mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-29 18:19:02 +00:00
9ac1523062
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| mt7622-buffalo-wsr-2533dhp2.dts | ||
| mt7622-buffalo-wsr-3200ax4s.dts | ||
| mt7622-buffalo-wsr.dtsi | ||
| mt7622-dlink-eagle-pro-ai-m32-a1.dts | ||
| mt7622-elecom-wrc-2533gent.dts | ||
| mt7622-elecom-wrc-x3200gst3.dts | ||
| mt7622-linksys-e8450-ubi.dts | ||
| mt7622-linksys-e8450.dts | ||
| mt7622-linksys-e8450.dtsi | ||
| mt7622-netgear-wax206.dts | ||
| mt7622-reyee-ax3200-e5.dts | ||
| mt7622-rfb1-ubi.dts | ||
| mt7622-ruijie-rg-ew3200.dtsi | ||
| mt7622-ruijie-rg-ew3200gx-pro.dts | ||
| mt7622-totolink-a8000ru.dts | ||
| mt7622-ubnt-unifi-6-lr-v1-ubootmod.dts | ||
| mt7622-ubnt-unifi-6-lr-v1.dts | ||
| mt7622-ubnt-unifi-6-lr-v1.dtsi | ||
| mt7622-ubnt-unifi-6-lr-v2-ubootmod.dts | ||
| mt7622-ubnt-unifi-6-lr-v2.dts | ||
| mt7622-ubnt-unifi-6-lr-v2.dtsi | ||
| mt7622-ubnt-unifi-6-lr-v3-ubootmod.dts | ||
| mt7622-ubnt-unifi-6-lr-v3.dts | ||
| mt7622-ubnt-unifi-6-lr-v3.dtsi | ||
| mt7622-ubnt-unifi-6-lr.dtsi | ||
| mt7622-xiaomi-redmi-router-ax6s.dts | ||
| mt7623a-unielec-u7623-02-emmc-512m.dts | ||
| mt7623a-unielec-u7623-02.dts | ||
| mt7623a-unielec-u7623-02.dtsi | ||
| mt7629-iptime-a6004mx.dts | ||
| mt7629-netgear-ex6250-v2.dts | ||
| mt7629-tplink_eap225-v5.dts | ||
| mt7981a-comfast-cf-e393ax.dts | ||
| mt7981a-ubnt-unifi-6-plus.dts | ||
| mt7981b-cetron-ct3003.dts | ||
| mt7981b-cmcc-rax3000m-emmc.dtso | ||
| mt7981b-cmcc-rax3000m-nand.dtso | ||
| mt7981b-cmcc-rax3000m.dts | ||
| mt7981b-confiabits-mt7981.dts | ||
| mt7981b-cudy-re3000-v1.dts | ||
| mt7981b-cudy-tr3000-v1.dts | ||
| mt7981b-cudy-wr3000-v1.dts | ||
| mt7981b-glinet-gl-mt3000.dts | ||
| mt7981b-h3c-magic-nx30-pro.dts | ||
| mt7981b-jcg-q30-pro.dts | ||
| mt7981b-qihoo-360t7.dts | ||
| mt7981b-routerich-ax3000.dts | ||
| mt7981b-unielec-u7981-01-emmc.dts | ||
| mt7981b-unielec-u7981-01-nand.dts | ||
| mt7981b-unielec-u7981-01.dtsi | ||
| mt7981b-xiaomi-mi-router-ax3000t-ubootmod.dts | ||
| mt7981b-xiaomi-mi-router-ax3000t.dts | ||
| mt7981b-xiaomi-mi-router-ax3000t.dtsi | ||
| mt7981b-xiaomi-mi-router-common.dtsi | ||
| mt7981b-xiaomi-mi-router-wr30u-stock.dts | ||
| mt7981b-xiaomi-mi-router-wr30u-ubootmod.dts | ||
| mt7981b-xiaomi-mi-router-wr30u.dtsi | ||
| mt7981b-yuncore-ax835.dts | ||
| mt7981b-zbtlink-zbt-z8102ax.dts | ||
| mt7981b-zbtlink-zbt-z8103ax.dts | ||
| mt7981b-zyxel-nwa50ax-pro.dts | ||
| mt7986a-acelink-ew-7886cax.dts | ||
| mt7986a-acer-predator-w6.dts | ||
| mt7986a-asus-rt-ax59u.dts | ||
| mt7986a-asus-tuf-ax4200.dts | ||
| mt7986a-asus-tuf-ax6000.dts | ||
| mt7986a-glinet-gl-mt6000.dts | ||
| mt7986a-smartrg-bonanza-peak.dtsi | ||
| mt7986a-smartrg-SDG-8612.dts | ||
| mt7986a-smartrg-SDG-8614.dts | ||
| mt7986a-smartrg-SDG-8622.dts | ||
| mt7986a-smartrg-SDG-8632.dts | ||
| mt7986a-tplink-tl-xdr4288.dts | ||
| mt7986a-tplink-tl-xdr6086.dts | ||
| mt7986a-tplink-tl-xdr6088.dts | ||
| mt7986a-tplink-tl-xdr-common.dtsi | ||
| mt7986a-xiaomi-redmi-router-ax6000-stock.dts | ||
| mt7986a-xiaomi-redmi-router-ax6000-ubootmod.dts | ||
| mt7986a-xiaomi-redmi-router-ax6000.dtsi | ||
| mt7986a-zyxel-ex5601-t0-common.dtsi | ||
| mt7986a-zyxel-ex5601-t0-stock.dts | ||
| mt7986a-zyxel-ex5601-t0-ubootmod.dts | ||
| mt7986a-zyxel-ex5700-telenor.dts | ||
| mt7986b-mercusys-mr90x-v1.dts | ||
| mt7986b-netgear-wax220.dts | ||