TP-LINK新固件SSH密码几乎无解

Luochancy

洛手头上有一台R473G V3，想折腾一下
查了下N3发现SSH密码通过MAC就可以算
然后算半天密码不对
然后就想着去解更新包看看
一看不知道，TP-LINK更新了SSH密码计算方式



固件来源：TP-LINK
解包工具：https://zhiwanyuzhou.com/
文件位置：/etc/init.d/dropbear



这是原来的：

1. #!/bin/sh /etc/rc.common
   
2. # Copyright (C) 2006-2010 OpenWrt.org
   
3. # Copyright (C) 2006 Carlos Sobrinho
   
4. 
   
5. START=50
   
6. STOP=50
   
7. 
   
8. SERVICE_USE_PID=1
   
9. 
   
10. NAME=dropbear
    
11. PROG=/usr/sbin/dropbear
    
12. PIDCOUNT=0
    
13. EXTRA_COMMANDS="killclients"
    
14. EXTRA_HELP="        killclients Kill ${NAME} processes except servers and yourself"
    
15. 
    
16. getNewPasswd()
    
17. {
    
18.         . /lib/functions.sh
    
19.         local macAddr=""
    
20.         macAddr=$(ubus call tddpServer getInfo '{"infoMask":1,"sep":"-"}' | sed 's/-//g' | jsonfilter -e '@.mac')
    
21.         echo "macAddr from tddp config is $macAddr" > /dev/console
    
22. 
    
23.         local key=$(echo -n "$macAddr" | md5sum)
    
24.         key=$(echo ${key:0:16})
    
25.         #echo "key is $key" > /dev/console
    
26. 
    
27.         echo ${key}
    
28. }
    
29. 
    
30. setNewPasswd()
    
31. {
    
32.         local newPasswd=`getNewPasswd`
    
33.         #echo "newPasswd is $newPasswd" > /dev/console
    
34.         (echo "$newPasswd";sleep 1;echo "$newPasswd") | passwd > /dev/null
    
35. }
    
36. 
    
37. setDefaultPasswd()
    
38. {
    
39.         cp /rom/etc/passwd /etc/passwd &> /dev/null
    
40. }
    
41. 
    
42. dropbear_start()
    
43. {
    
44.         append_ports()
    
45.         {
    
46.                 local ifname="$1"
    
47.                 local port="$2"
    
48. 
    
49.                 grep -qs "^ *$ifname:" /proc/net/dev || {
    
50.                         append args "-p $port"
    
51.                         return
    
52.                 }
    
53. 
    
54.                 for addr in $(
    
55.                         ifconfig "$ifname" | sed -ne '
    
56.                                 /addr: *fe[89ab][0-9a-f]:/d
    
57.                                 s/.* addr: *\([0-9a-f:\.]*\).*/\1/p
    
58.                         '
    
59.                 ); do
    
60.                         append args "-p $addr:$port"
    
61.                 done
    
62.         }
    
63. 
    
64. 
    
65.         local section="$1"
    
66. 
    
67.         # Customized kill switch
    
68.         config_get_bool ssh_port_switch "${section}" ssh_port_switch 0
    
69.         echo "ssh_port_switch is $ssh_port_switch" > /dev/console
    
70.         if [ "$ssh_port_switch" != "1" ]; then
    
71.                 echo "set default passwd" > /dev/console
    
72.                 setDefaultPasswd
    
73.                 return 0
    
74.         fi
    
75. 
    
76.         # check if section is enabled (default)
    
77.         local enabled
    
78.         config_get_bool enabled "${section}" enable 1
    
79.         [ "${enabled}" -eq 0 ] && return 1
    
80. 
    
81.         setNewPasswd
    
82. 
    
83.         # verbose parameter
    
84.         local verbosed
    
85.         config_get_bool verbosed "${section}" verbose 0
    
86. 
    
87.         # increase pid file count to handle multiple instances correctly
    
88.         PIDCOUNT="$(( ${PIDCOUNT} + 1))"
    
89. 
    
