Shell access to your ix2/ix4 exposed! “Get yer red hot ssh here!”

January 8th, 2010
by Christopher Kusek (PKGuild)

So, I promised you guys in Iomega ix4-200d data reconstruction, ssh and more! that I would expose the password to login to the ix2 and ix4 as soon as I could.    Well, your wait is finally over!

Let’s start as you normally would, by logging into the support console!

http://192.168.1.1/support.html

Click on Support Files

Whoa, what’s that I highlighted there and even tossed in an arrow?! Can I MAKE it any more straight forward? Psst.. Click on Support Files :)

Click on the Dump button

Ooh, what’s that little guy down there? Dump? Yea, I didn’t even notice this before (because I had shell access myself ;)) but this is for your benefit!

The system will go through "Gathering system state…"

Open up your dump file!

Why yes, I did go mad with clicking colors and arrows in the win7 version of MSPaint.. Okay, but I digress. :)

Click that bad boy, which will include dump data about your system! Download it, and open it!

Drill down into the dump –> config –> etc –> and open up the file named “shadow”   (dump-20100107225620.tar.gz\dump-20100107225620\config\etc)

Wait, what?! Is that an exposed hash with the root password from your shadow?!

Find your shadow File in there, and lo and behold, you will have your Iomega root users hash!    Now it’s just a matter of cracking it!

It is beyond the scope of this article to tell you how to actually crack the pwd.. (giggle) go here, download john the ripper and you’ll do just fine :)

Password CRACKED in seconds! user:root pwd:soho

Taking my seed from my system and running it through a simple alphanumeric search, I come up with username root, password soho! That was easy! That works if you have NO Password set!

Through a collaborative effort with @randyjcress @Kiwi_Si @VirtualisedReal and @gabvirtualworld we were able to determine that by using soho and whatever password you use on the system, that should do it! And really, the credit does primarily go to @randyjcress for leading us in that specific direction so props randy! :)

ie: admin pwd is apples, so login using sohoapples – This is still undergoing verification, but I thought I’d share it out there, while we sort it out!

Disclaimer: The means to perform all of these tasks has been replicated and verified in the wild without requiring any intimate knowledge of the inner workings of the system. 

Tags: , , , , , , , , ,
Posted in Iomega, NAS, Storage | Comments (160)

← Older Comments
Newer Comments →
  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • jfr

    I meant the *green* arrow

  • Reefven1

    hola a todos, una pregunta, puedo cambiar la web de la interface? personalizarla? con el logo?

  • Lorak

    Did not work on Software Version: 2.1.30.10908

  • Stefan

    works here with soho+admin-password (used version 2.1.38.22294)

    Thanks a lot :)

  • Lorak

    Update – This method does work! Thanks Christopher for the original info and Stefan for making me think ;-)

    For Newbee’s 2 Linux U need 2 use an SSH client like PuTTY to get to the # prompt – using the web interface to the device is not a valid way to check you have the right root level password “incase” you ever need it for an SHH session as I was doing – not sure what I was thinking about, I suspect I just wasn’t :-(

  • http://twitter.com/vStewed Vaughn Stewart

    Chris – this is excellent. Now any tips on disabling CIFS? I’m an NFS/AFP/FTP household.

  • Ml

    work on ix4-100 too, but to do what ?

  • http://pkguild.com Christopher Kusek

    I can definitely dive in to that – But why in particular do you want to disable CIFS?

    With that in mind… let me know and then I can drill down into actually disabling it! :)

  • http://pkguild.com Christopher Kusek

    Very useful for shell like operations! or even changing file permissions, a lot of us do that..

  • http://pkguild.com Christopher Kusek

    Glad you found this useful!

  • http://pkguild.com Christopher Kusek

    I’m still working on some manually handling Torrent process.. I haven’t published anything on it yet as I haven’t found anything good to publish on doing it yet :)

  • Russ Green

    genious…that work on my IX2 (2.0.15.43099)….any chance of a tutorial to install Squeezebox server onto the ix2?

  • Mallesite

    Great tutorial!

    Just a though… Lets say that I mess around with some WOL settings etc. and I somehow makes the system go down… Will I be able to reset the system to default configuration?
    I know theres a reset button on the back of the ix2-200, but if I mess with the Linux OS manually then I am not sure if the default “installation” is saved somewhere safe to save the system for people like us ;-) ?

    Anybody?

  • Dldl

    awesome

    Now, we are allmighty. What fine stuff to do?
    Anybody made a cross-build environment to port wget, ncftp, torrent, emule, what-the-hell?

  • Arvils

    Does not seem to work on ix2-200, firmware 192.168.0.189

  • http://pkguild.com Christopher Kusek

    You may want to go through iterations of this, because I’ve heard of people not doing it right the first time, and once they realize what they’re doing wrong it works just fine :)

  • Pepijn Gabriel

    Chris, brilliant cracking. Can you give any hints on how to enable oplocks on the ix2-200? I wish to use offline files (windows7), iomega tells me that’s not possible. Perhaps you know better.

  • http://www.facebook.com/joakim.laine Joakim Laine

    Thanks guys! It works amazingly stunningly. I had a big problem, there were some directories that were empty but couldnt be deleted by mac os x for whatever reason. But with straight shell access to my ix2-200 i could clean up the files I wanted without formatting the whole NAS and starting all over with almost 2TB of data! (sigh).

    BTW does anybody know if/how the ix2-200 can be upgraded to cloud edition?? Iomega support told me that its not possible.. it must be only software on the NAS..

