SamKnows speed test

 # Hacking the SamKnows Whitebox
The SamKnows Whitebox is a free router (TP-Link TL-WDR3600) provided by SamKnows to gather internet speed statistics. Ok that's great, but any person with a small amount of hacker's spirit will want to hack it to install some custom firmware to take advantage of the two gigantic antennas on the back, the USB ports and everything else.

## Step 1 : Debug mode
Root access can be obtained via a "debug mode" on the router giving you a direct root shell via telnet, amazingly simple.

* Disconnect the Whitebox from the internet.
* Connect your computer directly to the Whitebox via Ethernet to one of the four ethernet ports on the Whitebox.
* Configure your computer's IP settings to "Manual" setting the computer's IP address to `192.168.1.2`, the Subnet Mask to `255.255.255.0` and the Gateway to `192.168.1.1`.
* Turn off the Whitebox.
* Turn on the Whitebox.
* Wait for all the lights to come on and turn off once, then spam the "WPS / Reset" button on the back of the Whitebox.
* Continue spamming until the second LED from the left flashes continuosly. You are now in "debug mode".

## Step 2 : Changing the root password

Ok, so now you have a root shell on the Whitebox via telnet, wasn't that hard. Now connect to the Whitebox with a telnet client (Putty on Windows, Terminal on linux) :

    $ telnet 192.168.1.1
    Trying 192.168.1.1...
    Connected to 192.168.1.1.
    Escape character is '^]'.

     === IMPORTANT ============================
     Use 'passwd' to set your login password
     this will disable telnet and enable SSH
     ------------------------------------------


    BusyBox v1.19.4 (2012-11-21 13:26:44 GMT) built-in     shell (ash)
    Enter 'help' for a list of built-in commands.

                         _
     ___  __ _ _ __ ___ | | ___ __   _____      _____
    / __|/ _` | '_ ` _ \| |/ / '_ \ / _ \ \ /\ / / __|
    \__ \ (_| | | | | | |   <| | | | (_) \ V  V /\__ \
    |___/\__,_|_| |_| |_|_|\_\_| |_|\___/ \_/\_/ |___/
           P E R F O R M A N C E   M O N I T O R I N G

     OS: OpenWRT Attitude Adjustment, r35093
     SW: WDR3600 Build
     -------------------------------------------------
    root@(none):/# 

There you have it, a root busybox shell. Next up... mounting the filesystem :

    root@(none):/# mount_root
    switching to jffs2

Now we can perform modifications to the system, for example we could change the... root user's password maybe (They gave us the hint when connecting via telnet)

    root@(none):/# passwd
    Changing password for root
    New password: 
    Bad password: too short
    Retype password: 
    Password for root changed by root

I set the password to "root", hence the "Bad password" warning. 

## Step 3 : SSH inside

Telnet is a pile of shit, a move to SSH is recommended.

Now if you restart the box (don't bother trying `reboot` it doesn't do much, just pull the plug), plug the Whitebox back in to your router then you should be able to access the device via SSH on port 2222 (once you've found the DHCP assigned IP address, check your router's web interface to see if you can get a list of all connected devices, or try an IP scan on the local network)

    $ ssh root@10.0.0.44 -p 2222
    root@10.0.0.44's password: 

    BusyBox v1.19.4 (2012-11-21 13:26:44 GMT) built-in shell (ash)
    Enter 'help' for a list of built-in commands.

                         _
     ___  __ _ _ __ ___ | | ___ __   _____      _____
    / __|/ _` | '_ ` _ \| |/ / '_ \ / _ \ \ /\ / / __|
    \__ \ (_| | | | | | |   <| | | | (_) \ V  V /\__ \
    |___/\__,_|_| |_| |_|_|\_\_| |_|\___/ \_/\_/ |___/
           P E R F O R M A N C E   M O N I T O R I N G

     OS: OpenWRT Attitude Adjustment, r35093
     SW: WDR3600 Build

    root@OpenWrt:~#

## Step 4 : Explore

Now you're inside, you can explore around, find your device's "Unit ID" to spoof metrics :

    root@OpenWrt:/tmp/samknows# cat /tmp/samknows/unitid
    123456

You can also modify it to pretend you're someone else (Warning : the "unitid" goes back to default on reboot) with a quick `vi /tmp/samknows/unitid`

You can also find out how everything works (such as sending results and all the different test) and disable reporting by exploring `/tmp/ispmon`

    root@OpenWrt:~# cat /tmp/ispmon/cron/crontab 
    40 * * * *  /tmp/ispmon/bin/dcsclient https://dcs-uk.samknows.com:443 -v >/dev/null 2>&1
    45 * * * * /tmp/ispmon/scripts/pcscript >/dev/null 2>&1
    25 * * * * /tmp/ispmon/scripts/sanity.sh >/dev/null 2>&1
    26 * * * * /tmp/ispmon/scripts/submit.sh >/dev/null 2>&1
    30 * * * * /tmp/ispmon/scripts/timesync.sh >/dev/null 2>&1
    35 6 * * * /usr/sbin/udhcpcrestart.sh >/dev/null 2>&1
    38 22 * * * /tmp/ispmon/scripts/background_tests.sh restart >/dev/null 2>&1

This shows which scripts are called by the system and how often. The same output can be obtained via `crontab -e`

Cronjob execution can be disabled for the current session with `killall crond`

And if you want to disable stuff permanently, take a look at `/overlay` (A good explanation is available [here](http://wiki.openwrt.org/doc/techref/flash.layout))

# Step 5 : Flash

The great thing about this little Whitebox is that we can install pratically anything on it, I've chosen to install DD-WRT. To start off you need to find the correct firmware for the Whitebox and download it to your computer.

Pop over to the [DD-WRT Router Database](http://www.dd-wrt.com/site/support/router-database), type `TL-WDR3600` and download the `factory-to-ddwrt.bin` file.

Put the file on a web server on your computer to make it accessible from the Whitebox so the router can access http://192.168.1.2/factory-to-ddwrt.bin

* Now go back to step 1 and access the Whitebox via telnet.
* Execute the `mount_root` command.
* Move to the `/tmp` directory : `cd /tmp`
* Execute `wget http://192.168.1.2/factory-to-ddwrt.bin`
* Execute `mtd -r write /tmp/factory-to-ddwrt.bin firmware`

You should now have the following output, it can take a few moments, don't panic :

    root@(none):/tmp# mtd -r write /tmp/factory-to-ddwrt.bin firmware
    Unlocking firmware ...

    Writing from /tmp/factory-to-ddwrt.bin to firmware ...     
    Rebooting ...

## Step 6 : Enjoy

Now the telnet session should die and your Whitebox should reboot, I'll call it the Blackbox now because it's turned to the dark side.

Now by visiting http://192.168.1.1/ in your browser you will be greeted with your brand-spanking-new version of DD-WRT. I'm not going to cover setting everything up, that's your problem now. Have fun with your Blackbox !