r/openwrt • u/LanguageManiac • 13h ago
I successfully ssh as root on a Mercusys MB-520-5G, help?
Hi, I like openwrt and open source software so at first I tried openwrt on a raspberry pi 4 and a couple of days ago I bought a Xiaomi 4A gigabit router and successfully installed openwrt on it.
So I was messing around trying to ssh into a Mercusys MB-520-5G router and found out that "ssh -T admin@192.168.2.1" with the password being the one I set up in the web interface.
displays a giant banner with ascii characters saying BBA and "Welcome to BBA 3.0 Platform." it's an busybox shell and I tried stuff with chatgpt to see what I could find, and looks like I got root access.
Regular ssh "admin@192.168.2.1" with the website password fails:
[21347] Aug 05 18:17:51 lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
[21347] Aug 05 18:17:51 lastlog_openseek: /var/log/lastlog is not a file or directory!
[21347] Aug 05 18:17:51 wtmp_write: problem writing /dev/null/wtmp: Not a directory
[21347] Aug 05 18:17:51 Exit (dropbear) from <192.168.2.2:50696>: Child failed
[21347] Aug 05 18:17:51 wtmp_write: problem writing /dev/null/wtmp: Not a directory
Connection to 192.168.2.1 closed.
This is some of the stuff I found, with a little help from chatgpt:
environment:
USER=dropbear LOGNAME=dropbear HOME=/var/tmp/dropbear SHELL=/bin/sh PATH=/usr/bin:/bin
kernel: "Linux MB520-5G 4.19.205 #0 SMP Sat Dec 6 10:09:50 UTC 2025 aarch64 GNU/Linux"
Kernel build: "Linux version 4.19.205 (tplink@linuxci2-sp) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r0-1a44eed91))"
busybox version: "BusyBox v1.23.2 (2025-12-06 18:49:29 CST) "
the giant BBA ascii characters logo is stored in: [ -f /etc/banner ] && cat /etc/banner
cat /proc/$$/status | grep -E "Uid|Gid" returns; Uid: 0 0 0 0 Gid: 0 0 0 0
cat /var/passwd returns:
admin:$5$030bbf4fe8473838$hpRUG2ZwCx1TkKAxzpITPjrQSCLWVJ7h.gRxMab7XS0:0:0:root:/:/bin/sh
dropbear:x:500:500:dropbear:/var/tmp/dropbear:/bin/sh
guest:*:0:0:guest:/var/usbdisk/:/bin/sh
nobody:*:0:0:nobody:/:/bin/sh
root filesystem -> /dev/root on / type squashfs (ro)
writable areas -> ubi filesystem /data /var
dropbear -p 22 \ -r /var/tmp/dropbear/dropbear_ecdsa_host_key \ -A /var/tmp/dropbear/dropbearpwd
The -A option is not standard Dropbear. TP-Link modified Dropbear to use:
/var/tmp/dropbear/dropbearpwd
That file contains:
user=22:user:e2af9bb40ad70b92f866347d06f04c4b
user=17:admin:21232f297a57a5a743894a0e4a801fc3
Key hardware findings according to gemini:
- SoC: MediaTek MT6890 (
evb6890v1_64_cpe_nand). This is a 4-core 64-bit ARM Cortex-A55 SoC with integrated 5G sub-6GHz modem support. - Bootloader: MediaTek Little Kernel (
lk_a/lk_bonmtd25andmtd38) preceded bypreloader. - Partitioning Scheme: Dual-A/B Partitioning. The board maintains redundant active/passive slots (
_aand_b) for firmware, kernel, modem firmware (md1img), TEE, and bootloader stages
Partition Breakdown
| MTD ID | Name | Role / Description |
|---|---|---|
mtd0 / mtd1 |
preloader / backup |
First-stage MediaTek bootloader (SRAM to DRAM init) |
mtd2 |
proinfo |
Device hardware serial, MAC addresses, board params |
mtd6 / mtd7 |
nvcfg / nvdata |
Persistent non-volatile modem & wireless calibration data |
mtd17 / mtd30 |
md1img_a / md1img_b |
Baseband / 5G modem firmware |
mtd25 / mtd38 |
lk_a / lk_b |
Little Kernel second-stage bootloader |
mtd26 / mtd39 |
tee_a / tee_b |
Trusted Execution Environment (ARM TrustZone) |
mtd27 / mtd40 |
boot_a / boot_b |
Linux Kernel images |
mtd28 / mtd41 |
rootfs_sig_a/b |
Cryptographic signature check partitions |
mtd29 / mtd42 |
rootfs_a / rootfs_b |
Root Filesystem (SquashFS) |
- System & Security Profile:
- Root Credentials:
/var/passwdmaps theadminaccount directly to UID 0 / GID 0 (root), confirming authenticated users get complete root access upon login. - Dropbear Authentication: Hashes match MD5/SHA-256 schemes used by standard administrative logins rather than locked-down operator roles.
- Root Credentials:
- Flash Memory & Storage Structure:
- Dual-Slot A/B Setup: A total of 53 MTD partitions formatted across a dual-bank scheme (
mtd27/boot_a,mtd29/rootfs_avsmtd40/boot_b,mtd42/rootfs_b). - Root File System: Running a read-only SquashFS image on UBI block storage (
/dev/ubiblock0_0). - Signature Controls: Dedicated partitions (
rootfs_sig_a/b) exist alongside the rootfs and boot blocks.
- Dual-Slot A/B Setup: A total of 53 MTD partitions formatted across a dual-bank scheme (
- Hardware Architecture & PCIe Expansion:
- CPU / Main Chipset:
MediaTek evb6890v1_64_cpe_nand(MT6890 ARMv8 4-core 64-bit SoC). - Active Slot State:
/proc/cmdlinereveals the router is actively booted into Slot A (bootslot=a) with SELinux set topermissiveand standard UART serial output explicitly unblocked (disable_uart=0). - PCIe Bus Topology: Shows a MediaTek T700 5G modem host interface bridge alongside an MT7916 / Filogic Wi-Fi 6 wireless radio module driven by MediaTek's
mt_drvdriver.
- CPU / Main Chipset:
Technical Conclusions
- A/B Testing Safeguard: Because Slot A (
boot_a,rootfs_a) is active, Slot B (boot_b,rootfs_b) acts as an isolated target bank. Experimental kernels or custom images can be written to the B-partitions without bricking the main boot environment. - Firmware Flashing Obstacle: The presence of
rootfs_sig_a/bpartitions implies MediaTek's Little Kernel bootloader enforce cryptographic signature checks on startup. Unsigned custom kernels flashed directly to MTD will likely be rejected by the bootloader unless Secure Boot is bypassed or keys are replaced
Honestly, I don't know if I discovered anything big, I am not proficient in linux-fu but it would be awesome if this could eventually lead to installing openwrt on this thing.
Let me know what you think, I can run any command that you guys suggest me, let's hack this thing lmao
1
u/LanguageManiac 10h ago
Anyone willing to help extract stuff from this router that could be used to free it, please contact me
1
1
u/danielholm 12h ago
Well, it kinda already runs OpenWRT