 200000000, Tclk = 166664740

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PCI0_MEM ....base e8000000, size 128MB
PCI0_IO ....base f2100000, size   1MB
INTER_REGS ....base f1000000, size   1MB
DEVICE_CS0 ....no such
DEVICE_CS1 ....base f4000000, size  32MB
DEVICE_CS2 ....no such
DEV_BOOCS ....base ff800000, size   8MB
CRYPT_ENG ....base f0000000, size  64KB

  Marvell Development Board (LSP Version 3.0.5_NAS_GDP_p8)-- BUFFALO_BOARD  Soc: 88F5182 A2

 Detected Tclk 166664740 and SysClk 200000000
Marvell USB EHCI Host controller #0: c055b600
Marvell USB EHCI Host controller #1: c055b400
IO Request resource failed - Pci If 0
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
NET: Registered protocol family 2
Time: orion_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 32768K
RTC registered
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Use the XOR engines (acceleration) for enhancing the following functions:
  o RAID 5 Xor calculation
  o kernel memcpy
  o kenrel memzero
  o copy user to/from kernel buffers
Number of XOR engines to use: 2
Use IDMA channels 2 and 3 for enhancing the following function:
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
SGI XFS with ACLs, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
io scheduler noop registered (default)
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 3) is a 16550A
serial8250.0: ttyS2 at MMIO 0xf1012100 (irq = 4) is a 16550A
RAMDISK driver initialized: 3 RAM disks of 32768K size 1024 blocksize
loop: module loaded
Marvell Ethernet Driver 'mv_ethernet':
  o Uncached descriptors in DRAM
  o DRAM SW cache-coherency
  o TCP segmentation offload enabled
  o Checksum offload enabled
  o Rx desc: 128
  o Tx desc: 256
  o Loading network interface ** eth_init_module (0)
'eth0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi 0:0:0:0: Direct-Access     Maxtor   6Y160M0          YAR5 PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] 320173056 512-byte hardware sectors (163929 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 0:0:0:0: [sda] 320173056 512-byte hardware sectors (163929 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
 sda:
sd 0:0:0:0: [sda] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
physmap platform flash device: 01000000 at f0000000
physmap-flash physmap-flash.0: map_probe failed
Found: SST 39LF020
cfi_flash_0: Found 1 x8 devices at 0x0 in 8-bit bank
number of JEDEC chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
mice: PS/2 mouse device common for all mice
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     21 MB/s
raid6: int32x2     28 MB/s
raid6: int32x4     35 MB/s
raid6: int32x8     31 MB/s
raid6: using algorithm int32x4 (35 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :   304.000 MB/sec
   8regs     :   249.200 MB/sec
   32regs    :   270.800 MB/sec
raid5: using function: arm4regs (304.000 MB/sec)
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.0.02 installed.
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
---- in linuxrc ---
Version 1.00 2008/ 7/ 1
grep: /var/tmp/devlink: No such file or directory
Thu Nov  1 00:13:46 JST 2007
CheckDevices
grep: /var/tmp/devlink: No such file or directory
linuxrc:choose operation (timeout 4[s])
 1:RamRoot other:HddRoot  ? -HddRoot-
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk?_1: No such file or directory
mdadm: cannot open /dev/disk?_2: No such file or directory
mdadm: cannot open /dev/disk?_5: No such file or directory
mdadm: No devices listed in conf file were found.
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
Starting :fsck_disks(boot) ...         [Failed. ]
Starting :fsck_disks(rootfs) ...       [Success.]
Starting :mount(boot) ...              EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
[Failed. ]
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk?_1: No such file or directory
mdadm: cannot open /dev/disk?_2: No such file or directory
mdadm: cannot open /dev/disk?_5: No such file or directory
mdadm: No devices listed in conf file were found.
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
/usr/local/lib/libmd: line 262: EXT3-fs: unable to read superblock
/sys/block/md10/EXT2-fs: unable to read superblock
md/maxerr_cnt: No such file or directory
mount: mounting /dev/md1 on /mnt failed: Input/output error
EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
mount: mounting /dev/md1 on /mnt failed: Input/output error
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
mdadm: stopped /md: md10 stopped.
dev/md1
mdadm: stopped /dev/md10
umount: cannot open /proc/mounts
Freeing init memory: 120K
init started: BusyBox v1.7.0 (2007-10-15 19:49:46 IST)
starting pid 457, tty '': '/etc/init.d/rcS'
--- rcStart (initrd) ---
chmod: /home: No such file or directory