90.         # prepare parameters (initialise with pid file)
    
91.         local pid_file="/var/run/${NAME}.${PIDCOUNT}.pid"
    
92.         local args="-P $pid_file"
    
93.         local val
    
94.         # A) password authentication
    
95.         config_get_bool val "${section}" PasswordAuth 1
    
96.         [ "${val}" -eq 0 ] && append args "-s"
    
97.         # B) listen interface and port
    
98.         local port
    
99.         local interface
    
100.         config_get interface "${section}" Interface
     
101.         config_get interface "${interface}" ifname "$interface"
     
102.         config_get port "${section}" Port 22
     
103.         append_ports "$interface" "$port"
     
104.         # C) banner file
     
105.         config_get val "${section}" BannerFile
     
106.         [ -f "${val}" ] && append args "-b ${val}"
     
107.         # D) gatewayports
     
108.         config_get_bool val "${section}" GatewayPorts 0
     
109.         [ "${val}" -eq 1 ] && append args "-a"
     
110.         # E) root password authentication
     
111.         config_get_bool val "${section}" RootPasswordAuth 1
     
112.         [ "${val}" -eq 0 ] && append args "-g"
     
113.         # F) root login
     
114.         config_get_bool val "${section}" RootLogin 1
     
115.         [ "${val}" -eq 0 ] && append args "-w"
     
116.         # G) host keys
     
117.         config_get val "${section}" rsakeyfile
     
118.         [ -f "${val}" ] && append args "-r ${val}"
     
119.         config_get val "${section}" dsskeyfile
     
120.         [ -f "${val}" ] && append args "-d ${val}"
     
121. 
     
122.         # execute program and return its exit code
     
123.         [ "${verbosed}" -ne 0 ] && echo "${initscript}: section ${section} starting ${PROG} ${args}"
     
124.         SERVICE_PID_FILE="$pid_file" service_start ${PROG} ${args}
     
125. }
     
126. 
     
127. keygen()
     
128. {
     
129.         for keytype in rsa dss; do
     
130.                 # check for keys
     
131.                 key=dropbear/dropbear_${keytype}_host_key
     
132.                 [ -f /tmp/$key -o -s /etc/$key ] || {
     
133.                         # generate missing keys
     
134.                         mkdir -p /tmp/dropbear
     
135.                         [ -x /usr/bin/dropbearkey ] && {
     
136.                                 /usr/bin/dropbearkey -t $keytype -f /tmp/$key 2>&- >&- && exec /etc/rc.common "$initscript" start
     
137.                         } &
     
138.                 exit 0
     
139.                 }
     
140.         done
     
141. 
     
142.         lock /tmp/.switch2jffs
     
143.         mkdir -p /etc/dropbear
     
144.         mv /tmp/dropbear/dropbear_* /etc/dropbear/
     
145.         lock -u /tmp/.switch2jffs
     
146.         chown root /etc/dropbear
     
147.         chmod 0700 /etc/dropbear
     
148. }
     
149. 
     
150. start()
     
151. {
     
152.         [ -s /etc/dropbear/dropbear_rsa_host_key -a \
     
153.           -s /etc/dropbear/dropbear_dss_host_key ] || keygen
     
154. 
     
155.         config_load "${NAME}"
     
156.         config_foreach dropbear_start dropbear
     
157. }
     
158. 
     
159. stop()
     
160. {
     
161.         local pid_file pid_files
     
162.        
     
163.         pid_files=`ls /var/run/${NAME}.*.pid 2>/dev/null`
     
164.        
     
165.         [ -z "$pid_files" ] && return 1
     
166.        
     
167.         for pid_file in $pid_files; do
     
168.                 SERVICE_PID_FILE="$pid_file" service_stop ${PROG} && {
     
169.                         rm -f ${pid_file}
     
170.                 }
     
171.         done
     
172. }
     
173. 
     
174. killclients()
     
175. {
     
176.         local ignore=''
     
177.         local server
     
178.         local pid
     
179. 
     
180.         # if this script is run from inside a client session, then ignore that session
     
181.         pid="$$"
     
182.         while [ "${pid}" -ne 0 ]
     
183.          do
     
184.                 # get parent process id
     
185.                 pid=`cut -d ' ' -f 4 "/proc/${pid}/stat"`
     
186.                 [ "${pid}" -eq 0 ] && break
     
187. 
     
188.                 # check if client connection
     
189.                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
     
190.                         append ignore "${pid}"
     
191.                         break
     
192.                 }
     
193.         done
     
194. 
     
195.         # get all server pids that should be ignored
     
196.         for server in `cat /var/run/${NAME}.*.pid`
     
197.          do
     
198.                 append ignore "${server}"
     
199.         done
     
200. 
     
