Can't connect with default root login/pass on Kimax BS U25AWF (password invalid)


#1

Hi there,

This is my first post ! And also my first attempt to install OpenWrt...

I decided to install OpenWrt on a Kimax "Network HDD with Wifi". The device page is here: https://openwrt.org/toh/hwdata/blueendless/blueendless_u25awf

I found a .bin image on this page:
https://forum.archive.openwrt.org/viewtopic.php?id=61854&p=3
(the last link, from F5BJR)

I just updated the firmware from the stock admin interface, and gave the .bin file.
After update, the box booted, and showed me a login page with LuCI, but I can't login (invalid username/password). I tried:
root:[blank], root:root, root:password, kimax:kimax, admin:admin, admin:kimax, etc...
I have a ssh prompt working, asking for login and password, but same problem: root with no password doesn't work.

I tried with Chrome, Firefox, MS Edge, Putty and WinSCP.

Any idea on how I could login or install an other firmware ?
The rom seems to have squashfs, but the device doesn't have any serial port.
I suppose that the default password is blank since etc/shadow file shows root::0:0:99999:7:::

Did I brick my device ? lol please help me I'm lost. If the only way is to solder wires on the board or do weird things, I will search for and do it. But before going into this, i'm asking here...

Thanks in advance (and sorry for my weird english :))
Poulpy


#2

Have you tried telnet, user root, without password?
Are you connected with ethernet or wifi? Sometimes authentication without password is not allowed over wifi.


#3

Suppose you've tried the OEM / Last password that was set prior to install ( chance it was found on HDD )

Well this one;
openwrt-ramips-mt7620-u25awf-h1-squashfs-sysupgrade.bin

Has passwd of root:x and shadow of root:: ( empty as Mr trendy mentioned )


#4

With putty, telnet on port 23 give me "connection refused".
I am connected with an ethernet cable.
I am using openwrt-ramips-mt7620-u25awf-squashfs-sysupgrade.bin
With SSH on port 22, root without password give me an "access denied" message :frowning:


#5

Recent OpenWrt versions don't support telnet, you can only use ssh.

If you can't login via ssh (empty password after flashing), try https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset


#6

Thanks you all.

slh, I have seen that tutorial. Do i absolutely need a serial keyboard connected to enter failsafe mode ?
If so, I will do the soldering when I have time...

No other solutions ?


#7

The normal approach as depicted there doesn't involve serial access, just pressing a button at the right time.


#8

Ok I'll give a another try.
From the openwrt guide:
Watch for a boot message on the serial console and press a key (“f”) on the serial keyboard. This requires that you have attached a serial cable to the device. The message shown in the console is “ Press the [f] key and hit [enter] to enter failsafe mode”

But I will try again with different buttons/timings/leds/etc...


#9

@F5BJR maybe has an idea what can be the root password?


#10

Thanks trendy ! I did not know how to contact him !


#11

no password after firstboot ( with serial console )

openwrt web default password is empty


#12

Thank you for the confirmation @F5BJR !

@Romain before going into soldering the serial port, maybe you could try to re-upload the image (or another one)? Usually you need to press the reset button while power is off, keep pressing and power on, then wait until leds start blinking to release the button. Then router will have an http page at default address where you can upload the image.


#13

Hi all,

I did some new test. With wireshark I can see the "Please press button now to enter failsafe...". If I press the power button, it powers off. If I press reset button, or nothing, I got ping from response from 192.168.1.1 for about 10seconds.
During that time, no connection possible with telnet on 192.168.1.1
With SSH, I got a connection refused.

After these 10seconds, it boots normally with Luci asking for password. But I can't login...

It seems I can't trigger the failsafe button.

@trendy I can't manage to boot in the mode you described. It boots normally.

I noticed that once booted, or while booting, if I press briefly the power button, the blue LED (HDD) stays lit, with power LED (Orange). But I got no response with ping/http/ssh.

Have I to try soldering a keyboard ? Like this https://radikal.ru/fp/927590b7755f42d293791342ffe63d96
But I don't know to what wires I should connect these 3 ones (a ps/2 keyboard ? oO)

Also, is there a way with the TFTP firmware upload thing ? I did the tftp command in multiple state of booting, or while the 192.168.1.1 responded to pings, with no success...


#14

That was my plan b :cry:

Bummer. I remember I enabled the tftpd on routers with this sequence back in the days. Looks like it is not used much anymore.

I have managed to connect to serial without soldering. If the pins are thick enough to fit the holes, then you are lucky. Or crocodile cables.
Then you'll need a serial ttl cable (usually has USB on one end and 4-8 cable pins on the other) and some terminal emulator, like Putty, Minicom, SecureCRT.


#15

@trendy, about the TFTP thing, I think the box was not waiting for any file... In what mode should I launch the TFTP command ? after what buttons combo ?


#16

If I am not mistaken, cause it's been ten years since I last did that, I was pressing the reset button, powered on, waited for 15 seconds or so, the LEDs were blinking like Christmas tree, and ping was responding. At that point I released the reset button and pushed the image with TFTP to the router.


#17

I just bought this adapter, I will receive it on monday. I'm too curious about communicating with uart devices :slight_smile:. I will try to pass some pins through the pads without soldering, as you said. Otherwise I got some soldering skills. Pads are small, but I got hardware for such things...
https://www.amazon.fr/gp/product/B07B628LY8/ref=ppx_od_dt_b_asin_title_o00_s00?ie=UTF8&psc=1

From there I'll be able to get hand back on the Kimax firmware, and the other UART stuff I would get in the future. Thanks for all the advices. I will come back later to tell you how it has worked.


#18

TEst with your old password or default for chinese firmware 12345678


#19

@F5BJR, not better with 12345678, so I tried all the collection: 0123456789, 1234567890, 123456789...

I should receive the UART USB adapter today ! :slight_smile:

I will try again with the same image, if its not better, I will (re)do a WRT firmware with the U25AWF patches and all that was used to make your image... I think there is the needed infos in the old forum's posts...

Hey wait a minute, if I have control with SSH, I could make new passwords and accounts :smiley:


#20

Yes there is password recovery procedure when you connect with console.