UART Root Shell on Linux Router - Hacking the Totolink WiFi Router

In this video, we discover a hardcoded root password though the aid of OpenWRT's failsafe mode.

OpenWRT Failsafe Mode Docs:

---------------------------------------------------------------------------------

IoT Pentesting Certification from TCM:

Need IoT pentesting services?
Please consider Brown Fine Security:

Come join us on Discord for some device hacking!

🛠️ Stuff I Use 🛠️

🪛 Tools:

🫠 Soldering & Hot Air Rework Tools:

🔬 Microscope Setup:

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:

[mattbrwn]

Been a while since posting a video so thanks for viewing!
Was busy last month competing in a HackerOne Live Hacking Event with Amazon and AWS! Excited to get back to YT. 😎

[gametec_live]

How nice of them to label and even populate the UART interface lol

[OhadLutzky]

Man, "google the password hash" is such a forehead-knock moment, absolutely beautiful!

[RetroDelete]

Awesome, just what I was looking forward to!
Coincidentally I just opened my old ASUS RT-AC57U V3 router and the UART is even labeled!
Strangely enough the router has a dropbear SSH server that you can turn on in advanced settings, but the entire rootfs seemed to be mounted as a tmpfs.
I'll post some comments here after I get a little bit more time to investigate the router later today.

[tarunvignesh]

Its amazing to see ur projects u have opened me up to an whole new domain

[johnkutney]

Love your work and high quality videos on a nesh topic is amazing thank you 🎉

[ripplerxeon]

Finally, i was waiting for the upload.

[Mr._Mythical]

Your videos are what got me into type things like routers. I have 1 router, but im not gonna mess with it until the new year as im waiting to see if the company wants it back as i just upgraded my internet

[bin_chicken]

Cool Matt. Thanks. Look forward to the next episode.

[hexdef]

7:06 had to pause the video right before the partition table it claims it's a raspi

[mjmeans]

LOL. You didn't remove the label. You cut it. Warranty not voided!

[manjsc]

nice, really fun content to watch! keep up the good work!

[arghyl]

We know is a great day when there's a new drop by Matt Brown.

[petehinch]

Another great video. Looking forward to the next one

[Mordecrox]

Finally some use for those suspicious thingies trying to pass as TP-Link

[vladimirrus]

TIO is a great cross-platform serial console tool with modern features and auto rate selection.

[illililililillli]

The irony is I'm actively doing a uart install while watching this

[bumpinz]

This was a good video. I appreciated the way you presented the process. I reached out to you through your email on your website. I am looking forward to hearing back from you.

[MrSuperSnuiter]

Hi Matt please make a video on ways of obtaining Tuya local keys. Eg (Tuya light bulb) by capturing network traffic with Wireshark etc.
Awesome channel and excellent video Thanks

[electronic]

Hah i am watching this while messing with a Tv settopbox via uart and compiling openwrt for my router i am also working on, but the router is laying on the side of my desk while my settopbox is near my keyboard. Its also partly due to your videos that i got inspired to go hardware hacking and uncovering the world of embedded Linux. Its also cause i just like messing arround with devices and stuff! And sometimes uncovering vulnerabilities and easter eggs/hidden elements