  • http://pkguild.com Christopher Kusek

    Let me see if I can find the product manager for the IX4 and for the Cloud version and see if that’s something which can be done (either on the roadmap or a hack.. :))

  • Hedy Dargere

    I have also a ix2-200 with the lastest firmware (3.0.9.37355)
    But on my device, the address http://my-ix2-address/support.html doesn’t exist.

    Is the procedure changed and if yes, how can I activate the SSH access ?

  • http://pkguild.com Christopher Kusek

    You may want to check again, or try fully populating your IP address a few times; lets just say… I’ve not seen it NOT work yet.

    What IP are you trying to use?

  • Hedy Dargere

    I just found one other guy who have the same problem around the 12 april 2011 : http://ix2-200.wikidot.com/forum/t-272682/ssh-restrictions

  • Hedy Dargere

    I’m using my ix2-200 on http://192.168.0.250
    It’s working well : for the moment, I’m using it for stoarage with nfs access.

    There is one thing which disapointed myself : the manager interface is not the same as you in my device.
    Have a look :
    - when I go to http://192.168.0.250 I have this : http://img.spheerys.fr/images/nothing.png
    - when I go to http://192.168.0.250/manage.html I have this : http://img.spheerys.fr/images/manage.png
    - when I go to http://192.168.0.250/support.html I have this : http://img.spheerys.fr/images/support.png

    It’s look like the last firmware change the interface and the procedure to activate the ssh access.

  • Hedy Dargere

    I found the solution on the Iomega Forum support : for the “Cloud Edition”, the new address is http://my-ix2-ip/diagnostics.html

  • Buck

    I am definitely interested in trying to upgrade my “old school” ix2-200 to the new cloud edition as well. Please do keep us posted!

  • Kcantrel

    Okay, now I have done with I wanted to with ‘ssh’ access, how do you turn it off?  I have an IX-200 Cloud Edition and I’ve gone back to the support.html file, well, actually, it is diagnostics.html for the cloud version, unselected the check mark next to “allow remote access for support” and clicked Apply.  Unfortunately, the check mark reappears and as expected, ssh access remains.  Do I have to reboot this thing to get it to stick?

  • http://pkguild.com Christopher Kusek

    In a word.   Yes, yes you have to reboot it for the SSH access to turn off.
     

  • _rico_

    Hi Buck, did you find a way to upgrade to cloud edition?

  • _rico_

    Hi Chris, great work here, love my ssh on the ix2-200. Did you find a way to upgrade from a non cloud ed to cloud?, I have two ix2-200 units and I would love to use the cloud edition …

  • Guest

    you lose the warranty like this

  • Dave

    Hello, 
    I have a ix2-200 , and how can upgrade it to Cloud Edition.
    thanks 
    Dave

  • Guest

    I’ve heard that you CAN upgrade the ix2 to CLOUD EDITION… HOW???

  • footswitch

    Hi there,

    This wiki page contains a set of instructions in order to recover the NAND or replace the internal HDDs:

    http://iomega.nas-central.org/wiki/Category:Ix2-200-usb-init

    This would not only allow us to swap the HDDs in the ix2-200 to larger ones, but also upgrade (?) to the cloud edition.

    I do NOT know if any of this works as advertised.

    I have little knowledge of SSH and *nix and so forth. If
    someone with proper know-how is willing to give it a try… pretty
    please :)

    If you need to perform some test in one of the devices and you don’t have it…

    —- I have both ix2-200 (1 year-old model and the new Cloud Edition). —-

    So I’m more than willing to help with what I can.

    P.S.: I did try a basic and probably stupid thing:

    1. Remove the drives from the older model;

    2. Place just one drive from the Cloud Edition into the older model.

    I imagined at first that it would boot as if it were the Cloud Edition,
    but it doesn’t. It seems like there’s a part of the OS that’s stored in
    the HDDs and another part (or firmware) stored in the board…?

  • Joachim

    Just a stupid question. Why don’t you use the first icon? Support access, and then check the ‘Enable support access via ssh…’? Afterwards, you can ssh with root & password soho-pwd…

  • Yozz

    I have the ix2-200 edition and wanted cloud as well. I’ve made it working, however not by a hack. I bought the transmit app http://www.panic.com/transmit/ (mac only) and have set that setup over ssh connecting to my ix-200. 2 minutes work and all can by accessed as a local drive. No read/write issues or other tech issues. Just plug and play.

  • Scpcom

    I updated my USB Init page on NAS Central. Now also people who have only Non-Cloud Edition can update to Cloud Edition (on new drives). Only the original firmware file for cloud edition is required

  • Remy Blank

    I understand this procedure enables the SSH server on the ix2, that is, sshd. Is the ssh client also installed? That is, if I’m logged into an ix2, can I ssh to another machine? Is Python installed, too?

  • Magneto

    FYI:
    Procedure works fine on a StorCenter px6-300d.

    - enable ssh via http://nas/diagnostics.html
    - use the described method to login as root

  • Hometeck20001

    hi i have the iomega ix100 and tride to akses the thidden web page of iomega storcenter and ther is aproblem with the certiffecut and clikt the link and got 404 file not found can you help my emaile is hometeck20001@hotmail.com

  • http://www.facebook.com/joakim.laine Joakim Laine

    Has anybody tried with http://iomega.nas-central.org/wiki/Category:Ix2-200-usb-init using the cloud edition firmware downloaded from iomega support site into non cloud ix2-200 if it works?? will it erase the drives or keep old data?? This would also add os x lion compatibility. I’d test it but dont have extra drives to try with.

← Older Comments
Newer Comments →

  • Archives

Google