201.         # get all running pids and kill client connections
     
202.         local skip
     
203.         for pid in `pidof "${NAME}"`
     
204.          do
     
205.                 # check if correct program, otherwise process next pid
     
206.                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" || {
     
207.                         continue
     
208.                 }
     
209. 
     
210.                 # check if pid should be ignored (servers, ourself)
     
211.                 skip=0
     
212.                 for server in ${ignore}
     
213.                  do
     
214.                         if [ "${pid}" == "${server}" ]
     
215.                          then
     
216.                                 skip=1
     
217.                                 break
     
218.                         fi
     
219.                 done
     
220.                 [ "${skip}" -ne 0 ] && continue
     
221. 
     
222.                 # kill process
     
223.                 echo "${initscript}: Killing ${pid}..."
     
224.                 kill -KILL ${pid}
     
225.         done
     
226. }

复制代码

这是现在（2.2.1 Build 240514 Rel.58724n）

1. #!/bin/sh /etc/rc.common
   
2. # Copyright (C) 2006-2010 OpenWrt.org
   
3. # Copyright (C) 2006 Carlos Sobrinho
   
4. 
   
5. START=50
   
6. STOP=50
   
7. 
   
8. SERVICE_USE_PID=1
   
9. 
   
10. NAME=dropbear
    
11. PROG=/usr/sbin/dropbear
    
12. PIDCOUNT=0
    
13. EXTRA_COMMANDS="killclients"
    
14. EXTRA_HELP="        killclients Kill ${NAME} processes except servers and yourself"
    
15. 
    
16. getNewPasswd()
    
17. {
    
18.         local key_code=`/usr/sbin/dbg_passwd_gen`
    
19.         local key=$(echo ${key_code:0:6})
    
20.         local code=$(echo ${key_code:6:38})
    
21.         #echo "Password: $key" > /dev/console
    
22.         echo "Authorized code: $code" > /dev/console
    
23.         echo ${key}
    
24.         echo ${code}
    
25. }
    
26. 
    
27. setNewPasswd()
    
28. {
    
29.         local ret=`getNewPasswd`
    
30.         local newPasswd=`echo $ret | awk '{print $1}'`
    
31.         local newAuthCode=`echo $ret | awk '{print $2}'`
    
32.         #echo "newPasswd is $newPasswd" > /dev/console
    
33.         (echo "$newPasswd";sleep 1;echo "$newPasswd") | passwd > /dev/null
    
34.         uci set ${NAME}.$1.AuthCode="$newAuthCode"
    
35.         uci commit ${NAME}
    
36. }
    
37. 
    
38. setDefaultPasswd()
    
39. {
    
40.         cp /rom/etc/passwd /etc/passwd &> /dev/null
    
41. }
    
42. 
    
43. dropbear_start()
    
44. {
    
45.         append_ports()
    
46.         {
    
47.                 local ifname="$1"
    
48.                 local port="$2"
    
49. 
    
50.                 grep -qs "^ *$ifname:" /proc/net/dev || {
    
51.                         append args "-p $port"
    
52.                         return
    
53.                 }
    
54. 
    
55.                 for addr in $(
    
56.                         ifconfig "$ifname" | sed -ne '
    
57.                                 /addr: *fe[89ab][0-9a-f]:/d
    
58.                                 s/.* addr: *\([0-9a-f:\.]*\).*/\1/p
    
59.                         '
    
60.                 ); do
    
61.                         append args "-p $addr:$port"
    
62.                 done
    
63.         }
    
64. 
    
65. 
    
66.         local section="$1"
    
67. 
    
68.         # Customized kill switch
    
69.         config_get_bool ssh_port_switch "${section}" ssh_port_switch 0
    
70.         echo "ssh_port_switch is $ssh_port_switch" > /dev/console
    
71.         if [ "$ssh_port_switch" != "1" ]; then
    
72.                 echo "set default passwd" > /dev/console
    
73.                 setDefaultPasswd
    
74.                 return 0
    
75.         fi
    
76. 
    
77.         # check if section is enabled (default)
    
78.         local enabled
    
79.         config_get_bool enabled "${section}" enable 1
    
80.         [ "${enabled}" -eq 0 ] && return 1
    
81. 
    
82.         # debug firmware use default password
    
83.         setDefaultPasswd
    
84. 
    
