Adding OpenWrt support for Xiaomi AX6000

For Developers
20

Thanks to all, got SSH access to AX6000 . for password used simplified https://github.com/odedlaz/ax3600-files/blob/master/scripts/calc_passwd.py script, where password need be entered as parameter (will place at end) .

Answers to my questions:

  • Password on second OpenWPN router does not meter
  • Exploit line should be like in instruction.
  • Connection to Xiaomi I used LAN (could be that any)
  • To check second OpenWRT router used: http://169.254.31.1/cgi-bin/luci/api/xqsystem/token
  • AX6000 fw verison - forgot, will report later :slight_smile:
  • Used FireFox

Simplified script:

import sys
import hashlib

# credit goes to zhoujiazhao:
# https://blog.csdn.net/zhoujiazhao/article/details/102578244

salt = {'r1d': 'A2E371B0-B34B-48A5-8C40-A7133F3B5D88',
        'others': 'd44fb0960aa0-a5e6-4a30-250f-6d2df50a'}

def get_salt(sn):
    if "/" not in sn:
        return salt["r1d"]
    return "-".join(reversed(salt["others"].split("-")))

def calc_passwd(sn):
    passwd = sn + get_salt(sn)
    m = hashlib.md5(passwd.encode())
    return m.hexdigest()[:8]

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: python3 {sys.argv[0]} <SN>")
        sys.exit(1)
    sn = sys.argv[1]
    print("Given SN: "+ sn)
    print("Calculated root password: "+calc_passwd(sn))