Help with gen2 backdoor

I’ve found out that the gen2 has a backdoor. The file system_init looks for a file called mfg_WDMyCloud on the mounted USB drives. If the file is executable. It then looks for a file called fun_plug. If that file is executable it then does a touch /tmp/mfg_mode. Near the end of
system_init it checks to see if mfg_mode exists and is executable. If it is executable a program called mfg_start is started. mfg_start checks the mfg_WDMyCloud file for the strings WDMyCloud and sn00py if they do it executes the fun_plug script.
The problem is that when it does a touch of the mfg_mode file it is not created executable. I can’t find the where the mfg_mode is made executable. This would be the perfect way to run a script on reboot. No need to modify image.cfs Less chance of bricking the device.

RAC

PS you can test this by creating these two files. Make then executable. My files
File mfg_WDMyCloud contains two lines
mfg_MyCloud
sn00py
File fun_plug contains one line
echo fun_plug works
Below is the output of running mfg_start

mfg_start

mfg_start version 1.01

Tue Sep 27 17:54:15 2016
root@WDMyCloud Public #
filename_mfg [mfg_WDMyCloud]
count of USB volume= 1
mfg_start check [ 1 ]
mnt pnt [/mnt/USB/USB1_b1]
usb_dir [/mnt/USB/USB1_b1]
check /mnt/USB/USB1_b1/mfg_WDMyCloud file
check /mnt/USB/USB1_b1/fun_plug
sh /mnt/USB/USB1_b1/fun_plug /mnt/USB/USB1_b1/
fun_plug works
mfg_start done

Hi,

I haven’t try this yet. Let’s see if any of the users can share some information about it.

Problem is until we can figure how to get the file marked as executable. The backdoor does not work.

RAC

you do know that you can touch a file that already exists? thus create a mfg_mode file that is executable…

you are welcome…

Btw, how are you doing with the search for that slow ticking scan?

no comment

I’m done. I’m returning the gen2 My Cloud. Too much trouble. Can’t get any thing to work. The gen2 is working as it is designed. I just have too much trouble trying to get any programs to work.
The gen2 is missing fdisk,strace, gparted, unsquashfs, squashfs and most other programs. Tried to bring missing programs from a standard Debian system. But the programs won’t run. Different types of errors. Suspect the problem is missing libraries. I tried multiple methods to mount the image.cfs file wiht no luck. I also tried to rebuild the image.cfs but squashfs would get different errors depending on which OS I tried to run the program. I guess I’m just not smart enough to get things working. With the gen1 I have been able to build those programs that I needed to debug things on the system. Even though the gen1 uses 64k pages. You can compile a program and move it over to the gen1 and it runs. I’ll stick to my gen1 My Clouds.

RAC

you mean your two week return time is up…

This new Cloud should have been a keeper, something you can experiment with abandonment but you are giving up.

It is unfortunate that the young doesn’t have patience these days…

Oh well… I guess I’m on my own again…

Actually I have a 30 day return policy. Which leaves me with 14 more days. As for the young not having patience. I’m most likely old enough to be your father. But it does appear that you are on your own.

RAC

then that just makes you a cranky old man with no patience :stuck_out_tongue:

so if I do find something, like a fix for that incessant ticking, you are not allowed to contradict my findings nor are you allowed to point out what you are surmising since in fact you will be surmising.

I was hoping you might convert the gen2 drive to full debian, after all they did it with gen1

but since you and I don’t have any more cloud commonalities, it is goodbye for now…

I’ve found a similar program in the latest (1.08) firmware on the DLINK DNS 320L. It appears to check for a file mfg_DNS_320L and I can see sn00py in the code so I’ll have a play next week and see if I can find anything.

UPDATE - I’ve not had a lot of time over the last year on this, I got chance to play again over christmas and so far had tried various places for the mfg_DNS_320L file but nothign yet.

On the DLINK DNS-323 it looks for a file called fun_plug on the first disk. Just google fun_plug dlink
You will get all the information that you need to get it orking.