85.         # verbose parameter
    
86.         local verbosed
    
87.         config_get_bool verbosed "${section}" verbose 0
    
88. 
    
89.         # increase pid file count to handle multiple instances correctly
    
90.         PIDCOUNT="$(( ${PIDCOUNT} + 1))"
    
91. 
    
92.         # prepare parameters (initialise with pid file)
    
93.         local pid_file="/var/run/${NAME}.${PIDCOUNT}.pid"
    
94.         local args="-P $pid_file"
    
95.         local val
    
96.         # A) password authentication
    
97.         config_get_bool val "${section}" PasswordAuth 1
    
98.         [ "${val}" -eq 0 ] && append args "-s"
    
99.         # B) listen interface and port
    
100.         local port
     
101.         local interface
     
102.         config_get interface "${section}" Interface
     
103.         config_get interface "${interface}" ifname "$interface"
     
104.         config_get port "${section}" Port 22
     
105.         append_ports "$interface" "$port"
     
106.         # C) banner file
     
107.         config_get val "${section}" BannerFile
     
108.         [ -f "${val}" ] && append args "-b ${val}"
     
109.         # D) gatewayports
     
110.         config_get_bool val "${section}" GatewayPorts 0
     
111.         [ "${val}" -eq 1 ] && append args "-a"
     
112.         # E) root password authentication
     
113.         config_get_bool val "${section}" RootPasswordAuth 1
     
114.         [ "${val}" -eq 0 ] && append args "-g"
     
115.         # F) root login
     
116.         config_get_bool val "${section}" RootLogin 1
     
117.         [ "${val}" -eq 0 ] && append args "-w"
     
118.         # G) host keys
     
119.         config_get val "${section}" rsakeyfile
     
120.         [ -f "${val}" ] && append args "-r ${val}"
     
121.         config_get val "${section}" dsskeyfile
     
122.         [ -f "${val}" ] && append args "-d ${val}"
     
123. 
     
124.         # execute program and return its exit code
     
125.         [ "${verbosed}" -ne 0 ] && echo "${initscript}: section ${section} starting ${PROG} ${args}"
     
126.         SERVICE_PID_FILE="$pid_file" service_start ${PROG} ${args}
     
127. }
     
128. 
     
129. keygen()
     
130. {
     
131.         for keytype in rsa dss; do
     
132.                 # check for keys
     
133.                 key=dropbear/dropbear_${keytype}_host_key
     
134.                 [ -f /tmp/$key -o -s /etc/$key ] || {
     
135.                         # generate missing keys
     
136.                         mkdir -p /tmp/dropbear
     
137.                         [ -x /usr/bin/dropbearkey ] && {
     
138.                                 /usr/bin/dropbearkey -t $keytype -f /tmp/$key 2>&- >&- && exec /etc/rc.common "$initscript" start
     
139.                         } &
     
140.                 exit 0
     
141.                 }
     
142.         done
     
143. 
     
144.         lock /tmp/.switch2jffs
     
145.         mkdir -p /etc/dropbear
     
146.         mv /tmp/dropbear/dropbear_* /etc/dropbear/
     
147.         lock -u /tmp/.switch2jffs
     
148.         chown root /etc/dropbear
     
149.         chmod 0700 /etc/dropbear
     
150. }
     
151. 
     
152. start()
     
153. {
     
154.         [ -s /etc/dropbear/dropbear_rsa_host_key -a \
     
155.           -s /etc/dropbear/dropbear_dss_host_key ] || keygen
     
156. 
     
157.         config_load "${NAME}"
     
158.         config_foreach dropbear_start dropbear
     
159. }
     
160. 
     
161. stop()
     
162. {
     
163.         local pid_file pid_files
     
164. 
     
165.         pid_files=`ls /var/run/${NAME}.*.pid 2>/dev/null`
     
166. 
     
167.         [ -z "$pid_files" ] && return 1
     
168. 
     
169.         for pid_file in $pid_files; do
     
170.                 SERVICE_PID_FILE="$pid_file" service_stop ${PROG} && {
     
171.                         rm -f ${pid_file}
     
172.                 }
     
173.         done
     
174. }
     
175. 
     
176. killclients()
     
177. {
     
178.         local ignore=''
     
179.         local server
     
180.         local pid
     
181. 
     
