Build Your Own WiFi Pineapple Tetra for $7!
Let's talk about the WiFi Pineapple! This little gem normally sells for about $99 that allows
Evil Portal, Fake HTTPS, Man-In-The-Middle attack... I have myself experienced many of the features offered by WiFi Pineapple in the past, but only in a manual way using a laptop with a WiFi adapter. The WiFi Pineapple is meant to be easy to use by gathering in a web interface all the features for WiFi testing and auditing, especially to see if WiFi networks are vulnerable to WiFi hackers.
As I often do before buying something, I did some research on the product. I learned that the WiFi Pineapple is based on OpenWrt, a Linux based firmware for embedded devices but with a graphic overlay and some open-source security tools pre-installed in the router. I then started to think that it could be possible to replicate this on any other router.
Let's try! The first thing to do is to download the latest version of WiFi Pineapple Tetra.
wget https://www.wifipineapple.com/downloads/tetra/latest -O tetrafw.bin
--2021-11-06 18:49:43-- https://www.wifipineapple.com/downloads/tetra/latest
Resolving www.wifipineapple.com (www.wifipineapple.com)... 172.67.137.197, 104.21.46.105, 2606:4700:3037::6815:2e69, ...
Connecting to www.wifipineapple.com (www.wifipineapple.com)|172.67.137.197|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘tetrafw.bin’
tetrafw.bin [ <=> ] 30.51M 6.65MB/s in 5.8s
2021-11-06 18:49:49 (5.30 MB/s) - ‘tetrafw.bin’ saved [31989793]
Once the firmware downloads successfully, I de-compile it to explore the content and try to find what is inside the classic OpenWrt firmware. To unpack the firmware, I will use the tool binwalk.
binwalk -eM tetrafw.bin
Scan Time: 2021-11-06 18:56:37
Target File: /home/yoda/tetrafw.bin
MD5 Checksum: 6cc58d0ca85cf9a025a257890b73532c
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 POSIX tar archive (GNU), owner user name: "de-pineapple-tetra/"
Scan Time: 2021-11-06 18:56:38
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/kernel
MD5 Checksum: 11a7c4122eefbc1187d1fde8d5e5bc9f
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
64 0x40 LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: 5365292 bytes
Scan Time: 2021-11-06 18:56:38
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/CONTROL
MD5 Checksum: 77a3bbf6768daae74a3e346282d270eb
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
Scan Time: 2021-11-06 18:56:38
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/root
MD5 Checksum: dbeec16d73770b49b7fcfafd721f28e0
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
0 0x0 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 13757048 bytes, 2553 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12
Scan Time: 2021-11-06 18:56:39
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/kernel
MD5 Checksum: 11a7c4122eefbc1187d1fde8d5e5bc9f
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
64 0x40 LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: 5365292 bytes
Scan Time: 2021-11-06 18:56:40
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/CONTROL
MD5 Checksum: 00ed91cb41aa4d08fe228e06816264e6
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
Scan Time: 2021-11-06 18:56:40
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/root
MD5 Checksum: dbeec16d73770b49b7fcfafd721f28e0
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
0 0x0 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 13757048 bytes, 2553 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12
Scan Time: 2021-11-06 18:56:40
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_kernel.extracted/40
MD5 Checksum: fbda25f0448f6d23f8f0f210d007397b
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
4181472 0x3FCDE0 CRC32 polynomial table, big endian
4222725 0x406F05 Certificate in DER format (x509 v3), header length: 4, sequence length: 21632
4790800 0x491A10 xz compressed data
4813916 0x49745C Unix path: /lib/firmware/updates/4.14.171
4854481 0x4A12D1 Neighborly text, "neighbor table overflow!tics"
4873372 0x4A5C9C Neighborly text, "NeighborSolicitsports"
4873392 0x4A5CB0 Neighborly text, "NeighborAdvertisements"
4876310 0x4A6816 Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
5185536 0x4F2000 ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5364536 0x51DB38 ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5364652 0x51DBAC ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5364776 0x51DC28 ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5364892 0x51DC9C ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
Scan Time: 2021-11-06 18:56:42
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/_kernel.extracted/40
MD5 Checksum: fbda25f0448f6d23f8f0f210d007397b
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
4181472 0x3FCDE0 CRC32 polynomial table, big endian
4222725 0x406F05 Certificate in DER format (x509 v3), header length: 4, sequence length: 21632
4790800 0x491A10 xz compressed data
4813916 0x49745C Unix path: /lib/firmware/updates/4.14.171
4854481 0x4A12D1 Neighborly text, "neighbor table overflow!tics"
4873372 0x4A5C9C Neighborly text, "NeighborSolicitsports"
4873392 0x4A5CB0 Neighborly text, "NeighborAdvertisements"
4876310 0x4A6816 Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
5185536 0x4F2000 ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5364536 0x51DB38 ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5364652 0x51DBAC ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5364776 0x51DC28 ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5364892 0x51DC9C ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
Scan Time: 2021-11-06 18:56:44
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_kernel.extracted/_40.extracted/console
MD5 Checksum: d41d8cd98f00b204e9800998ecf8427e
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
Scan Time: 2021-11-06 18:56:44
Target File: /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/_kernel.extracted/_40.extracted/console
MD5 Checksum: d41d8cd98f00b204e9800998ecf8427e
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
Now we can see all directories that are a part of the squashfs-root partition.
