So I got a new tp-link router (Archer vr600) and downloaded the firmware version I'm running from the site (V2 firmware version 170504) in order to search for vulnerabilites.
After some research I got these insights:
In rcS script I can see it's running by default telnetd binary. From passwd.bak file (using john to crack the hash), I can find pretty easily hardcoded credentials such as admin:1234 that needs to have access to /bin/sh, dropbear without password. But when trying to telnet the server (192.168.1.1) it does establish connection but I cannot figure out the password (It doesn't require username). Also when I try to ssh email@example.com, the password 1234 is wrong. What am I missing here? Doesn't the credentials from passwd.bak should work?
After reversing vsftpd binary I saw there is hardcoded account "anonymous" that doesn't require password, but after I login to ftp server with anonymous (succesfuly), I don't have permission to anything, not even "ls". Also there are credentials in vsftpd_passwd which is clear-text file, but the credentials doesn't work. I guess it's not supposed to, mainly searching for insights from someone with experience in this topic.
From what I've seen on the web, binaries such as libcmm.so, cos are binaries worth looking at for buffer overflows, harcoded credentials. Any more tips from someone with experince?
Thanks for the help.