Acer predator connect W6x

For Developers
218

Hi @ternary, thanks for sharing your progress! I'm trying to follow the same process on the exact same firmware version (W6x_GBL_2.00.000008) Web-ui (W6x_GBL_2.00.000012), but I ran into a few problems when trying to modify the backup.

First, when trying to pack the modified settings back into a tarball using the admin user, I got a permission denied error on the etc/wireless/mediatek/DBDC_card0.dat:

admin@W6x:/tmp/backup$ tar -czf backup_settings_modified.bin etc/ data/

tar: can't open 'etc/wireless/mediatek/DBDC_card0.dat': Permission deniedtar: error exit delayed from previous errors

Because the tar command didn't complete successfully (or missed that specific file), when I proceeded to sign/encode the image using fwhandle, it threw an encoding failure:

admin@W6x:/tmp/backup$ fwhandle -s backup_settings_modified.bin -d backup_settings_finished.bin

error: fwhandle encode fail

Any insights would be highly appreciated!

219

I forgot about that file! I had the same thing. For whatever reason its permissions are all the way off.
chmod 644 etc/wireless/mediatek/DBDC_card0.dat should fix, then tar

220

Great news! please add this method to the wiki when you have the time!

221

Hello, this is great! The root access part can be shortened considerably by abusing samba functionality.

Samba root method
  • get the router up and accessible at 192.168.76.1
  • run enableTelnet.py (add your W6x web interface password to the script)
  • navigate to /#/system/usbStorage
  • change username to root and password to one of your choosing (Password must be changed to a different one)
    • samba does not need to be enabled
  • telnet to the router (192.168.76.1)
  • login as root with the password you set

Verified to work on latest firmware (W6x_GBL_2.00.000008). Gives actual root (uid=0, and not uid=1001 of the default admin account).

For anyone interested: The script in the firmware responsible is /sbin/samba-config.

222

I bought the W6X days ago and without cracking the case or doing serial connections, also flashed the latest OpenWRT Stock without any issues, my W6X came with a very old firmware, i think it was W6x_GLB_1.01.000013?

Used the enableTelnet.py + Samba method and the whole installation was done in less than 5 minutes.

Great job guys! Thanks rethesis and ternary for this method!

223

Just wanted to report a successful flash using a combination of the Samba and Telnet exploits. The whole process took less than 5 minutes, with no hardware modifications or serial cables required.

Here's a quick rundown of the steps I followed:

  • Root via Samba: Changed the network storage username to "root" (and set a password) in the stock web interface, then obtained true root privileges ("uid=0").

  • Telnet access: Triggered a settings backup from the stock web interface to populate the temporary files in "/tmp", ran the "enableTelnet.py" script, and successfully logged in via Telnet as "root".

  • MTD backup: Before modifying anything else, I plugged in a USB drive (mounted at "/mnt/sda1") and backed up all MTD partitions for safety. I intentionally skipped "mtd0" ("spi0.0") since it's just a virtual representation of the entire NAND.

  • Flashing OpenWrt: Used "curl" to download the official OpenWrt stock-layout image directly to "/tmp", then executed "nand_do_upgrade".

The router rebooted cleanly, and everything is working flawlessly

Huge thanks to rethesis, ternary, and everyone else in this thread who helped discover and document this method!