小米路由器3a刷入openWRT

1
dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

1
部署映像服务和管理工具
2
版本: 10.0.26100.1150
3

4
映像版本: 10.0.26100.4652
5

6
启用一个或多个功能
7
[==========================100.0%==========================]
8
操作成功完成。

1
Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -NoRestart

1
Path          :
2
Online        : True
3
RestartNeeded : False

1
wsl --install

1
正在下载: Ubuntu
2
正在安装: Ubuntu
3
已成功安装分发。可以通过 “wsl.exe -d Ubuntu” 启动它
4
正在启动 Ubuntu...
5
Provisioning the new WSL instance Ubuntu
6
This might take a while...
7
Create a default Unix user account: xi
8
New password:
9
Retype new password:
10
passwd: password updated successfully
11
To run a command as administrator (user "root"), use "sudo <command>".
12
See "man sudo_root" for details.
13

14
xi@SKYCHOW:/mnt/c/Users/33960$

1
sudo chmod +x setup_openwrt_invasion.sh

1
cd OpenWRTInvasion-0.0.10

1
nano script.sh

1
download_file_from_github() {
2
    # Rationale for using --insecure: https://github.com/acecilia/OpenWRTInvasion/issues/31#issuecomment-690755250
3
    curl -L "https://gitee.com/juserzhang/OpenWRTInvasion/tree/master/script_tools$1" --insecure --output "$2"
4
}

1
python3 remote_command_execution_vulnerability.py

1
Router IP address [press enter for using the default 'miwifi.com']: 192.168.31.1
2
Enter router admin password: 12345678

1
There two options to provide the files needed for invasion:
2
   1. Use a local TCP file server runing on random port to provide files in local directory `script_tools`.
3
   2. Download needed files from remote github repository. (choose this option only if github is accessable inside router device.)
4
Which option do you prefer? (default: 1)

1
****************
2
router_ip_address: 192.168.31.1
3
stok: a80675f22f75d3281445ea2c2638f97e
4
file provider: remote github repository
5
****************
6
start uploading config file...
7
start exec command...
8
done! Now you can connect to the router using several options: (user: root, password: root)
9
* telnet 192.168.31.1
10
* ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc -o UserKnownHostsFile=/dev/null root@192.168.31.1
11
* ftp: using a program like cyberduck

1
cat /proc/mtd

1
dd if=/dev/mtd4 of=/tmp/eeprom.bin
2
dd if=/dev/mtd1 of=/tmp/Bootloader.bin

1
mtd write breed.bin Bootloader