Hello, I want to start this off by saying that I am very unexperienced when it comes to cracking into devices and flashing custom firmware so I am looking for some advice. I have managed to get uboot access and full linux command line access on an Aerohive AP250, with help from the internet, these APs firmware are vulnerable in multiple ways and the bootloader password has been known for some time, here is the article I used.
Here is the output of cat /proc/cpuinfo:
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 1990.65
Features : swp half thumb fastmult edsp tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0
processor : 1
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 1990.65
Features : swp half thumb fastmult edsp tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0
Hardware : BCM94708
Revision : 0000
Serial : 0000000000000000
I'm not sure if this platform has been worked on yet, I know it is not in the supported platforms.
and the output of cat /proc/meminfo:
MemTotal: 510852 kB
MemFree: 306452 kB
Buffers: 14144 kB
Cached: 69752 kB
SwapCached: 0 kB
Active: 84396 kB
Inactive: 49928 kB
Active(anon): 51452 kB
Inactive(anon): 6376 kB
Active(file): 32944 kB
Inactive(file): 43552 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 50428 kB
Mapped: 24368 kB
Shmem: 7400 kB
Slab: 22108 kB
SReclaimable: 3008 kB
SUnreclaim: 19100 kB
KernelStack: 2376 kB
PageTables: 1696 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 255424 kB
Committed_AS: 1668696 kB
VmallocTotal: 499712 kB
VmallocUsed: 62396 kB
VmallocChunk: 210944 kB
512 Mb of RAM!
And it uses broadcom ethernet:
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 10.10.80.505_e5.1.2.3 (r659762)
register snif device on interface eth1.
eth1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 10.10.80.505_e5.1.2.3 (r659762)
This does exist in the platforms list so it has somewhat confused me. The platform would be the CPU correct?
here is a df just for S&Gs:
Filesystem Size Used Available Use% Mounted on
/dev/root 29.3M 29.3M 0 100% /
devtmpfs 234.7M 0 234.7M 0% /dev
tmpfs 170.7M 4.7M 166.0M 3% /tmp
ubi0:f 344.6M 87.9M 252.0M 26% /f
My big question is how hard would it be to get this device working with OpenWrt? The reason I am trying to go this route is because they are unconfigurable from the web interface and Extreme (who bought Aerohive), their cloud management is horrible, even thought they do offer a free version. I have four of these access points and a few more (4 or 5) Aerohive AP150Ws which are similar that I could probably exploit and get access to. If it is not possible for someone who is inexperienced that is okay, I understand and will leave it at that, although I would love to learn the ins and outs even if it takes time and effort.