[Success] Mi Router AC1200 EU (rb02) on firmware 3.0.61

[Amirali-Foroutan]

I’ve followed all the instructions and videos, and even read some forums, but I still couldn’t succeed with the 3.0.61 firmware on my Mi Router AC1200 EU (RB02) it just refuse to start telnet or ssh the ports 22 and 23 are also closed. However, it seems some people have succeeded with the exact same model #192 and #155 someone help me here on how to do it properly?

[Amirali-Foroutan]

Solution: Installing OpenWRT 23.05.2 on Mi Router AC1200 EU (rb02) - Firmware 3.0.61
Note: This device is identical to the Mi Router 4A Gigabit V2. The process involves exploiting a vulnerability using a Windows machine and then accessing the router via Telnet.

Tools and Resources:
Exploit Source: https://github.com/LordPinhead/OpenWRTInvasion

OpenWRT Firmware: http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin

Operating Systems Used:
Windows

Preparation:
Modify the Exploit Script for Windows Compatibility:
Open remote_command_execution_vulnerability.py from the OpenWRTInvasion repository.

Remove the line: sys.exit("Stopping: script can only be run on a Mac/Linux system").

Save the file. This allows the script to run on Windows.

Steps:
Part 1: Turn OFF the Firewall and Antivirus
Run the Exploit on Windows
Open a terminal (e.g., Command Prompt or PowerShell) on your Windows machine.
Navigate to the directory containing remote_command_execution_vulnerability.py.

Execute the following command:
python remote_command_execution_vulnerability.py
This exploits the vulnerability and enables Telnet access on the router.

Part 2: Open Telnet on Windows
Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine.
Type: dism /online /Enable-Feature /FeatureName:TelnetClient
This will let you use Telnet on Windows

Part 3: Access the Router via Telnet
Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine.
Connect to the router using Telnet with the following command:
telnet 192.168.31.1

Log in with the default credentials:
Username: root
Password: root

Part 4: Install OpenWRT Firmware
Once logged in, navigate to the /tmp directory:
cd /tmp

Download the OpenWRT firmware file:
wget http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin -O firmware.bin

Verify the integrity of the downloaded file (optional but recommended):
./busybox sha256sum firmware.bin

Flash the firmware to the router:
mtd -e OS1 -r write firmware.bin OS1
This erases the existing OS1 partition, writes the new firmware, and reboots the router.

[Neustradamus]

@acecilia: Have you seen?

[SteffenR87]

For me it unfortunaly does'nt work. Same firmware and Model, Tried with Windows11 + Dokker and by removing mac line with python. Any ideas?

[Amirali-Foroutan]

For me it unfortunaly does'nt work. Same firmware and Model, Tried with Windows11 + Dokker and by removing mac line with python. Any ideas?

Can you tell me what Operating system did you use exactly and how?
what i understanded was that you own a mac, and then you ran a windows 11 on it via virtual environments and tried to use the exploit. true?

[SteffenR87]

I have been using Windows 11 physically on machine, no VM. Antivirus and Firewall turned off. I tried docker and also python on win11 directly. Script worked, logged into router but wasn't able to open telnet.

[SteffenR87]

Today I tried with Linux. Same issue. I am not able to upload file. Any ideas? I bought several devices with intention of upgrading to openwrt

[RandomTutorialPh]

I have been using Windows 11 physically on machine, no VM. Antivirus and Firewall turned off. I tried docker and also python on win11 directly. Script worked, logged into router but wasn't able to open telnet.

Same, when login to telnet it refuse

[kshmohamad2-max]

oh my god. hey man you are my hero. i tested even with uart and ch341. but not work. and i read this post and WORKED!!! thanks man

[kshmohamad2-max]

Solution: Installing OpenWRT 23.05.2 on Mi Router AC1200 EU (rb02) - Firmware 3.0.61 Note: This device is identical to the Mi Router 4A Gigabit V2. The process involves exploiting a vulnerability using a Windows machine and then accessing the router via Telnet.

Tools and Resources: Exploit Source: https://github.com/LordPinhead/OpenWRTInvasion

OpenWRT Firmware: http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin

Operating Systems Used: Windows

Preparation: Modify the Exploit Script for Windows Compatibility: Open remote_command_execution_vulnerability.py from the OpenWRTInvasion repository.