ll _tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_root.extracted/squashfs-root/
inode Permissions Links Size Blocks User Group Date Modified Name
648479 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 bin/
648480 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 dev/
648485 drwxr-xr-x 24 - - yoda yoda 28 Feb 2020 etc/
745968 drwxr-xr-x 11 - - yoda yoda 11 Aug 2019 lib/
648596 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 mnt/
746242 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 overlay/
746246 drwxr-xr-x 8 - - yoda yoda 28 Feb 2020 pineapple/
746315 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 proc/
746316 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 rom/
746317 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 root/
746318 drwxr-xr-x 2 - - yoda yoda 11 Aug 2019 sbin/
746319 drwxr-xr-x 2 - - yoda yoda 28 Feb 2020 sys/
746320 drwxrwxrwt 2 - - yoda yoda 28 Feb 2020 tmp/
746321 drwxr-xr-x 7 - - yoda yoda 11 Aug 2019 usr/
648597 drwxr-xr-x 2 - - yoda yoda 11 Aug 2019 www/
627573 lrwxrwxrwx 1 3 0 yoda yoda 28 Feb 2020 var -> tmp
After some time digging in the different directories, I found the file openwrt_release which gave me some interesting information about the composition of the firmware.
cat etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='19.07.2'
DISTRIB_REVISION='r10947-65030d81f3'
DISTRIB_TARGET='ar71xx/nand'
DISTRIB_ARCH='mips_24kc'
DISTRIB_DESCRIPTION='OpenWrt 19.07.2 r10947-65030d81f3'
DISTRIB_TAINTS='no-all busybox'So what does this file tell us?
Well, we can see that it uses OpenWrt 19.07.2 (a bit outdated now) but the most important thing we found was that the WiFi Pineapple uses the mips_24kc architecture! Therefore it is possible that if the same conditions are met, we can install the firmware on another device using the same architecture.
After a quick research on Google, I found the list of all routers using the mips_24kc architecture. https://openwrt.org/docs/techref/instructionset/mips_24kc
So many potential candidates! As I didn't have any of these routers on hand, I checked on a second hand shop to see if there were any routers from this list available. To my surprise, I found that there were many Buffalo routers available for around ¥800, or around $7 USD. So I decided to buy not one or two, but three routers from this list 😁
| WiFi Pineapple TETRA | Buffalo WZR-HP-G450H | Buffalo WZR-HP-AG300H | TP-Link Archer C7 v4 | |
|---|---|---|---|---|
| CPU | Atheros AR9344 | Atheros AR7242 | Atheros AR7161 | Atheros QCA9563 |
| CPU MHz | 533 MHz | 400 MHz | 680 MHz | 775 MHz |
| Flash MB/GB | 2 GB | 32 MB | 32 MB | 16 MB |
| RAM MB | 64 MB | 64 MB | 128 MB | 128 MB |
| Price ($) | $99 | $7 (¥800) | $8 (¥900) | $13 (¥1500) |
What do you think? When we quickly compare them, we can see that except for the 2GB of memory, the other routers have nothing special compared to the WiFi Pineapple. Since all routers are equipped with USB port(s), it is possible to insert a USB key to fill in the difference of memory. Therefore, a USB key of at least 2GB will be required to install the WiFi Pineapple in one of these routers.
Clone the Firmware and Make it Yours.
The idea is simple. In order to make the official WiFi Pineapple firmware work with a different router, I will have to build my own OpenWrt firmware specially designed for it and at the same time include the overlay "Pineapple".
