Lưu ý : Hướng dẫn này chỉ khả dụng cho các thiết bị được sản xuất trước tháng 03/2022 dùng chip flash mã GigaDevice GD25Q127CSIG, những phiên bản trang bị chip flash mã Eon EN25QX128 sẽ không cài được OpenWRT ( xem thêm thông tin tại đây)
Quá trình cài đặt chuyển đổi được khuyến khích sử dụng máy ảo Ubuntu, hướng dẫn này có thể làm trên cả hệ điều hành khác miễn là cài đặt và sử dụng được Python!
Bài viết đang được hoàn thiện!!!
- Tải source code tại GitHub OpenWRTInvasion
- Tải và cài đặt Python
- Mở thư mục OpenWRTInvasion với Terminal.
- Nhập lệnh sau ở Terminal vừa mở lên: pip3 install -r requirements.txt
- Nhập lệnh sau để bắt đầu quá trình: python3 remote_command_execution_vulnerability.py
- Dùng cyberduck để thả firmware vào thư mục /tmp/.
python3 remote_command_execution_vulnerability.py
Router IP address [press enter for using the default 'miwifi.com']: 192.168.31.1
Enter router admin password: 123456789
There two options to provide the files needed for invasion:
1. Use a local TCP file server runing on random port to provide files in local directory `script_tools`.
2. Download needed files from remote github repository. (choose this option only if github is accessable inside router device.)
Which option do you prefer? (default: 1)1
****************
router_ip_address: 192.168.31.1
stok: 97c6d7ee4bc90c9623adb5e26d740b63
file provider: local file server
****************
start uploading config file...
start exec command...
local file server is runing on 0.0.0.0:48353. root='script_tools'
local file server is getting 'busybox-mipsel' for 192.168.31.1.
local file server is getting 'dropbearStaticMipsel.tar.bz2' for 192.168.31.1.
done! Now you can connect to the router using several options: (user: root, password: root)
* telnet 192.168.31.1
* ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa -c 3des-cbc -o UserKnownHostsFile=/dev/null root@192.168.31.1
* ftp: using a program like cyberduck
telnet 192.168.31.1
Trying 192.168.31.1...
Connected to 192.168.31.1.
Escape character is '^]'.
XiaoQiang login: root
Password:
BusyBox v1.19.4 (2020-08-14 12:26:28 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
root@XiaoQiang:~# cd /tmp/
root@XiaoQiang:/tmp# ls
2624.bootcheck.log
TZ
arrays
busybox
daemon
dhcp.leases
dropbear
dropbear.tar.bz2
etc
ftpd
head.bin
hosts
http_info
lock
log
logexec
luci-indexcache
luci-nonce
luci-sessions
messages
miqos.lock
mnt
mt76xx.sh.log
network.env
nginx_check.log
openwrt-22.03.5-ramips-mt76x8-xiaomi_mi-router-4c-squashfs-sysupgrade.bin
oui
rc.done
rc.timing
resolv.conf
resolv.conf.auto
resolv.conf.dummy
root
rr
run
script.sh
speedtest_urls.xml
spool
startscene_crontab.lua.PID
stat_points_privacy.log
stat_points_rom.log
stat_points_web.log
state
sysapihttpd
sysapihttpdconf
sysinfo
syslog-ng.ctl
syslog-ng.pid
taskmonitor
uci2dat_mt7628.log
uploadfiles
upnp.leases
web_config_list
web_filter_list
wifi_analysis.log
root@XiaoQiang:/tmp# mv openwrt-22.03.5-ramips-mt76x8-xiaomi_mi-router-4c-squash
fs-sysupgrade.bin openwrt.bin
root@XiaoQiang:/tmp# ls
2624.bootcheck.log rc.timing
TZ resolv.conf
arrays resolv.conf.auto
busybox resolv.conf.dummy
daemon root
dhcp.leases rr
dropbear run
dropbear.tar.bz2 script.sh
etc speedtest_urls.xml
ftpd spool
head.bin startscene_crontab.lua.PID
hosts stat_points_privacy.log
http_info stat_points_rom.log
lock stat_points_web.log
log state
logexec sysapihttpd
luci-indexcache sysapihttpdconf
luci-nonce sysinfo
luci-sessions syslog-ng.ctl
messages syslog-ng.pid
miqos.lock taskmonitor
mnt uci2dat_mt7628.log
mt76xx.sh.log uploadfiles
network.env upnp.leases
nginx_check.log web_config_list
openwrt.bin web_filter_list
oui wifi_analysis.log
rc.done
root@XiaoQiang:/tmp# ls -la | grep openwrt.bin
-rw-r--r-- 1 root root 6029625 Aug 14 13:43 openwrt.bin
root@XiaoQiang:/tmp# mtd -r write /tmp/openwrt.bin OS1
Unlocking OS1 ...
Writing from /tmp/openwrt.bin to OS1 ...
Rebooting ...
