I have a Gemtek WVRTM 127ACN router / modem, my goal is to get root access and to dump the currently installed firmware, not being official, but a modified version of who provided it to me. On the internet there is nothing about this specific model, however, if I disassembled it I noticed pre-soldered the serial attacks, with these I managed to use the serial. I noticed immediately that it uses a MT7621 ralink chip with its U-boot version 1.1.3 bootloader, it does not have many functions as a result it is difficult to dump the firmware, but I think I have solved by loading an application from the ram that would do it. Now get root access, If you do not touch any key during startup, linux starts automatically. It's a linux version created with buildroot, the problem is that there is not a normal login, it asks me the user, I put root as user and then gives me a challenge code and I have to provide an authentication code, here's an example:

buildroot login: root
Challenge code:
XIOzMDMXP0L+qu1OzNVCt6nee75ucEbbyR+O6xlXlrLGM7KKTpsXgkeZKxT+tWUS
ckuJHYh6WppGdsha+h1+Sl1wD3b9PsNcAlRneVpVmAJchEST5LE8pJ2MSaxgL0z6
jE2VbYPKRX/gNbDnB7b6mov9igPRIsd3hXgcCxgAJ2L8eFOoxAf0IOBAlSpad1nY
U2O/UrZgn/Jha4prb4ltXlmzrza7OI62TH1jFlZKXi2RmQbXtPB2FfMAGzt3thnG
6w54bJKl9fK581fk2V5EzYK21Ejwsz6bmo5cx2Ezn2sjx+vjLTgbZJKgd6geheOW
xUrRUVmywMHnhPtdMSZQEA
Authentication code: 

Now I guess this is an encryption system is that I need to know the private key to generate the authentication code, now in the bootloader variables (U Boot) I found one in particular called root_chain_cert that contained something like that even if very long, as if it were a private key, below I leave all the variables that are there including this

bootdelay=1

baudrate=115200

ethaddr="00:AA:BB:CC:DD:10"

filesize=c5900c

fileaddr=81000000

ipaddr=10.10.10.123

serverip=10.10.10.3

Mmid=WVRTM-127ACN

version_uboot=U-Boot 1.1.3 (Oct 23 2015 - 16:03:05)

