Mercku M6a Shell

For Developers
1

Heya.

i recently got my hands on a Mercku M6a which i have noticed runs a vendor-specific verion of OpenWRT (LEDE 17)

I was hoping one of the big brains in the community might be able to point me in the direction of getting Shell access as someone has already managed to do it but did not share as seen

I have messaged him but have no idea if he is still access

I know the device is running some flavor of OpenWRT as when looking into the config i can find a link to an openwrt page provided in the backup file

In the end all i want is to install Netdata so i can monitor the router as my old router ( runs OpenWRT) is not fast enough to route 1gbps over PPPoE

2

A little disclaimer I am not responsible if your brick or damage your router in any way.

To get shell access is fairly simple the process involves opening up the router browser and logging in
Once logged in change the url to make sure that the 192.168.127.1 is the address of your router if not use your routers address.
http://192.168.127.1/web/setting/super
set your root password
then go to
http://192.168.127.1/web/advance/telnet
and enable telnet

Once that is done you should be able to telnet to the router on the standard telnet port

bonus:
if you want to access luci by default and access the mercku ui via port 8080 edit
/etc/config/uhttpd

config uhttpd 'main'
        list listen_http '0.0.0.0:8080'
        list listen_http '[::]:8080'
        list alias '/firmware_upload=/web'
        list alias '/file_upload=/web'
        list alias '/v4/app=/web'
        list alias '/app=/web'
        option redirect_https '1'
        option home '/web'
        option error_page '/index.html'
        option rfc1918_filter '1'
        option max_requests '1'
        option max_connections '100'
        option cert '/etc/uhttpd.crt'
        option key '/etc/uhttpd.key'
        option lua_prefix '/web'
        option lua_handler '/usr/lib/lua/mercku/main.lua'
        option script_timeout '60'
        option network_timeout '30'
        option http_keepalive '20'
        option tcp_keepalive '1'
        option ubus_prefix '/ubus'
config uhttpd 'other'
        option listen_http '0.0.0.0:80'
        option home '/www'
config cert 'px5g'
        option days '730'
        option bits '1024'
        option country 'ZZ'
        option state 'Somewhere'
        option location 'Uknown'
        option commonname 'OpenWrt'

If you want ssh access you have to update your package lists and then install the dropbear package.

I cannot find any firmware that appears to be built for any devices based on this hardware so if you find packages that work let me know please.

Two people have not had luck with this though :neutral_face:

3

Wow, that was actually really easy...

Thank you for the info i managed to get into the telnet shell and enable the familiar LUCI web interface

it looks like there is problems updating the package list with Opkg update and my plans of installing netdata will probably not work as it is not in the package list for LEDE17.01

Downloading https://openwrt.wtfast.com/opkg/mipsel_24kc/Packages.gz
wget: SSL support not available, please install one of the libustream-ssl-* libraries as well as the ca-bundle and ca-certificates packages.
*** Failed to download the package list from https://openwrt.wtfast.com/opkg/mipsel_24kc/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/targets/ramips/mt7621/packages/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/targets/ramips/mt7621/packages/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/base/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/base/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/luci/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/luci/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/mercku/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/mercku/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/packages/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/packages/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/routing/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/routing/Packages.gz

Downloading http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/telephony/Packages.gz
*** Failed to download the package list from http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/telephony/Packages.gz

Collected errors:
 * opkg_download: Failed to download https://openwrt.wtfast.com/opkg/mipsel_24kc/Packages.gz, wget returned 1.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/targets/ramips/mt7621/packages/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/base/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/luci/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/mercku/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/packages/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/routing/Packages.gz, wget returned 8.
 * opkg_download: Failed to download http://downloads.lede-project.org/releases/17.01-SNAPSHOT/packages/mipsel_24kc/telephony/Packages.gz, wget returned 8.
root@Mercku:~#
4

image
image1110×681 21.3 KB

Managed to get it installed manually XD
image
image1916×763 78.9 KB

5

I was one of the people who didn't had luck with this, because I had provider blocked firmware, not original from Mercku. (With one note, I had just M6, not M6a, but steps was similar)
Setting password on http://192.168.127.1/web/setting/super was not working for me, it was failing with error.

I had another chance trying to do it, and I succeeded.
So firstly I was needed to update firmware to original from Mercku
Here is guide how to do it on M6 Guide on mercku.zendesk.com
Only TFTP was working, through web page it was saying that file is incorrect.

After changing it to Mercku firmware I had little bit different UI on web page, but enabling telnet was actually working this time :grin:

6

Ive actually just taken a look at Mercku's website and seen that there is a new firmware.

