I bought a little GL.iNet router and flashed it with a fresh OpenWRT image but I've been unable to do anything with it yet since it was unable to connect to the net via my apartment's ethernet connection. After some diagnostics I managed to find out that I needed to find the PPPoE username/password my working router used to connect, which was where my weird adventure began.
My landlord or previous tenant had (smartly) changed the default password - admin/admin - so I wasn't able to use the web interface or SSH. I realised there was likely some Serial headers on the board I could use, so I dug out the schematics, cracked open my router and hoped to god that there was no login required, so that I could retrieve the settings from /etc/chap-secrets where I think they reside.
My router is a TP-Link WR741ND v4, a router that sadly doesn't already have serial pins which meant I needed to do a little soldering.
Two things need soldering, first is the connection between TX header and the onboard MIPS cpu as it's left open on this version of the router:
Once this was done I just needed to connect some cables to the TX, RX and GND headers (I also connected up VCC in case I ever needed it in future):
Once these were sorted I was able to hook up my USB-TTL cable, open up terminal and crosss my fingers to see a very reassuring Linux boot in progress...
... followed swiftly by a login prompt!
I genuinely hoped that serial access would not be password protected, but it seems that I need to regroup and figure out how I can maybe retrieve the pppoe information some other way.
There is hope - typing "tpl" and hitting <Enter> during the boot process takes me to the u-boot prompt below
So it's possible that either:
- I could coax uboot to boot into linux in single user mode
- Theres a way I could dump the data in the router's flash memory (I think md/mw/cp uboot commands can help here), find a way to access the filesystem this way.
- I could get uboot to load a minimal linux image over TFTP (using tftpboot), then mount the flash file system and browse it.
The final alternative is to brute force the username (probably still admin) and password, which is a little inelegant and slow.