Step 1: Obtain the Stok variable
- Open the Chrome browser.
- Log in to the router's management page, usually at
http://192.168.31.1/. - Find the value of the Stok variable in the browser's address bar. This value will be used for the SSH unlock commands later.
For example:
http://192.168.31.1/cgi-bin/luci/;stok=030b24d39b1a4a549aa12dac23c52313/web/home#router
Then Stok=030b24d39b1a4a549aa12dac23c52313
Note: every time the router restarts, the stok value will change.
Step 2: Unlock SSH
- Open Command Prompt (cmd), and enter the following commands in order. Replace
tokenwith the actual Stok value obtained in step 1:
curl -X POST http://192.168.31.1/cgi-bin/luci/;stok=token/api/misystem/arn_switch -d "open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A"
Step 3: Obtain the SSH password
- Visit https://miwifi.dev/ssh
- Enter your router's serial number (SN). The serial number can be found on the back of the router, or viewed through the router's management interface.
- The system will display the SSH password.
Step 4: Soft-persist SSH
After connecting to the router's ssh via MobaXterm, execute the following commands (after execution, the ssh password will automatically be changed to admin):
After the router restarts, the dropbear file will revert to its original unmodified state, so you need to add an autostart script. Each time the router starts, it will automatically execute the script to modify the dropbear file and enable ssh. There are two methods for this step: one is to obtain the script online, and the other is to create the script manually offline. Just choose one.
Online method
Offline method
At this point you have entered the vi editor. First copy the script content below to the clipboard:
After copying, return to the vi editing screen, press i to enter edit mode, then press CTRL+SHIFT+V to paste. After pasting, press ESC, then type :wq and press Enter. Note that it must be in English:
After confirming there are no issues, execute the following commands:
Step 5: Hard-persist SSH
After connecting to the router's ssh via MobaXterm, execute the following commands (the router will restart automatically after execution):
After waiting for the router to restart, reconnect to ssh and execute the following commands (the router will restart automatically after execution):
After waiting for the router to restart, reconnect to ssh and execute the following commands (the router will restart automatically after execution):
After waiting for the router to restart, reconnect to ssh. Persistence is now complete.
Notes
After each firmware upgrade or firmware reset, you need to use telnet first, and then enable ssh from within telnet.
The specific method is:
- Use MobaXterm to connect to the router via telnet. The username is
root, and the password is the initial password. After entering them, you can log in to the router's telnet backend. - Enable ssh via telnet, and change the root password to admin:
Use MobaXterm to connect to the router via ssh. The username is
root, and the password isadmin. After entering them, you can log in to the router's ssh backend. After logging in, repeat step 4 for soft persistence.Custom password:
2. 通过 telnet 开启 ssh,并修改 root 密码为 admin:
sh
sed -i '/flgssh=`nvram get sshen/{:loop; N; /\n.*channel=/sbin/uci get /usr/share/xiao /xiao _version.version.CHANNEL`\n.return 0\n.fi/!b loop; d}' /etc/init.d/dropbear
/etc/init.d/dropbear restart
echo -e 'admin\nadmin' | passwd root
sh echo -e '你的密码\n你的密码' | passwd root