The first step is to find all the files specific to the WiFi Pineapple firmware. After some long and tedious work, here is the list:
/bin/bash
/bin/busybox
/etc/config/autossh
/etc/hotplug.d/block/20-sd
/etc/hotplug.d/iface/20-autossh
/etc/hotplug.d/iface/30-usb
/etc/hotplug.d/usb/30-fix_wifi
/etc/hotplug.d/usb/30-sd
/etc/init.d/atd
/etc/init.d/autossh
/etc/init.d/cc-client
/etc/init.d/dnsmasq
/etc/init.d/php7-fpm
/etc/init.d/pineapd
/etc/init.d/pineapple
/etc/init.d/resetssids
/etc/nginx/nginx.conf
/etc/opkg
/etc/php7-fpm.d/www.conf
/etc/pineape
/etc/pineapple
/etc/rc.button/BTN_1
/etc/rc.button/reset
/etc/rc.d/S90resetssids
/etc/rc.d/S98pineapple
/etc/rc.d/S99cc-client
/etc/rc.d/S99pineapd
/etc/ssh/sshd_config
/etc/ssl/openssl.cnf
/etc/uci-defaults/90-firewall.sh
/etc/uci-defaults/91-fstab.sh
/etc/uci-defaults/92-system.sh
/etc/uci-defaults/93-pineap.sh
/etc/uci-defaults/94-reporting.sh
/etc/uci-defaults/95-network.sh
/etc/uci-defaults/96-landingpage.sh
/etc/uci-defaults/97-pineapple.sh
/etc/banner
/etc/inittab
/etc/opkg.conf
/etc/php.ini
/etc/php7-fpm.conf
/etc/rc.local
/etc/shadow
/lib/preinit/30_failsafe_wait
/lib/preinit/40_run_failsafe_hook
/lib/upgrade/keep.d/busybox
/lib/wifi/mac80211.sh
/pineapple
/sbin/fdisk
/sbin/led
/usr/bin/pineapple
/usr/bin/aircrack-ng
/usr/bin/pineap
/usr/bin/uuencode
/usr/lib/libaircrack-ce-wpa-1.5.2.so
/usr/lib/libaircrack-ce-wpa.la
/usr/lib/libaircrack-ce-wpa.so
/usr/lib/libaircrack-osdep-1.5.2.so
/usr/lib/libaircrack-osdep.la
/usr/lib/libaircrack-osdep.so
/usr/lib/libprotobuf-lite.so
/usr/lib/libprotobuf-lite.so.15
/usr/lib/libprotobuf-lite.so.15.0.1
/usr/lib/libwifi.so
/usr/sbin/aireplay-ng
/usr/sbin/airmon-ng
/usr/sbin/airodump-ng
/usr/sbin/airodump-ng-oui-update
/usr/sbin/C2CONNECT
/usr/sbin/C2DISCONNECT
/usr/sbin/C2EXFIL
/usr/sbin/cc-client
/usr/sbin/http_sniffer
/usr/sbin/log_daemon
/usr/sbin/pineapd
/usr/sbin/resetssids
/wwwCreate a new folder called "overlay" (in my case) and copy all the folders/directories and files above inside. It's time to build our own firmware. In order to respect as much as possible comparing the original firmware, I will download the OpenWrt image builder using version 19.07.2.
wget https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64.tar.xz
tar xJf openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64.tar.xzEverything is good so far, and it is almost possible to build our firmware. However, before we do that we have to do four things.
The first thing is that we need the list of all packages (opkg) pre-installed in the WiFi Pineapple firmware to include them in our custom firmware and make the overlay files work. The second thing to do is to replace 3 files (/lib/netifd/wireless/mac80211.sh, /lib/netifd/hostapd.sh and /lib/wifi/mac80211.sh) that are specific to the Tetra device with the one we want to flash. Let's say the WZR-HP-G450H for this example. The third thing to do is to replace the hash for the root user by a hash defined by myself. This will be useful later to SSH to the router once the firmware is installed just in case we need to debug at a later time. The last thing to do is to bypass the limitation device space by adding a script which will mount the USB key at startup to have more storage space.
