Hello, I want to start this off by saying that I am very unexperienced when it comes to cracking into devices and flashing custom firmware so I am looking for some advice. I have managed to get uboot access and full linux command line access on an Aerohive AP250, with help from the internet, these APs firmware are vulnerable in multiple ways and the bootloader password has been known for some time, here is the article I used.
Here is the output of cat /proc/cpuinfo:
processor : 0 model name : ARMv7 Processor rev 0 (v7l) BogoMIPS : 1990.65 Features : swp half thumb fastmult edsp tls CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x3 CPU part : 0xc09 CPU revision : 0 processor : 1 model name : ARMv7 Processor rev 0 (v7l) BogoMIPS : 1990.65 Features : swp half thumb fastmult edsp tls CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x3 CPU part : 0xc09 CPU revision : 0 Hardware : BCM94708 Revision : 0000 Serial : 0000000000000000
I'm not sure if this platform has been worked on yet, I know it is not in the supported platforms.
and the output of cat /proc/meminfo:
MemTotal: 510852 kB MemFree: 306452 kB Buffers: 14144 kB Cached: 69752 kB SwapCached: 0 kB Active: 84396 kB Inactive: 49928 kB Active(anon): 51452 kB Inactive(anon): 6376 kB Active(file): 32944 kB Inactive(file): 43552 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 50428 kB Mapped: 24368 kB Shmem: 7400 kB Slab: 22108 kB SReclaimable: 3008 kB SUnreclaim: 19100 kB KernelStack: 2376 kB PageTables: 1696 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 255424 kB Committed_AS: 1668696 kB VmallocTotal: 499712 kB VmallocUsed: 62396 kB VmallocChunk: 210944 kB
512 Mb of RAM!
And it uses broadcom ethernet:
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 10.10.80.505_e22.214.171.124 (r659762) register snif device on interface eth1. eth1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 10.10.80.505_e126.96.36.199 (r659762)
This does exist in the platforms list so it has somewhat confused me. The platform would be the CPU correct?
here is a df just for S&Gs:
Filesystem Size Used Available Use% Mounted on /dev/root 29.3M 29.3M 0 100% / devtmpfs 234.7M 0 234.7M 0% /dev tmpfs 170.7M 4.7M 166.0M 3% /tmp ubi0:f 344.6M 87.9M 252.0M 26% /f
My big question is how hard would it be to get this device working with OpenWrt? The reason I am trying to go this route is because they are unconfigurable from the web interface and Extreme (who bought Aerohive), their cloud management is horrible, even thought they do offer a free version. I have four of these access points and a few more (4 or 5) Aerohive AP150Ws which are similar that I could probably exploit and get access to. If it is not possible for someone who is inexperienced that is okay, I understand and will leave it at that, although I would love to learn the ins and outs even if it takes time and effort.