grep: /var/tmp/devlink: No such file or directory
Unable to find swap-space signature
swapon: /dev/md10: Invalid argument
create dir : /home
create dir : /var/www
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk?_1: No such file or directory
mdadm: cannot open /dev/disk?_2: No such file or directory
mdadm: cannot open /dev/disk?_5: No such file or directory
mdadm: No devices listed in conf file were found.
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
umount: cannot umount /boot: Invalid argument
mkdir: cannot create directory '/boot': File exists
EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
mount: mounting /dev/md0 on /boot failed: Input/output error
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
md: md10 stopped.
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
configure files from Buffalo parameters.
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk?_1: No such file or directory
mdadm: cannot open /dev/disk?_2: No such file or directory
mdadm: cannot open /dev/disk?_5: No such file or directory
mdadm: No devices listed in conf file were found.
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
mount: mounting /dev/md0 on /boot failed: Input/output error
Restore previous configuration files
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
unzip  fail.
umount: cannot umount /boot: Invalid argument
rootfs on / type rootfs (rw)
/dev/root.old on / type ext2 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/ram1 on /mnt/ram type tmpfs (rw)
  PID  Uid        VSZ Stat Command
    1 root       3364 S   init
    2 root            SW< [kthreadd]
    3 root            SWN [ksoftirqd/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
 md: md0 stopped.
  32 root            SW< [kblockd/0]
   45 root            SW  md: md1 stopped.
[crypto]
   46 md: md10 stopped.
root            SW  [crypto_ret]
   49 root            SW  [pdflush]
   50 root            SW  [pdflush]
   51 root            SW< [kswapd0]
   52 root            SW< [aio/0]
   53 root            SW< [xfslogd/0]
   54 root            SW< [xfsdatad/0]
  242 root            SW< [scsi_eh_0]
  243 root            SW< [scsi_eh_1]
  253 root            SW< [mtdblockd]
  456 root       3364 S   init
  457 root       2392 S   /bin/sh /etc/init.d/rcS
  882 root       2692 R   /bin/sh /etc/init.d/restore_config.sh start
  919 root       3236 R   grep -v atalk
  924 root       3368 R   ps
mdadm: stopped /dev/md0
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
create network files..
IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[]
killall: dhcpcd: no process killed
route: SIOCDELRT: No such process
Configuration network interface: lo eth0
requesting DHCP  tout=30[s]
networking.sh: dhcp requesting...
DontDownIface
alwaysFork
eth reg(9) val=0x0300
eth0: link down
eth0: link up, full duplex, speed 1 Gbps
sendto:  count 6   sync 1
sendto:  count 5   sync 0
sendto:  count 6   sync 0
dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.50 GATEWAY=192.168.2.1
** networking.sh dhcp fin.
configure files from Buffalo parameters.
Starting system logger:
Starting kernel logger:
Starting kernelmon:usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_marvell ehci_marvell.4523: Marvell Orion EHCI
ehci_marvell ehci_marvell.4523: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.4523: irq 17, io base 0xf1050100
ehci_marvell ehci_marvell.4523: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_marvell ehci_marvell.167817: Marvell Orion EHCI
ehci_marvell ehci_marvell.167817: new USB bus registered, assigned bus number 2
ehci_marvell ehci_marvell.167817: irq 12, io base 0xf10a0100
ehci_marvell ehci_marvell.167817: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
KERNELMOn (lanact 0 half)
Starting clientUtil_server:starting on eth0
Starting daemonwatch:daemonwatch Ver.1.01
watch list file : /etc/daemonwatch.list
KERNELMOn (lanact 1000 full)
No need to run drivecheck.sh
/etc/init.d/bootcomplete.sh: line 50: /usr/local/bin/sendmail.sh: No such file or directory
**** request DHCP
starting pid 1331, tty '': '/sbin/getty'

BUFFALO INC. LinkStation series
LS-QL-EM233 login:

ファームウェアアップデータの実行

この間 lsql-107b.exe を実行したときに、 C:\Documents and Settings\yasunari\デスクトップ\lsql-107b に放置された LSUpdater.exe を実行、
LS-QL-EM233 が見つかるので、「ファームウェア更新」を実行する。
「HDD のパーティション情報が確認できませんでした・・」には「はい」
しばらくして、、、
「LS-QL Series のアップデートは完了しました」

セキュリティホールの確認

クラックを試みたが、LS-QL ファームウェア 1.07β に 当該セキュリティホールはない
Internet 上にはセキュリティホールがある旨書かれているページもあるが、 どこかの時点で修正されたのであろう。

'09/5/6 追記
LS-QL ファームウェア 1.07β には セキュリティホールが存在します。

さあ、あとは LS-XHL。こいつだけはシリアルコンソールがない(藁)



LS-QL
バッファローダイレクト
楽天市場
amazon
livedoorデパート
Sofmap
バリューモア
Yahoo!ショッピングトップ
パソQ
ムラウチドットコム


まっさらにする
ハックの記録
LinkStation/玄箱 をハックしよう

まっさらにする

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市