1 - Get the packages list (usr/lib/opkg/status):
cat _tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_root.extracted/squashfs-root/usr/lib/opkg/status | grep -e Package:
Package: procps-ng-pkill
Package: kmod-usb-storage
Package: terminfo
Package: iwinfo
Package: openssh-sftp-server
Package: tcpdump-mini
Package: libc
Package: php7-mod-openssl
Package: libbz2-1.0
Package: kmod-usb-net-asix-ax88179
Package: opkg
Package: wget
Package: kmod-usb-core
Package: libpthread
Package: ubus
Package: iw
Package: kmod-crypto-manager
Package: kmod-crypto-pcompress
Package: libuci20130104
Package: busybox
Package: pineap
Package: chat
Package: kmod-rtl8187
Package: kmod-crypto-hash
Package: kmod-nf-reject6
Package: protobuf-lite
Package: nano
Package: kmod-crypto-aead
Package: kmod-usb-wdm
Package: bash
Package: kmod-rt2800-usb
Package: openssl-util
Package: kmod-nf-flow
Package: kmod-lib-crc-ccitt
Package: kmod-rtlwifi
Package: kmod-mt76-usb
Package: getrandom
Package: openssh-server
Package: rtl8192cu-firmware
Package: ssmtp
Package: libusb-1.0-0
Package: kmod-nf-nathelper
Package: kmod-pppoe
Package: kmod-rt2x00-usb
Package: libuuid1
Package: libiconv-full2
Package: procps-ng-ps
Package: kmod-pppox
Package: kmod-ipt-conntrack
Package: kmod-nf-reject
Package: base-files
Package: kmod-lib-crc16
Package: kmod-nf-nat
Package: php7-cgi
Package: libpcre
Package: kmod-crypto-crc32c
Package: macchanger
Package: kmod-rt2800-lib
Package: php7-mod-sockets
Package: netifd
Package: php7-mod-hash
Package: libnl-route200
Package: kmod-usb-serial-pl2303
Package: autossh
Package: python-light
Package: resetssids
Package: uboot-envtools
Package: kmod-usb-ohci
Package: kmod-mii
Package: dnsmasq
Package: procd
Package: libuclient20160123
Package: usbutils
Package: ubusd
Package: libnl200
Package: kmod-rt2x00-lib
Package: hostapd-utils
Package: libelf1
Package: kmod-usb-ehci
Package: python-base
Package: libxtables12
Package: libiwinfo20181126
Package: kmod-usb-net-rndis
Package: libmbedtls12
Package: block-mount
Package: kmod-fs-vfat
Package: kmod-usb2
Package: firewall
Package: libxml2
Package: kmod-nf-ipt
Package: libblkid1
Package: kmod-rtlwifi-usb
Package: libsqlite3-0
Package: ubi-utils
Package: php7-mod-mbstring
Package: kmod-ip6tables
Package: fstools
Package: uclient-fetch
Package: kmod-ath9k
Package: ethtool
Package: uci
Package: kmod-fs-ext4
Package: kmod-mt76x2-common
Package: libip4tc2
Package: libubox20191228
Package: rt2800-usb-firmware
Package: kmod-ledtrig-timer
Package: php7-mod-json
Package: kmod-usb-net-asix
Package: kmod-nls-utf8
Package: libgmp10
Package: zoneinfo-core
Package: kmod-nls-cp437
Package: mtd
Package: wpad
Package: aircrack-ng-hak5
Package: usb-modeswitch
Package: php7-mod-session
Package: urandom-seed
Package: libffi
Package: libcomerr0
Package: ppp
Package: kmod-leds-gpio
Package: kmod-gpio-button-hotplug
Package: logd
Package: rtl-sdr
Package: libreadline8
Package: kmod-usb-net
Package: kmod-mt76x02-common
Package: kmod-rtl8192c-common
Package: librt
Package: kmod-mac80211
Package: libopenssl1.1
Package: kmod-usb-serial
Package: kmod-dnsresolver
Package: openssh-keygen
Package: libjson-script
Package: python-sqlite3
Package: kmod-rtl8192cu
Package: uclibcxx
Package: libblobmsg-json
Package: libip6tc2
Package: iptables
Package: openwrt-keyring
Package: ath9k-htc-firmware
Package: kmod-mt76x02-usb
Package: libnl-core200
Package: kmod-libphy
Package: kmod-mt76x2u
Package: libext2fs2
Package: jshn
Package: kmod-ipt-core
Package: e2fsprogs
Package: kmod-ledtrig-default-on
Package: kmod-usb-acm
Package: ca-certificates
Package: kmod-ppp
Package: libopenssl-conf
Package: php7-fpm
Package: libncurses6
Package: librtlsdr
Package: netcat
Package: kmod-crypto-null
Package: libpcap1
Package: libss2
Package: libjson-c2
Package: python-openssl
Package: kmod-nf-conntrack
Package: php7
Package: libcurl4
Package: kmod-fs-nfs
Package: usign
Package: ip6tables
Package: http_sniffer
Package: zlib
Package: kmod-nf-ipt6
Package: ca-bundle
Package: log_daemon
Package: at
Package: python-logging
Package: procps-ng
Package: kmod-nls-iso8859-1
Package: ncat
Package: kmod-nf-conntrack6
Package: kmod-scsi-generic
Package: libgcc1
Package: kmod-usb-ledtrig-usbport
Package: kmod-usb-uhci
Package: libstdcpp6
Package: kmod-ath
Package: kmod-mt76-core
Package: ubox
Package: kernel
Package: libnl-tiny
Package: kmod-ath9k-htc
Package: libwifi
Package: openssh-client
Package: usbreset
Package: libubus20191227
Package: kmod-fs-nfs-common
Package: libltdl7
Package: php7-mod-sqlite3
Package: libatomic1
Package: kmod-usb-storage-extras
Package: kmod-nls-base
Package: libgdbm
Package: cc-client
Package: fwtool
Package: jsonfilter
Package: libnl-nf200
Package: hostapd-common
Package: kmod-eeprom-93cx6
Package: wireless-tools
Package: kmod-ipt-offload
Package: kmod-ath9k-common
Package: kmod-usb-net-cdc-ether
Package: wireless-regdb
Package: kmod-scsi-core
Package: urngd
Package: kmod-slhc
Package: libnet-1.2.x
Package: kmod-cfg80211
Package: nginx
Package: libustream-mbedtls20150806
Package: ppp-mod-pppoe
Package: kmod-lib-crc-itu-t
Package: kmod-ipt-nat
Package: libnl-genl200
Package: kmod-ledtrig-netdev
Let's copy the output somewhere since we will need this later.
