Its Lennys Fault :: Lenny Urbanowski

The Netgear Stora is a simple NAS system that allows anyone, even with no tech knowledge, to set up a simple network attached home RAID system. I plugged it in, slapped in a second hard drive, pushed the power button, and copied over my files. It was completely up and running within a few minutes. The Netgear Stora provided me an easy hot-swappable RAID system, but I wanted much more. I knew it was a fully functional, stand-alone, low-power linux server. The obvious next step was to root it.

Gaining root access on the Netgear Stora is amazingly easy. The first thing you need to do is get your product key. There is one located on the bottom of the device and one on the cd that came with it. Mine (for whatever reason) didn’t match. For me the one on the Netgear Stora install CD was the correct one to use. This may not always be the case so try both.

Here is a picture where to find both (I edited out my product id and replaced it with X’s)

NetGear Stora bottom

NetGear Stora CD

Gaining Root Access

Now that you have your Stora product id all you need to do is login via SSH using any user you have setup on your stora that has administrator access (in the web interface). However, if you just use the user name as is you won’t be allowed access. Instead you have to add “_hipserv2_netgear_XXXX-XXXX-XXXX-XXXX” after the user name (replace the X’s with your actual product key). For my example I will use my name Lenny as the user name and all X’s for the product key. Any user with the administrator access flagged in the Netgear Stora web panel will have the ability to use the sudo command to gain root access.

Here is the process

NetGear Stora root

Why  it works

From what I can tell this is just a lame attempt by the developers to keep the general public form being able to shell into the device while still allowing themselves to get in for debugging / testing. It looks like the distribution of linux packaged with the Netgear Stora is shipped with a custom SSH server that appends a string including the product keys to the authorized user list.