Hacking the SamKnows Whitebox
The SamKnows Whitebox is a free router (TP-Link TL-WDR3600) provided by SamKnows to gather internet speed statistics. Ok that's great, but any person with a small amount of hacker's spirit will want to hack it to install some custom firmware to take advantage of the two gigantic antennas on the back, the USB ports and everything else.
Step 1 : Debug mode
Root access can be obtained via a "debug mode" on the router giving you a direct root shell via telnet, amazingly simple.
- Disconnect the Whitebox from the internet.
- Connect your computer directly to the Whitebox via Ethernet to one of the four ethernet ports on the Whitebox.
- Configure your computer's IP settings to "Manual" setting the computer's IP address to
192.168.1.2, the Subnet Mask to
255.255.255.0and the Gateway to
- Turn off the Whitebox.
- Turn on the Whitebox.
- Wait for all the lights to come on and turn off once, then spam the "WPS / Reset" button on the back of the Whitebox.
- Continue spamming until the second LED from the left flashes continuosly. You are now in "debug mode".
Step 2 : Changing the root password
Ok, so now you have a root shell on the Whitebox via telnet, wasn't that hard. Now connect to the Whitebox with a telnet client (Putty on Windows, Terminal on linux) :
$ telnet 192.168.1.1 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. === IMPORTANT ============================ Use 'passwd' to set your login password this will disable telnet and enable SSH ------------------------------------------ BusyBox v1.19.4 (2012-11-21 13:26:44 GMT) built-in shell (ash) Enter 'help' for a list of built-in commands. _ ___ __ _ _ __ ___ | | ___ __ _____ _____ / __|/ _` | '_ ` _ \| |/ / '_ \ / _ \ \ /\ / / __| \__ \ (_| | | | | | | <| | | | (_) \ V V /\__ \ |___/\__,_|_| |_| |_|_|\_\_| |_|\___/ \_/\_/ |___/ P E R F O R M A N C E M O N I T O R I N G OS: OpenWRT Attitude Adjustment, r35093 SW: WDR3600 Build ------------------------------------------------- root@(none):/#
There you have it, a root busybox shell. Next up... mounting the filesystem :
root@(none):/# mount_root switching to jffs2
Now we can perform modifications to the system, for example we could change the... root user's password maybe (They gave us the hint when connecting via telnet)
root@(none):/# passwd Changing password for root New password: Bad password: too short Retype password: Password for root changed by root
I set the password to "root", hence the "Bad password" warning.
Step 3 : SSH inside
Telnet is a pile of shit, a move to SSH is recommended.
Now if you restart the box (don't bother trying
reboot it doesn't do much, just pull the plug), plug the Whitebox back in to your router then you should be able to access the device via SSH on port 2222 (once you've found the DHCP assigned IP address, check your router's web interface to see if you can get a list of all connected devices, or try an IP scan on the local network)
$ ssh email@example.com -p 2222 firstname.lastname@example.org's password: BusyBox v1.19.4 (2012-11-21 13:26:44 GMT) built-in shell (ash) Enter 'help' for a list of built-in commands. _ ___ __ _ _ __ ___ | | ___ __ _____ _____ / __|/ _` | '_ ` _ \| |/ / '_ \ / _ \ \ /\ / / __| \__ \ (_| | | | | | | <| | | | (_) \ V V /\__ \ |___/\__,_|_| |_| |_|_|\_\_| |_|\___/ \_/\_/ |___/ P E R F O R M A N C E M O N I T O R I N G OS: OpenWRT Attitude Adjustment, r35093 SW: WDR3600 Build root@OpenWrt:~#
Step 4 : Explore
Now you're inside, you can explore around, find your device's "Unit ID" to spoof metrics :
root@OpenWrt:/tmp/samknows# cat /tmp/samknows/unitid 123456
You can also modify it to pretend you're someone else (Warning : the "unitid" goes back to default on reboot) with a quick
You can also find out how everything works (such as sending results and all the different test) and disable reporting by exploring
root@OpenWrt:~# cat /tmp/ispmon/cron/crontab 40 * * * * /tmp/ispmon/bin/dcsclient https://dcs-uk.samknows.com:443 -v >/dev/null 2>&1 45 * * * * /tmp/ispmon/scripts/pcscript >/dev/null 2>&1 25 * * * * /tmp/ispmon/scripts/sanity.sh >/dev/null 2>&1 26 * * * * /tmp/ispmon/scripts/submit.sh >/dev/null 2>&1 30 * * * * /tmp/ispmon/scripts/timesync.sh >/dev/null 2>&1 35 6 * * * /usr/sbin/udhcpcrestart.sh >/dev/null 2>&1 38 22 * * * /tmp/ispmon/scripts/background_tests.sh restart >/dev/null 2>&1
This shows which scripts are called by the system and how often. The same output can be obtained via
Cronjob execution can be disabled for the current session with
And if you want to disable stuff permanently, take a look at
/overlay (A good explanation is available here)
Step 4.2 : Backup
Thanks to @nonflammable for this, if you ever feel like coming back to the original Samknow's firmware then you can do the following, if not ignore the step.
Do a quick system backup :
dd if=/dev/mtdblock5 of=/tmp/sysbackup.bin
Copy the file
/tmp/sysbackup.bin to a relatively safe place on your PC with something like WinSCP or Filezilla.
Whenever you need to restore the backup you can use the following command :
mtd -r write /tmp/sysbackup.bin firmware
Or you can also use DD-WRTs web GUI to upload and flash
sysbackup.bin without the 1337 command line.
Step 5 : Flash
The great thing about this little Whitebox is that we can install pratically anything on it, I've chosen to install DD-WRT. To start off you need to find the correct firmware for the Whitebox and download it to your computer.
Pop over to the DD-WRT Router Database, type
TL-WDR3600 and download the
Put the file on a web server on your computer to make it accessible from the Whitebox so the router can access http://192.168.1.2/factory-to-ddwrt.bin
- Now go back to step 1 and access the Whitebox via telnet.
- Execute the
- Move to the
mtd -r write /tmp/factory-to-ddwrt.bin firmware
You should now have the following output, it can take a few moments, don't panic :
root@(none):/tmp# mtd -r write /tmp/factory-to-ddwrt.bin firmware Unlocking firmware ... Writing from /tmp/factory-to-ddwrt.bin to firmware ... Rebooting ...
Step 6 : Enjoy
Now the telnet session should die and your Whitebox should reboot, I'll call it the Blackbox now because it's turned to the dark side.
Now by visiting http://192.168.1.1/ in your browser you will be greeted with your brand-spanking-new version of DD-WRT. I'm not going to cover setting everything up, that's your problem now. Have fun with your Blackbox !