My brother owns a TerraMaster F5-420 which is a nice little device considering its price value. Unfortunately his actions led to an unwanted situation.He exposed the web GUI out to the world and in came a surprise: xmrig
Oddly enough this was supposed to be fixed on version 3.0.34 as stated here. We were running version 3.1.03! Upon a bit more further analysis, the file “/usr/www/include/ajax/GetTest.php” in fact didn’t exist, suggesting another *.php file had a similar vulnerability? I didn’t get into a deeper analysis of how this all occurred as he wanted his NAS to go back online ASAP.
Why? Isn’t TOS Good Enough?
Among many things, TOS isn’t secure especially if security vulnerabilities of low level complexions exist. Honestly, it just can’t be trusted. It also lacks a lot of aesthetics and overall poor quality in a user experience perspective. Additionally this presented us with the opportunity to get rid of TOS.
What You’ll Need
- Windows Server 2012 R2 .iso
- USB Drive
- Big enough for ISO to fit in
- Can be USB 3.0
- 2.5″ SDD/HDD
- 15+7 Pin SATA Serial ATA Male to Female Power Cable, 20″
- Picked ours up from a Central Computers
- SKU: CAB-GCST304R
- Double-sided tape
Installing Windows Server 2012 R2
- Burn Windows Server 2012 R2 iso onto your USB drive
- I will not be going over how to burn an iso onto a USB drive as there are many tutorials already out there.
- Plug the USB drive onto the back of the NAS, use the 3.0 port if applicable.
- I don’t recall the need to change anything in the BIOS, although I had been going through it out of my curiosity. The hotkey to boot into the BIOS is the Delete key. Boot menu or to override the prioritization is located in the Save & Exit menu in the BIOS.
- Boot into Windows Server 2012 R2 Installation environment and install it like you would with any other Windows installation.
- We ditched Windows Server 2012 for Xpenology. Seems like Windows kept maxing out the CPU for long periods of time creating a lot of heat and ultimately forcing the system to halt.