The firmware runs /sbin/check-image 2>&1 > /dev/null on firmware upload, which is basicaly just fwhandle -x /tmp/image_enc.img -y /tmp/image_dec.img -r /tmp/img_decode_result -i "$model_name" -t kernel_pad_fs. fwhandle is a binary which I haven't yet checked in detail.
After if check-image succeeds, it runs /sbin/sysupgrade -F -v /tmp/image_dec.img &
There is also telnet functionality in the firmware, which can be activated with a script. Unfortunately accessing the router via telnet requires a login which I do not know.
enableTelnet.py
#!/bin/python
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
from base64 import b64decode, b64encode
import argparse
import json
import requests
# Replace here with your own
ADMIN_PASSWORD = "TEMPLATE"
ROUTER_IP = "192.168.76.1" # Default is 192.168.76.1
#-----------------------------
parser = argparse.ArgumentParser(
prog = "enableTelnet.py",
description = "Script to enable telnet access on Acer Predator Connect W6x router",
epilog = "Password & IP can be set by editing values of ADMIN_PASSWORD and ROUTER_IP")
if ADMIN_PASSWORD == "TEMPLATE":
parser.add_argument("password", help="The admin password for the webui", type=str)
else:
parser.add_argument("password", nargs='?', help="The admin password for the webui", type=str)
parser.add_argument("IP", nargs='?', help="Router's IP address, leave blank for 192.168.76.1", type=str)
args = parser.parse_args()
if args.password:
ADMIN_PASSWORD = args.password
if args.IP:
ROUTER_IP = args.IP
# ----------------------------
key_X = "L6bb2tAt3oxzCGwkSfsqtzOALHJLJ1MB".encode('utf-8')
iv_X = "hobh264Tk21UfDPM".encode('utf-8')
template_login = f'{{"action":"login_telnet","aesLocalRandomKey":"bkcx1z2uoqrepfrlj3mylqdwmqlz34wp51da1a0e5de3qe1wv39wpg5pn8f6j1h7","loginpwd":"{ADMIN_PASSWORD}","accesstoken":null}}'
template_telnet = '{{"action":"set_telnet_config","enable":true,"accesstoken":"{0}"}}'
template_enDataX = '{{"enDataX":"{0}"}}'
router_url = f"http://{ROUTER_IP}/cgi-bin/web_cgi"
def decode(data, key, iv):
cipher = AES.new(key, AES.MODE_CBC, iv)
data_bytes = b64decode(data)
dec_data = cipher.decrypt(data_bytes)
unpadded_data = unpad(dec_data, AES.block_size)
return unpadded_data.decode('utf-8')
def encode(data, key, iv):
cipher = AES.new(key, AES.MODE_CBC, iv)
pad_data = pad(data.encode('utf-8'), AES.block_size)
enc_data = cipher.encrypt(pad_data)
return b64encode(enc_data).decode('utf-8')
# Login request
login_enDataX = encode(template_login, key_X, iv_X)
login_request_data = template_enDataX.format(login_enDataX)
login_request = requests.post(router_url, data=login_request_data)
if login_request.status_code == 502:
print(f"Login request failed - malformed request")
print(login_request_data)
exit()
elif login_request.status_code != 200:
print(f"Login request failed - {router_url} returned http code {login_request.status_code}")
exit()
login_response_encoded = login_request.text
login_response_json_string = decode(login_response_encoded.strip(), key_X, iv_X)
login_response_json = json.loads(login_response_json_string)
login_request_fail_cause = login_response_json.get('cause')
if login_request_fail_cause:
if login_request_fail_cause == "Already login":
print("Login failed - Already logged in")
print("Wait until auth expires (few minutes)")
else:
print(f"Login failed - cause: {login_request_fail_cause}")
exit()
accesstoken = login_response_json.get('accesstoken')
# Telnet enable request
telnet_enDataX = encode(template_telnet.format(accesstoken), key_X, iv_X)
telnet_request_data = template_enDataX.format(telnet_enDataX)
telnet_request = requests.post(router_url, data=telnet_request_data)
if telnet_request.status_code == 502:
print("Login request failed - malformed request")
exit()
elif telnet_request.status_code == 401:
print("Login request failed - auth somehow failed")
exit()
elif telnet_request.status_code != 200:
print(f"Login request failed - {router_url} returned http code {telnet_request.status_code}")
exit()
telnet_response_encoded = telnet_request.text
telnet_response_json_string = decode(telnet_response_encoded.strip(), key_X, iv_X)
telnet_response_json = json.loads(telnet_response_json_string)
if telnet_response_json.get("result") == 0:
print("Telnet access enabled for current boot")