182.         # if this script is run from inside a client session, then ignore that session
     
183.         pid="$$"
     
184.         while [ "${pid}" -ne 0 ]
     
185.          do
     
186.                 # get parent process id
     
187.                 pid=`cut -d ' ' -f 4 "/proc/${pid}/stat"`
     
188.                 [ "${pid}" -eq 0 ] && break
     
189. 
     
190.                 # check if client connection
     
191.                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
     
192.                         append ignore "${pid}"
     
193.                         break
     
194.                 }
     
195.         done
     
196. 
     
197.         # get all server pids that should be ignored
     
198.         for server in `cat /var/run/${NAME}.*.pid`
     
199.          do
     
200.                 append ignore "${server}"
     
201.         done
     
202. 
     
203.         # get all running pids and kill client connections
     
204.         local skip
     
205.         for pid in `pidof "${NAME}"`
     
206.          do
     
207.                 # check if correct program, otherwise process next pid
     
208.                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" || {
     
209.                         continue
     
210.                 }
     
211. 
     
212.                 # check if pid should be ignored (servers, ourself)
     
213.                 skip=0
     
214.                 for server in ${ignore}
     
215.                  do
     
216.                         if [ "${pid}" == "${server}" ]
     
217.                          then
     
218.                                 skip=1
     
219.                                 break
     
220.                         fi
     
221.                 done
     
222.                 [ "${skip}" -ne 0 ] && continue
     
223. 
     
224.                 # kill process
     
225.                 echo "${initscript}: Killing ${pid}..."
     
226.                 kill -KILL ${pid}
     
227.         done
     
228. }
     

复制代码

以下是关键字段

1. # 新计算方式
   
2. getNewPasswd()
   
3. {
   
4.         local key_code=`/usr/sbin/dbg_passwd_gen`
   
5.         local key=$(echo ${key_code:0:6})
   
6.         local code=$(echo ${key_code:6:38})
   
7.         #echo "Password: $key" > /dev/console
   
8.         echo "Authorized code: $code" > /dev/console
   
9.         echo ${key}
   
10.         echo ${code}
    
11. }
    
12. 
    
13. 
    
14. #旧计算方式
    
15. getNewPasswd()
    
16. {
    
17.         . /lib/functions.sh
    
18.         local macAddr=""
    
19.         macAddr=$(ubus call tddpServer getInfo '{"infoMask":1,"sep":"-"}' | sed 's/-//g' | jsonfilter -e '@.mac')
    
20.         echo "macAddr from tddp config is $macAddr" > /dev/console
    
21. 
    
22.         local key=$(echo -n "$macAddr" | md5sum)
    
23.         key=$(echo ${key:0:16})
    
24.         #echo "key is $key" > /dev/console
    
25. 
    
26.         echo ${key}
    
27. }

复制代码

根据这个脚本分析出TP-LINK在新版固件（指使用改版OpenWRT固件路由器）修改了ROOT密码计算方式
现在需要由dbg_passwd_gen这个二进制文件来生成不知道撒玩意的东西然后再去算
但是解包却没有看到这玩意的踪影
有点怀疑是TP-LINK是在更新后才释放这个文件，但是固件找不到也就提不出来
希望有大佬能折腾一下这玩意

btpan

既然能解包再封包，理论上替换shadow里的内容就可以啦，或者看看是不是有个启动时的uci配置教本自动重置了shadow内容
只要telnet能成功登录后，想怎么操作就怎么操作。都是敲命令
例如:
cd
ls
ls -l
cat
passwd

btpan

binwalk解压原始固件，
squashfs-root文件系统
/etc目录
重新mksquashfs压缩回去。

楼主拿到shadow文件就可以替换了。用别的知道密码的openwrt的shadow替换密码部分就可以了
比如$1$/upNzzBq$n6dSjhrukZDsXFFm33doL1替换$1$tHiYRbC2$zCy8uUkCeF8Rwa8p2yPKX1。保存文件打包回去再上传，重启。
我给的$1$/upNzzBq$n6dSjhrukZDsXFFm33doL1就是admin。替换后root密码就是admin
我的TL-ER3210G提取出来的默认密码就是$1$tHiYRbC2$zCy8uUkCeF8Rwa8p2yPKX1。有高手能反推出密码吗?tp用openwrt内核的路由器是不是都是这个密码啊。
另外拿到root ttl进系统了后能改什么呢？改插件？