lanaddr=1C:49:7B:55:30:14

mid=WVRTM-127ACN

cid=Linkem

pid=LTE CPE

hid=V02

dmid=WVRTM-127ACN

serial=GMK160308008941

LTE_SupportBand_Mask=0000060000000000

dsp_port_number=0

wmxaddr=1C:49:7B:55:30:14

wifiaddr=1C:49:7B:55:30:15

11acaddr=1C:49:7B:55:30:16

root_chain_cert=QlpoOTFBWSZTWeaspK0ABNX/lOiQAEDAC//iP///+H////AEAAAAgAhgBz7fNMSg CgegA9DruzohpKADR6gAGQGhoAbUNNB5RoAAJKlT1MnvSGKZNPFT1P1PNRo9TUj8 mlPTU9HqQyPUNAyBpUaA0aGnqNPIgaaA0aDQA9QAAAcZMmjEMTTAQMCaYIwTE000 AGEGSoPSPUANAA0AAAAAAAAJShMTAjRo0MgaA0AACaZoVTyTGmjqR+4B+YAZK1EK LZgEEwwoKZCF4CG8YIHxRlCL4jmQ8IyArySiUo6fv6jQUVHibTkPLThTjdlOonuE nOscj/KhwGrsYkiH8oKoayQkNYstOkXUswuo0nup/CSB89d38YIDR4FDR/ooj9fv XWSy/GYvyWEtM/smVPx0AdBoUiNKAETimooARgQAhfFq3zrElZQhgrGkb/SVyyD5 TMvu+GAsGw/ktOFRP0jzGxO0EKKQq1kFFlEui52dFWaCZhwQzn7TekZwJv82FCn+ Wh5FnFCAtn7b2Y5hr6/P9IPWaDZEv2rWY1hTxM2MOgLOvtWiUdwV9XfbeOT53eKd OU0j+/OY3KhYjsnMhCw9JSQeaZfBi8+JK5e+5UUrfUuwlkI8WpRJ/MvbH03dJnow tvG5WzzrAVdYwoJylXtGaqEZt1TUEtE5qFSiPlkjoQJ9BGn6SSFLjhuMafCPuRbQ 9zfWhP0DHR1DaZHPs7SlJNaeDq2NKjKRLwXCWvMHlMLopMRIbO0IvwLKPE7ygO4O Vbq7ibUoVJ0YNgsdg9Dh1GnuALPjwvmRwVKJkKwLHMUCMUBY4pw1w8WR8tNHLFd+ MG0i0GooD5XFXQ3oqdZZLxAMjAwWQXLpKuflPJ3Pq4TDRiIikM0xkcevtrmg2nYt PjZX0SHohFcuNOxL6NKf1dB4fNpgD2GmWRhQtjdYHaj1W6jRnP/VGBaXijSWSyi6 xODKOCxxOnjfRKIQnP6E8JusiXB41+bRqwPlRFAjqnpekUQXOwMqHCgNoUCBN6Xa xkBchM5AqMFAVwFvYKlgWCiXh8XOPazqCw0XsIKhbHTElga6dWyiX6UJKmCtcPI0 XzGXTSmbiyF0hHDTvcTkVUugwTgoEqs85HClogBQh24ie2q6AvQmawjKS1xxVMxQ ZMBDjobyjjny28wywkol0H0VR+gTGgaCAmDEol8bN4+diJNZrylYd9YCj3PreFIr kZmLnkiJS2RBJbITBoPJ0PK4wpMTlUmNj44aTzsF67CQDvkVMZj8I7lK29PiS7rC c2FpCTLzIsY3CEytExq6N4V7xP8b3GkmOiXiEWJRtKIsK8FDaNmQYNh2YGiMkSEU M5aNwMjDB8NA8NPQxZ0jL4V7iUoBUvo/xPZWoJojxC4fCUDCkTvfi7Mk2m8NJOkF QkEaYzpE/ihVIVG0NhRMBBRogdDU2hmDsc4gsrDONmLIwUyO5yqkco+DB2KBXwqj Tgqa4mMojQqOihKOjb54eOHaQ6lwpp2vjkGkzPhVFSpOxSeJSyVgqG4YeH4TgSHr XKVk5snP7KPM2C8JbCkcHfB9cluVsKb9/T9rDZlNz+sxCca5hLBlGiIXBQVDAdLB 74jxB3KmXxVIehEdeBYHRKhe2TGsXDxgx5Qxp6KS5BIXzKWS/fOhCc00FzneGgsz ipELEQwJWbtEhr3sJVNXbubrSNDOOY8nkZbp5B7x1SqFdFy7amIi7X3g8lzYVdxS L1VYYKw74mTQ1eRmiZlgmLgbi8G0mFTeWTRDvnPutT54E1yJhTT7xJ3OKLVaRSGC ifQsRncok/QpFuBp/TsziVQhsnfujx7qHccTvkkWf8QIaU23jYbws8aowm3G6KG5 kLZzLIwlMbhsupy7py6jRbCo6R2f1/Cf62boTkXTOYDSnVOjQ4A1bCwnDKM40FsG 6iTJHPaYhE0Ehgc6QUXAqjrdbeuZ5gc3T2ktGUpiWiknGwbAcSp5CcYoD8klxQ83 PEJTG02DwodqQHBFFTOLjhTDIYxcf9OyplS/RFqp1TUZIDkZyPIF4tC5YPZAnua0 ej7K2xlO0BYhzJ9I4ldw+8RUMJ+JEi5ROXTueumpLBzqmsGmC+K+YlX1AqpgpZyA Z4M5Gv067i28NwSZ4K5NyemW09nEfKxnesHBwzbfNJAP5TMdyL11I3Jvu2GiiKpo Oct0qjzsZjPhwTrhXol0deHyEOZye1LHMUsmxJDjzTj5KB9hclwYjYLQIPJBCcRg LN12TkCRjFczaAd4D6LxJQyHFFiFkBZWEw1xRAlqKUQRgsGtWLSGNh5Pwh+0FgKd vGchS8RpzxY3+xAYRlPsh2lYUPsTcasL4hqNmsNqhbuMpqSHt48lrOlBM055nQ87 edVpqss1+C4mv4EvuWRx9CNRPf5FVzddyeDTsIIWmpcDIfWvLsdL6UKdMnwGclID SbhUVRUiUJzNhMhXBcqC9vSUD73lwLTYqOh59c93axS6ZoCmMiYE+k1sI8Pmrklc 3hJ07lQGU+RmD5psvStXMIRFg9pbJTk/XlO6bS35Ef8XckU4UJDmrKSt

mtddevnum=5

stdin=serial

stdout=serial

stderr=serial


Environment size: 3112/131067 bytes

Does anyone know anything more about this login system? Here is the list of commands supported by u boot:

?       - alias for 'help'

bootm   - boot application image from memory

go      - start application at address 'addr'

help    - print online help

md      - memory display

mdio   - Ralink PHY register R/W command !!

mm      - memory modify (auto-incrementing)

nand- nand command

nm      - memory modify (constant address)

printenv- print environment variables

reset   - Perform RESET of the CPU

saveenv - save environment variables to persistent storage

setenv  - set environment variables

tftpboot- boot image via network using TFTP protocol

version - print monitor version

And these are the first lines of linux output:

Starting kernel ...

LINUX started...

 THIS IS ASIC
[    0.000000] Linux version 2.6.36 (greg_kuo@hana) (gcc version 4.5.4 (Buildroot 2015.02-svn16582) ) #1 SMP PREEMPT Fri Jul 28 12:23:00 CST 2017
New contributor
Chi non salta Pavarotti è is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Chi non salta Pavarotti è is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.