Remove the line: sys.exit("Stopping: script can only be run on a Mac/Linux system").

Save the file. This allows the script to run on Windows.

Steps: Part 1: Turn OFF the Firewall and Antivirus Run the Exploit on Windows Open a terminal (e.g., Command Prompt or PowerShell) on your Windows machine. Navigate to the directory containing remote_command_execution_vulnerability.py.

Execute the following command: python remote_command_execution_vulnerability.py This exploits the vulnerability and enables Telnet access on the router.

Part 2: Open Telnet on Windows Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine. Type: dism /online /Enable-Feature /FeatureName:TelnetClient This will let you use Telnet on Windows

Part 3: Access the Router via Telnet Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine. Connect to the router using Telnet with the following command: telnet 192.168.31.1

Log in with the default credentials: Username: root Password: root

Part 4: Install OpenWRT Firmware Once logged in, navigate to the /tmp directory: cd /tmp

Download the OpenWRT firmware file: wget http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin -O firmware.bin

Verify the integrity of the downloaded file (optional but recommended): ./busybox sha256sum firmware.bin

Flash the firmware to the router: mtd -e OS1 -r write firmware.bin OS1 This erases the existing OS1 partition, writes the new firmware, and reboots the router.

امیر علی دمت گرم مرد

[Amirali-Foroutan]

Solution: Installing OpenWRT 23.05.2 on Mi Router AC1200 EU (rb02) - Firmware 3.0.61 Note: This device is identical to the Mi Router 4A Gigabit V2. The process involves exploiting a vulnerability using a Windows machine and then accessing the router via Telnet.
Tools and Resources: Exploit Source: https://github.com/LordPinhead/OpenWRTInvasion
OpenWRT Firmware: http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin
Operating Systems Used: Windows
Preparation: Modify the Exploit Script for Windows Compatibility: Open remote_command_execution_vulnerability.py from the OpenWRTInvasion repository.
Remove the line: sys.exit("Stopping: script can only be run on a Mac/Linux system").
Save the file. This allows the script to run on Windows.
Steps: Part 1: Turn OFF the Firewall and Antivirus Run the Exploit on Windows Open a terminal (e.g., Command Prompt or PowerShell) on your Windows machine. Navigate to the directory containing remote_command_execution_vulnerability.py.
Execute the following command: python remote_command_execution_vulnerability.py This exploits the vulnerability and enables Telnet access on the router.
Part 2: Open Telnet on Windows Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine. Type: dism /online /Enable-Feature /FeatureName:TelnetClient This will let you use Telnet on Windows
Part 3: Access the Router via Telnet Open a terminal (e.g., Command Prompt or PowerShell) as an administrator on your Windows machine. Connect to the router using Telnet with the following command: telnet 192.168.31.1
Log in with the default credentials: Username: root Password: root
Part 4: Install OpenWRT Firmware Once logged in, navigate to the /tmp directory: cd /tmp
Download the OpenWRT firmware file: wget http://downloads.openwrt.org/releases/23.05.2/targets/ramips/mt7621/openwrt-23.05.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-v2-squashfs-sysupgrade.bin -O firmware.bin
Verify the integrity of the downloaded file (optional but recommended): ./busybox sha256sum firmware.bin
Flash the firmware to the router: mtd -e OS1 -r write firmware.bin OS1 This erases the existing OS1 partition, writes the new firmware, and reboots the router.

امیر علی دمت گرم مرد

من نوکرتم

[Amirali-Foroutan]

I have been using Windows 11 physically on machine, no VM. Antivirus and Firewall turned off. I tried docker and also python on win11 directly. Script worked, logged into router but wasn't able to open telnet.

I tried with a new mi4a with the same spec.
it worked after the third time.
i guess it takes some tries to open the Telnet connection.

[Amirali-Foroutan]

I have been using Windows 11 physically on machine, no VM. Antivirus and Firewall turned off. I tried docker and also python on win11 directly. Script worked, logged into router but wasn't able to open telnet.

Same, when login to telnet it refuse

@SteffenR87 @RandomTutorialPh
Same to you brother, try a couple of times then it will open the access.
i will still answer the questions.
if you did not made it.
make a comment here so that we connect and i help you.
DM me on Telegram or something with id Amirali_F9