2 - I will download the OpenWrt image of my router (version 19.07.2), unpack-it, and copy the 3 files /lib/netifd/wireless/mac80211.sh, /lib/netifd/hostapd.sh and /lib/wifi/mac80211.sh in the folder/directory i named "overlay".
wget https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin -O wzr-hp-g450h.bin && binwalk -eM wzr-hp-g450h.bin
--2021-11-06 21:45:15-- https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin
Resolving downloads.openwrt.org (downloads.openwrt.org)... 168.119.138.211, 2a01:4f8:251:321::2
Connecting to downloads.openwrt.org (downloads.openwrt.org)|168.119.138.211|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4128772 (3.9M) [application/octet-stream]
Saving to: ‘wzr-hp-g450h.bin’
wzr-hp-g450h.bin 100%[======================================================================================================>] 3.94M 144KB/s in 24s
2021-11-06 21:45:41 (166 KB/s) - ‘wzr-hp-g450h.bin’ saved [4128772/4128772]
Scan Time: 2021-11-06 21:45:42
Target File: /home/yoda/Downloads/wzr-hp-g450h.bin
MD5 Checksum: ae35327223114c1595d17c6fdebdcfcc
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x1D26185B, created: 2020-02-27 21:05:12, image size: 1586206 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x677FDD55, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.14.171"
64 0x40 LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 5050948 bytes
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly
WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
1586270 0x18345E Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2522858 bytes, 1172 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12
Scan Time: 2021-11-06 21:45:42
Target File: /home/yoda/Downloads/_wzr-hp-g450h.bin.extracted/40
MD5 Checksum: 242f879c4eb348ab14aa45837926c39e
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
4128736 0x3EFFE0 CRC32 polynomial table, big endian
4155760 0x3F6970 eCos RTOS string reference: "ecoscentric,redboot-fis-partitions"
4183981 0x3FD7AD Certificate in DER format (x509 v3), header length: 4, sequence length: 16512
4227276 0x4080CC Ubiquiti firmware header, header size: 264 bytes, ~CRC32: 0x302D6862, version: "-RSPRO"
4340172 0x4239CC xz compressed data
4363980 0x4296CC Unix path: /lib/firmware/updates/4.14.171
4398681 0x431E59 Neighborly text, "neighbor table overflow!tics"
4418408 0x436B68 Neighborly text, "NeighborSolicitsports"
4418428 0x436B7C Neighborly text, "NeighborAdvertisements"
4421478 0x437766 Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
4771840 0x48D000 ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5046144 0x4CFF80 ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5046260 0x4CFFF4 ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5046384 0x4D0070 ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5046500 0x4D00E4 ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
Scan Time: 2021-11-06 21:45:44
Target File: /home/yoda/Downloads/_wzr-hp-g450h.bin.extracted/_40.extracted/console
MD5 Checksum: d41d8cd98f00b204e9800998ecf8427e
Signatures: 391
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/netifd/wireless/mac80211.sh overlay/lib/netifd/wireless/mac80211.sh
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/netifd/hostapd.sh overlay/lib/netifd/hostapd.sh
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/wifi/mac80211.sh overlay/lib/wifi/mac80211.sh3 - I will generate my own hash and then modify the existing one in /etc/shadow for the root user:
Note: In my example I've defined root as password.
cat overlay/etc/shadow
root:$1$DhqYuxhs$p/O7aro1npF4yvkRT7qJK.:16786:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::
echo 'root' | openssl passwd -1 -stdin
$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1
sed -i.sedbackup 's/^\(root:\)[^:]*\(:.*\)$/\1$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1\2/' overlay/etc/shadow
cat overlay/etc/shadow
root:$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1:16786:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::
4 - I will use a modified version of the script /etc/hotplug.d/block/20-sd which is normally used by the WiFi Pineapple Nano to mount the micro SD during the boot process and also give more memory to the device. Since my router doesn't have any SD port, I will use the USB port instead.
#!/bin/bash
device=`basename $DEVPATH`
devNum=$(echo $device | awk -F "" '{print $4}')
[[ $ACTION == "add" ]] && {
mkdir -p /dev/sdcard
mkdir -p /sd
[[ $devNum == "" ]] && {
rm -rf /dev/sdcard/sd
ln -s /dev/$device /dev/sdcard/sd
} || {
rm -rf /dev/sdcard/sd$devNum
ln -s /dev/$device /dev/sdcard/sd$devNum
[[ $devNum == "1" ]] && {
logger "Add USB key as SD"
umount /sd
mount /dev/sdcard/sd$devNum /sd && {
[[ -e "/sd/etc" ]] || {
sleep 5
ln -s /etc/ /sd/etc
}
}
if [[ -e "/sd/modules/" ]]; then
logger "Link modules in /sd/modules/"
for module in `ls /sd/modules/`; do
if [[ ! -d "/pineapple/modules/$module" ]]; then
ln -s /sd/modules/$module /pineapple/modules/$module
fi
done
fi
if [[ ! -f "/sd/usr/lib/python2.7/encodings/__init__.pyc" ]]; then
logger "Add extra packages here"
opkg update && opkg --dest sd install python-logging python-openssl python-sqlite3 python-codecs && python -m compileall
fi
}
[[ $devNum == "2" ]] && {
logger "Add swap"
swapoff /dev/sdcard/sd$devNum
swapon /dev/sdcard/sd$devNum
}
}
}
[[ $ACTION == "remove" ]] && {
[[ $devNum == "" ]] && {
umount /sd
rm -rf /dev/sdcard/sd
}
[[ $devNum == "1" ]] && {
rm -rf /dev/sdcard/sd$devNum
}
[[ $devNum == "2" ]] && {
swapoff /dev/sdcard/sd$devNum
}
}
Copy this script above and replace it with the existing one in overlays/etc/hotplug.d/block/20-sd. Also, you may have noticed the presence of an additional package install command on line 38. This is because the original WiFi Pineapple firmware contains so many packages per-install that it is impossible to put everything in our firmware. 32 MB is too small compare to 2 GB for the Tetra. Therefore, If during the firmware compilation you get the error "file-system partition too big", you will have to remove some packages from the compilation command to add them in this file. They will be automatically installed on the USB key the first time the router will boot.
Ok, now we have everything we need to compile our firmware.
cd openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64
sudo make image PROFILE=WZRHPG450H PACKAGES="at autossh base-files bash block-mount ca-certificates chat dnsmasq e2fsprogs ethtool firewall hostapd-utils ip6tables iwinfo kmod-ath kmod-ath9k kmod-ath9k-htc kmod-crypto-manager kmod-fs-ext4 kmod-fs-nfs kmod-fs-vfat kmod-gpio-button-hotplug kmod-ipt-offload kmod-leds-gpio kmod-ledtrig-default-on kmod-ledtrig-netdev kmod-ledtrig-timer kmod-lib-crc-itu-t kmod-mt76x2u kmod-nf-nathelper kmod-rt2800-usb kmod-rtl8187 kmod-rtl8192cu kmod-scsi-generic kmod-usb-acm kmod-usb-ledtrig-usbport kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rndis kmod-usb-ohci kmod-usb-serial-pl2303 kmod-usb-storage-extras kmod-usb-uhci kmod-usb-wdm kmod-usb2 libbz2-1.0 libcurl4 libelf1 libffi libgdbm libgmp10 libiconv-full2 libltdl7 libnet-1.2.x libnl200 libustream-mbedtls20150806 libxml2 logd macchanger mtd nano ncat netcat nginx openssh-client openssh-server openssh-sftp-server openssl-util php7-cgi php7-fpm php7-mod-hash php7-mod-json php7-mod-mbstring php7-mod-openssl php7-mod-session php7-mod-sockets php7-mod-sqlite3 ppp ppp-mod-pppoe procps-ng-pkill procps-ng-ps rtl-sdr ssmtp tcpdump-mini uboot-envtools uci uclibcxx uclient-fetch urandom-seed urngd usb-modeswitch usbreset usbutils wget wireless-tools wpad busybox libatomic1 libstdcpp6 libubus20191227 -wpad-basic -dropbear" FILES=../overlay/
If you want to see all of the available profiles, the command is:
sudo make infoAnd again, as I explained above, if you get the error "file-system partition too big", remove some packages from the make image command and add them in the script overlay/etc/hotplug.d/block/20-sd then try again.
If everything went well, the output for the firmware compilation should be something like this:
Building images...
24+1 records in
25+0 records out
1638400 bytes (1.6 MB, 1.6 MiB) copied, 0.0193714 s, 84.6 MB/s
Image Name: MIPS OpenWrt Linux-4.14.171
Created: Sun Nov 7 09:24:14 2021
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1586152 Bytes = 1548.98 KiB = 1.51 MiB
Load Address: 80060000
Entry Point: 80060000
Parallel mksquashfs: Using 1 processor
Creating 4.0 filesystem on /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs, block size 262144.
Pseudo file "/dev" exists in source filesystem "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/root-ar71xx/dev".
Ignoring, exclude it (-e/-ef) to override.
[=========================================================================================================================\] 2010/2010 100%
Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
compressed data, compressed metadata, compressed fragments,
no xattrs, compressed ids
duplicates are removed
Filesystem size 13423.49 Kbytes (13.11 Mbytes)
32.32% of uncompressed filesystem size (41536.29 Kbytes)
Inode table size 19146 bytes (18.70 Kbytes)
22.31% of uncompressed inode table size (85815 bytes)
Directory table size 24610 bytes (24.03 Kbytes)
44.17% of uncompressed directory table size (55717 bytes)
Number of duplicate files found 243
Number of inodes 2516
Number of files 1940
Number of fragments 77
Number of symbolic links 412
Number of device nodes 1
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 163
Number of ids (unique uids + gids) 1
Number of uids 1
unknown (0)
Number of gids 1
unknown (0)
padding image to 00d20000
padding image to 00d1c000
padding image to 00d20000
padding image to 00d40000
106+1 records in
107+0 records out
14024704 bytes (14 MB, 13 MiB) copied, 0.0473437 s, 296 MB/s
make[4]: Entering directory '/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/target/linux/ar71xx/image'
cp /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/vmlinux /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h
/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/staging_dir/host/bin/patch-cmdline /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h "board=WZR-HP-G450H console=ttyS0,115200"
search space used is default of 16KB
/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/staging_dir/host/bin/lzma e /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h -lc1 -lp2 -pb2 /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.bin.lzma
mkimage -A mips -O linux -T kernel -a 0x80060000 -C lzma -e 0x80060000 -n 'MIPS OpenWrt Linux-4.14.171' -d /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.bin.lzma /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage
Image Name: MIPS OpenWrt Linux-4.14.171
Created: Sun Nov 7 09:24:25 2021
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1586206 Bytes = 1549.03 KiB = 1.51 MiB
Load Address: 80060000
Entry Point: 80060000
if [ 0 -eq 0 ]; then filename="/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw"; fstype=${filename##*\.}; case "${fstype}" in *) bs=`stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage`;; esac; ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=${bs} conv=sync; cat /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; if [ -n "64" ]; then case "${fstype}" in squashfs*) padjffs2 /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin 64; ;; esac; fi; if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin is too big (> $((33095680-4*64*1024)) bytes)" >&2; rm -f /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; else if [ 0 -gt 262144 ]; then if [ `stat -c%s "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage"` -gt 0 ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage is too big (> 0 bytes)" >&2; else if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw is too big (> $((33095680-4*64*1024)) bytes)" >&2; else ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=0 conv=sync; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; fi; else ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=0 conv=sync; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin is too big (> $((33095680-4*64*1024)) bytes)" >&2; rm -f /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; fi; fi
1+0 records in
1+0 records out
1586270 bytes (1.6 MB, 1.5 MiB) copied, 0.00191968 s, 826 MB/s
padding image to 00ea0000
if [ -e "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin" ]; then ( echo -n -e "# Airstation Public Fmt1\x00\x00\x00\x00\x00\x00\x00\x00"; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-tftp.bin; buffalo-enc -p WZR-HP-AG450H -v 1.99 -i /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin -o /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/wzr-hp-g450h.enc; buffalo-tag -b WZR-HP-AG450H -p WZR-HP-AG450H -a ath -v 1.99 -m 1.01 -l mlang8 -w 3 -c 0x80041000 -d 0x801e8000 -f 1 -r M_ -i /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/wzr-hp-g450h.enc -o /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-factory.bin; fi
29952+1 records in
29952+1 records out
15335428 bytes (15 MB, 15 MiB) copied, 0.074174 s, 207 MB/s
make[4]: Leaving directory '/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/target/linux/ar71xx/image'
Calculating checksums...
We can find our new firmware under openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic
If you reached this step, congratulations! you've just cloned the original WiFi Pineapple Tetra firmware but specifically designed it for your router!
Installation
Now I'm going to send and install my new sysupgrade firmware in my router, but first make sure your router has an original OpenWrt (version 19.07.2 preferred) already install on it. For example, in my case Buffalo does not integrate at all with OpenWrt by default, so the official OpenWrt website is your friend. The next thing to do is to plug a USB key in which has at least 2 GB in the USB port of your router.
scp openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin [email protected]:/tmp/
openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin 100% 15MB 1.4MB/s 00:10
ssh [email protected]
BusyBox v1.30.1 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 19.07.2, r10947-65030d81f3
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# cd /tmp
root@OpenWrt:/tmp# sysupgrade -n -F openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin
Image metadata not found
Image check failed but --force given - will update anyway!
Cannot save config while running from ramdisk.
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.
Wait for 2~3 minutes, then connect to http://172.16.42.1:1471 to configure the WiFi Pineapple Tetra custom Buffalo!
You can also SSH to the WiFi Pineapple.
ssh [email protected]
[email protected]'s password:
BusyBox v1.30.1 () built-in shell (ash)
.NN,
.cxxdl' xMMO 'cdxxl'
.c0WMNk;,NMMW:,xXMMKo.
...:KMMMWMMMMWMMMXc... .
, .l0NMMMNXMMMMMMMMMMMMXNMMMWKl' xWd
,0Wd .':xNMMMMMMMMMMMMMMMMNkc'. ;KM0'
lWMo .;dNMMMMMMMMMMMMMMWx:. .l. dMWc
:WWo oNd .;xKWMMMMMMMMMMMMMMMMMMMMWXx:. dWX: dMW;
,NWo oMW: .. ..,lOXWMMMMMMMMMMWN0o;.. .. cWMl dMN'
.XMx oWN; lc .loooolcooclooool. cXl oMWc kMK.
oMW' ,WMl cMW: lWMW0d:;cdd:;:o0WMWl lMW: OMW' ,WMl
0M0 xMX. .XMd .lo:.,dXMMMMMMXd,.:ol. kMK. 'NMd KMO
NMd KMk lMN. .;:xOxollccddcclloxOx:;. 'WM: OM0 xMX
WMo .XMx dMK oNMMMMWOc;;ol;;cOWMMMMNo .XMl kMK dMN
NMx 0MO :Kd. .lllcl;.:0WMMMMW0:.;lclll. .xK; 0MO kMX
__ ___ ______ _ _____ _.:W0;,oxl:::oOOo:::lxo,;0W: _ .ONo KMk
\ \ / (_| ____(_) | __ (_);cKMMMMWk:.;,.;kWMMMMKc;. | | .OX:
\ \ /\ / / _| |__ _ | |__) _ _ __ ___ __ _ _ __ _ __ | | ___ TETRA
\ \/ \/ / | | __| | | | ___| | '_ \ / _ \/ _` | '_ \| '_ \| |/ _ \ 2.7.0
\ /\ / | | | | | | | | | | | | __| (_| | |_) | |_) | | __/
\/ \/ |_|_| |_| |_| |_|_| |_|\___|\__,_| .__/| .__/|_|\___|
With OpenWRT 19.07.2 | | | |
--------------------- |_| |_|
root@Pineapple:~# I can't tell you how happy I was to be able to install the WiFi Pineapple firmware on a random router on my own...
Now I'm going to explore the different possibilities that the WiFi Pineapple offers. Especially the module section since I saw a module that talks about HackRF as I just received mine few days ago!
Anyway, as usual, thanks for reading! 🙂
[UPDATE 8/15/2022]
After receiving many of your messages regarding difficulties on how to build the firmware, I would like to officially announce that i have added to my GitHub a tool that automates the entire process of building the firmware image from start to finish!
It's pretty cool right?
GitLab repository:
Sweet WiFi Pineapple Tetra Builder supports the following router so far:
I hope you enjoyed reading my article! If you did, you might also like this one: Learn how to make your own Shark Jack network attack device.
https://samy.link/blog/jabberjaw-convert-your-router-in-portable-network-attack-dev
If you liked it, please follow me on my twitter as well! @0xSamy_