Support for Xiaomi Router AC1200 (RB02)

Ajudaste · September 12, 2023, 12:57pm

Exploit scripts for the V2 of the Router with Firmware 2.30.20

acecilia:master ← LordPinhead:master

opened 10:20PM - 30 Oct 22 UTC

Setup I used is router IP 192.168.31.1, computer IP 192.168.31.2, Password for t…he webinterface is 12345678, these are the default values. The exploit is based on [vanyasem](https://github.com/vanyasem) (https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775) findings and his comment in issue 141. Start remote_command_execution_vulnerability_v2.py with python3, this will ask for the router ip, the local ip and the webinterface password (default values are set), then it will pack a payload like before, a bootstrapper and it will be injected into the set_config_iotdev url. Basically, remote code execution. It needs the dropbear and busybox executable plus the script. Because it was so different, I made a new python script and a new bash script. Now, with root access, the router is also open for OpenWRT.

ghost · September 14, 2023, 9:40am

hello and thank you for helping me .
python files deleted and i can't find all files like "remote_command_execution_vulnerability_v2.py" and is not link to them .I don't understand how actually these files install on my router .

Ajudaste · September 14, 2023, 9:54am

Hello, ftp is activated by the scripts which are available on github, see the scrip link mentioned

github.com

acecilia/OpenWRTInvasion/blob/df37117e7f5e6424e32bedaf2213419b081a0240/remote_command_execution_vulnerability.py

#!/usr/bin/python
'''
There is a remote command execution vulnerability in Xiaomi Mi WiFi R3G V2 with version 2.30.20 and up we can
use to activate Telnet and SSH to flash our own system on them.

The script creates a payload, which is served via a local HTTP server, port 8000. The router
will download the payload, extracts it and executes the already known script.

The busybox executable was removed from the firmware, so we have to include one, same with
dropbear for SSH. They will be in the payload, no other downloads necessary.

Source: https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775

HOW TO RUN
Install requirements
pip3 install -r requirements.txt
Run the script
python3 remote_command_execution_vulnerability.py
'''

This file has been truncated. show original

ghost · September 14, 2023, 12:35pm

I do everything with your help here is screenshot . where is my fault ?

idk · September 26, 2023, 1:11pm

Where can I download the correct openwrt version for this device?

Does anyone know how to get OEM ROM?

Mr.TaiKe · November 6, 2023, 10:22am

Hi, Cbayle,
Did you ever try Openwrt v23.05 with Luci? It doesn't appear to work for me, even it claims that it supports R4AGv2 now if I don't misunderstood.

I also built the v23.05 image with Luci. I flashed both snapshot or image with Luci (that I built). The router kept booting back into the BREED web(192.168.1.1), what specifics you did so it works for you? Thank you!

Mr.TaiKe · November 8, 2023, 3:01pm

I fixed the problem with infinite bootloop to 192.168.1.1. I will post HOW2FIX, Please refer readme on https://github.com/MrTaiKe/Action_OpenWrt_Xiaomi_R4AGv2

By the way, My xiaomi R4AGv2 has Gigadevice flash chip, instead of EON chip

panois · January 31, 2024, 5:09pm

Hi,

Is this firmware working?
https://firmware-selector.openwrt.org/?version=23.05.2&target=ramips%2Fmt7621&id=xiaomi_mi-router-4a-gigabit-v2

maemohim · February 8, 2024, 9:05pm

i used this frameware to debrick my router, but i got purple light. any suggestion?

artefactom · March 27, 2024, 8:43pm

I’ve just find out MIR 4A v2 is not flashable. Do we have any intel about this one? It’s sold 700+
Can we tell if it’s v2 and if it can be flashed with openWrt? Thanks!

EDIT: Came back here to confirm it can be flashed. I used this video
OpenWrt on Xiaomi MIR 4AV2