It's mentoined already in this topic how to obtain the supervisor password.
Most important thing is to use the backup config ability to gain access. You don't even need the supervisor password for that, just the pass that's used for then encryption of that config.
The password used for this encryption i found in the serial console but i dont remember if it was from booting on odido software or maybe from stock initramfs kernel. Anyways here's the following
sysCmd = openssl enc -e -des3 -md md5 -pass pass: root password code: (unique per device) in /tmp/zcfg_config.json -out /tmp/zcfg_config.encrypt, zcmdEncryptConfig 532
EDIT: Apparently its unique per device and stored in u-boot env as "supervisor" variable.
Therefore you use the following command to decrypt the backup.
openssl enc -d -des3 -md md5 -pass pass:*** -in Backup_Restore -out Backup_Restore.json
After changing whats necessary you encrypt it back and restore the config with following command.
openssl enc -e -des3 -md md5 -pass pass:*** -in Backup_Restore.json -out Backup_Restore
What to change in this backup?
First of all look for the account supervisor and account root
Copy the shadow of account supervisor and replace the shadow of account root.
This will replace the root password to the supervisor password, which you can find in the message i quoted so /etc/zydefault/sysconfig.tar.gz.
:Uo1=8mR~`f.t?;MVsfk&e;u!L|;'4
After this you can login to the supervisor account, the root account is only for SSH but you can still not login there. To be able to login you also have to change the following in the decrypted config :
I'm not on my PC but on my phone, so i can not access the files, but there was something about
SPTrustDomain
Either replacd the IP statting with 10.1.?
With 192.168.1.0 and subnetmask 24 or add anoth entry like that one with ip
192.168.1.0
And subnetmask
24
After that look for the following line : LAN_ONLY
I think you will see an entry with HTTP indicsting you only have access to HTTP through LAN.
Copy the parameters of this entry and replace it with the paramaters of SSH,FTP etc... they are found below it.
Then encrypt the backup back and upload it.
If i didnt miss any step. You can now login ssh root@192.168.1.1 with the supervisor pasword.
Use passwd root , passwd supervisor commands to change the passwords
Enjoy. And probably Odido will patch this asap now.
So with the root shell i dont even think you need serial console to be able to switch to OpenWRT