I haven't been using the router as some firmware bugs prevented me from port forwarding and some weird problem that would not let Disney Dreamlight Valley connect to any of its servers in PPPoE mode

Will test in a few

7

On M6 there is even older version of OpenWRT. So any suggestions about how to get packages for it, would be great.
I remember using entware packages some time ago, but not sure if that will work here.
Just unlocked shell access
foo

Here is some data about Mercku M6

root@Mercku:/# uname -a
Linux Mercku 4.4.60 #179 SMP PREEMPT Wed Feb 23 18:17:50 CST 2022 armv7l GNU/Linux

root@Mercku:/# cat /etc/openwrt_release 
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='Chaos Calmer'
DISTRIB_REVISION='b12c7549a324+r49254'
DISTRIB_CODENAME='chaos_calmer'
DISTRIB_TARGET='ipq/ipq60xx'
DISTRIB_DESCRIPTION='OpenWrt Chaos Calmer 15.05.1'
DISTRIB_TAINTS='no-all busybox override'

root@Mercku:/# mount
mtd:ubi_rootfs on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup on /sys/fs/cgroup type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,cpu,cpuacct,blkio,memory,devices,freezer,net_cls,pids)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/ubi0_3 on /overlay type ubifs (rw,noatime)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
/dev/mtdblock20 on /lib/firmware/IPQ6018/WIFI_FW type squashfs (ro,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)

root@Mercku:/# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 51.84
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 1
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 51.84
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 2
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 51.84
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 3
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 51.84
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

Hardware        : Qualcomm Technologies, Inc IPQ6000
Revision        : 0000
Serial          : 0000000000000000

root@Mercku:/# cat /proc/meminfo 
MemTotal:         394048 kB
MemFree:          113084 kB
MemAvailable:     153336 kB
Buffers:           11368 kB
Cached:            33372 kB
SwapCached:            0 kB
Active:            35172 kB
Inactive:          23116 kB
Active(anon):      13736 kB
Inactive(anon):      780 kB
Active(file):      21436 kB
Inactive(file):    22336 kB
Unevictable:           0 kB
Mlocked:               0 kB
HighTotal:             0 kB
HighFree:              0 kB
LowTotal:         394048 kB
LowFree:          113084 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 4 kB
Writeback:             0 kB
AnonPages:         13564 kB
Mapped:            11324 kB
Shmem:               968 kB
Slab:             139820 kB
SReclaimable:       6496 kB
SUnreclaim:       133324 kB
KernelStack:        1544 kB
PageTables:          776 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      197024 kB
Committed_AS:      22432 kB
VmallocTotal:    1572864 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB
CmaTotal:              0 kB
CmaFree:               0 kB

root@Mercku:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00180000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00380000 00020000 "0:QSEE"
mtd5: 00380000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:RPM"
mtd9: 00080000 00020000 "0:RPM_1"
mtd10: 00080000 00020000 "0:CDT"
mtd11: 00080000 00020000 "0:CDT_1"
mtd12: 00080000 00020000 "0:APPSBLENV"
mtd13: 00180000 00020000 "0:APPSBL"
mtd14: 00180000 00020000 "0:APPSBL_1"
mtd15: 00080000 00020000 "0:ART"
mtd16: 03580000 00020000 "rootfs"
mtd17: 03580000 00020000 "rootfs_1"
mtd18: 00080000 00020000 "0:ETHPHYFW"
mtd19: 00458aa4 0001f000 "kernel"
mtd20: 001ac800 0001f000 "wifi_fw"
mtd21: 018d3000 0001f000 "ubi_rootfs"
mtd22: 00ded000 0001f000 "rootfs_data"
8

Nioce now all you need is to reconfigure the webserver to open up the LUCI interface

Follow here for instructions on enabling that

As for the packages I had to do trial and error installing them manually through the Software page in LUCI

I did some digging into the archived packages to find the specific ones needed using the errors from the opkg update errors as a starting point

For netdata here are the ones I used

http://downloads.openwrt.org/releases/19.07.0/packages/mipsel_24kc/packages/netdata_1.30.1-2_mipsel_24kc.ipk
http://downloads.openwrt.org/releases/18.06.1/packages/mipsel_24kc/packages/netdata_1.12.2-1_mipsel_24kc.ipk
http://downloads.openwrt.org/releases/17.01.7/packages/mipsel_24kc/base/libmnl_1.0.4-1_mipsel_24kc.ipk

Make sure to use HTTP, the last time I tried this the router failed to use HTTPS links

Again I must stress we are not responsible for any damage to the router such as bricking

Soft bricks can be fixed by factory resetting the router which also removes custom packages

9

Got LUCI working :slight_smile:

I'm not sure what packages to use, from brief search it seems ipq60xx is not properly supported by openwrt.
DISTRIB_TARGET='ipq/ipq60xx'

By default it is trying to download from the next path:

Downloading http://downloads.openwrt.org/chaos_calmer/15.05.1/ipq/ipq60xx/packages/base/Packages.gz.

But I'm not seeing that even in archive.openwrt.org. Any ideas?

10

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

This is a typical vendor firmware, which has very little in common with actual OpenWrt. ipq60xx has never been supported by OpenWrt (and certainly not in 2015, the whole SOC didn't even exist back then, nor did 802.11ax), accordingly there are no packages provided for it (that would be up to the original vendor - or not…).

As far as OpenWrt is concerned, ipq60xx support is still in development (to become qualcommax/ipq60xx) - moving, but moving very slowly. A lot of development work and mainlining of kernel patches will have to be finished first, before it becomes feasible to merge - expect months++ (double digit number thereof). Any help furthering this is probably welcome, but there is nothing that would answer your questions above.

11

Thank you for detailed response.

As I figured out, it is possible to install some packages from Entware to my device to /opt

mkdir /opt
cd /opt
wget http://bin.entware.net/armv7sf-k3.2/installer/generic.sh
sh generic.sh

Just for test, I installed htop and looks like it works.
But the problem is total amount of available storage is around 10Mb, which is low :frowning: