Build Your Own WiFi Pineapple Tetra for $7!

Let's talk about the WiFi Pineapple! This little gem normally sells for about $99 that allows cybercriminals pentesters to capture data shared on public WiFi networks. I've been hesitating to buy one for a few weeks now. After buying a Rubber Ducky on hak5's website, my attention was quickly caught up by all the little technology jewels that they also offered on their website. I couldn't get my eye off of the Lan Turtle, the Key Kroc, the Shark Jack, and so many other cool items. I didn't know from where to start or which ones I should buy! I was like a little kid in a candy shop. Especially when you are working in the cyber security industry, this website is like Santa's bag, let me tell you!

Evil Portal, Fake HTTPS, Man-In-The-Middle attack... I have myself experienced many of the features offered by WiFi Pineapple in the past, but only in a manual way using a laptop with a WiFi adapter. The WiFi Pineapple is meant to be easy to use by gathering in a web interface all the features for WiFi testing and auditing, especially to see if WiFi networks are vulnerable to WiFi hackers.

— WiFi Pineapple Tetra Mark VII

As I often do before buying something, I did some research on the product. I learned that the WiFi Pineapple is based on OpenWrt, a Linux based firmware for embedded devices but with a graphic overlay and some open-source security tools pre-installed in the router. I then started to think that it could be possible to replicate this on any other router.

Let's try! The first thing to do is to download the latest version of WiFi Pineapple Tetra.

wget https://www.wifipineapple.com/downloads/tetra/latest -O tetrafw.bin                                                                                                     
--2021-11-06 18:49:43--  https://www.wifipineapple.com/downloads/tetra/latest
Resolving www.wifipineapple.com (www.wifipineapple.com)... 172.67.137.197, 104.21.46.105, 2606:4700:3037::6815:2e69, ...
Connecting to www.wifipineapple.com (www.wifipineapple.com)|172.67.137.197|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘tetrafw.bin’

tetrafw.bin                                         [                           <=>                                                                         ]  30.51M  6.65MB/s    in 5.8s    

2021-11-06 18:49:49 (5.30 MB/s) - ‘tetrafw.bin’ saved [31989793]

Once the firmware downloads successfully, I de-compile it to explore the content and try to find what is inside the classic OpenWrt firmware.  To unpack the firmware, I will use the tool binwalk.

binwalk -eM tetrafw.bin                                                                                                                                                    

Scan Time:     2021-11-06 18:56:37
Target File:   /home/yoda/tetrafw.bin
MD5 Checksum:  6cc58d0ca85cf9a025a257890b73532c
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             POSIX tar archive (GNU), owner user name: "de-pineapple-tetra/"


Scan Time:     2021-11-06 18:56:38
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/kernel
MD5 Checksum:  11a7c4122eefbc1187d1fde8d5e5bc9f
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: 5365292 bytes


Scan Time:     2021-11-06 18:56:38
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/CONTROL
MD5 Checksum:  77a3bbf6768daae74a3e346282d270eb
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------


Scan Time:     2021-11-06 18:56:38
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/root
MD5 Checksum:  dbeec16d73770b49b7fcfafd721f28e0
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 13757048 bytes, 2553 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12


Scan Time:     2021-11-06 18:56:39
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/kernel
MD5 Checksum:  11a7c4122eefbc1187d1fde8d5e5bc9f
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: 5365292 bytes


Scan Time:     2021-11-06 18:56:40
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/CONTROL
MD5 Checksum:  00ed91cb41aa4d08fe228e06816264e6
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------


Scan Time:     2021-11-06 18:56:40
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/root
MD5 Checksum:  dbeec16d73770b49b7fcfafd721f28e0
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 13757048 bytes, 2553 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12


Scan Time:     2021-11-06 18:56:40
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_kernel.extracted/40
MD5 Checksum:  fbda25f0448f6d23f8f0f210d007397b
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
4181472       0x3FCDE0        CRC32 polynomial table, big endian
4222725       0x406F05        Certificate in DER format (x509 v3), header length: 4, sequence length: 21632
4790800       0x491A10        xz compressed data
4813916       0x49745C        Unix path: /lib/firmware/updates/4.14.171
4854481       0x4A12D1        Neighborly text, "neighbor table overflow!tics"
4873372       0x4A5C9C        Neighborly text, "NeighborSolicitsports"
4873392       0x4A5CB0        Neighborly text, "NeighborAdvertisements"
4876310       0x4A6816        Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
5185536       0x4F2000        ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5364536       0x51DB38        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5364652       0x51DBAC        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5364776       0x51DC28        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5364892       0x51DC9C        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"


Scan Time:     2021-11-06 18:56:42
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/_kernel.extracted/40
MD5 Checksum:  fbda25f0448f6d23f8f0f210d007397b
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
4181472       0x3FCDE0        CRC32 polynomial table, big endian
4222725       0x406F05        Certificate in DER format (x509 v3), header length: 4, sequence length: 21632
4790800       0x491A10        xz compressed data
4813916       0x49745C        Unix path: /lib/firmware/updates/4.14.171
4854481       0x4A12D1        Neighborly text, "neighbor table overflow!tics"
4873372       0x4A5C9C        Neighborly text, "NeighborSolicitsports"
4873392       0x4A5CB0        Neighborly text, "NeighborAdvertisements"
4876310       0x4A6816        Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
5185536       0x4F2000        ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5364536       0x51DB38        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5364652       0x51DBAC        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5364776       0x51DC28        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5364892       0x51DC9C        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"


Scan Time:     2021-11-06 18:56:44
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_kernel.extracted/_40.extracted/console
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------


Scan Time:     2021-11-06 18:56:44
Target File:   /home/yoda/_tetrafw.bin.extracted/sysupgrade-tetra/_kernel.extracted/_40.extracted/console
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

Now we can see all directories that are a part of the squashfs-root partition.

ll _tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_root.extracted/squashfs-root/                                                                                         
 inode Permissions Links Size Blocks User Group Date Modified Name
648479 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  bin/
648480 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  dev/
648485 drwxr-xr-x     24    -      - yoda yoda  28 Feb  2020  etc/
745968 drwxr-xr-x     11    -      - yoda yoda  11 Aug  2019  lib/
648596 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  mnt/
746242 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  overlay/
746246 drwxr-xr-x      8    -      - yoda yoda  28 Feb  2020  pineapple/
746315 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  proc/
746316 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  rom/
746317 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  root/
746318 drwxr-xr-x      2    -      - yoda yoda  11 Aug  2019  sbin/
746319 drwxr-xr-x      2    -      - yoda yoda  28 Feb  2020  sys/
746320 drwxrwxrwt      2    -      - yoda yoda  28 Feb  2020  tmp/
746321 drwxr-xr-x      7    -      - yoda yoda  11 Aug  2019  usr/
648597 drwxr-xr-x      2    -      - yoda yoda  11 Aug  2019  www/
627573 lrwxrwxrwx      1    3      0 yoda yoda  28 Feb  2020  var -> tmp

After some time digging in the different directories, I found the file openwrt_release which gave me some interesting information about the composition of the firmware.

cat etc/openwrt_release                                                                                                                                                      
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='19.07.2'
DISTRIB_REVISION='r10947-65030d81f3'
DISTRIB_TARGET='ar71xx/nand'
DISTRIB_ARCH='mips_24kc'
DISTRIB_DESCRIPTION='OpenWrt 19.07.2 r10947-65030d81f3'
DISTRIB_TAINTS='no-all busybox'

So what does this file tell us?

Well, we can see that it uses OpenWrt 19.07.2 (a bit outdated now) but the most important thing we found was that the WiFi Pineapple uses the mips_24kc architecture! Therefore it is possible that if the same conditions are met, we can install the firmware on another device using the same architecture.

After a quick research on Google, I found the list of all routers using the mips_24kc architecture. https://openwrt.org/docs/techref/instructionset/mips_24kc

So many potential candidates! As I didn't have any of these routers on hand, I checked on a second hand shop to see if there were any routers from this list available. To my surprise, I found that there were many Buffalo routers available for around ¥800, or around $7 USD. So I decided to buy not one or two, but three routers from this list 😁


WiFi Pineapple TETRA Buffalo WZR-HP-G450H Buffalo WZR-HP-AG300H TP-Link Archer C7 v4
CPU Atheros AR9344 Atheros AR7242 Atheros AR7161 Atheros QCA9563
CPU MHz 533 MHz 400 MHz 680 MHz 775 MHz
Flash MB/GB 2 GB 32 MB 32 MB 16 MB
RAM MB 64 MB 64 MB 128 MB 128 MB
Price ($) $99 $7 (¥800) $8 (¥900) $13 (¥1500)

What do you think? When we quickly compare them, we can see that except for the 2GB of memory, the other routers have nothing special compared to the WiFi Pineapple. Since all routers are equipped with USB port(s), it is possible to insert a USB key to fill in the difference of memory. Therefore, a USB key of at least 2GB will be required to install the WiFi Pineapple in one of these routers.

Clone the Firmware and Make it Yours.

The idea is simple. In order to make the official WiFi Pineapple firmware work with a different router, I will have to build my own OpenWrt firmware specially designed for it and at the same time include the overlay "Pineapple".

The first step is to find all the files specific to the WiFi Pineapple firmware. After some long and tedious work, here is the list:

/bin/bash
/bin/busybox
/etc/config/autossh
/etc/hotplug.d/block/20-sd
/etc/hotplug.d/iface/20-autossh
/etc/hotplug.d/iface/30-usb
/etc/hotplug.d/usb/30-fix_wifi
/etc/hotplug.d/usb/30-sd
/etc/init.d/atd
/etc/init.d/autossh
/etc/init.d/cc-client
/etc/init.d/dnsmasq
/etc/init.d/php7-fpm
/etc/init.d/pineapd
/etc/init.d/pineapple
/etc/init.d/resetssids
/etc/nginx/nginx.conf
/etc/opkg
/etc/php7-fpm.d/www.conf
/etc/pineape
/etc/pineapple
/etc/rc.button/BTN_1
/etc/rc.button/reset
/etc/rc.d/S90resetssids
/etc/rc.d/S98pineapple
/etc/rc.d/S99cc-client
/etc/rc.d/S99pineapd
/etc/ssh/sshd_config
/etc/ssl/openssl.cnf
/etc/uci-defaults/90-firewall.sh
/etc/uci-defaults/91-fstab.sh
/etc/uci-defaults/92-system.sh
/etc/uci-defaults/93-pineap.sh
/etc/uci-defaults/94-reporting.sh
/etc/uci-defaults/95-network.sh
/etc/uci-defaults/96-landingpage.sh
/etc/uci-defaults/97-pineapple.sh
/etc/banner
/etc/inittab
/etc/opkg.conf
/etc/php.ini
/etc/php7-fpm.conf
/etc/rc.local
/etc/shadow
/lib/preinit/30_failsafe_wait
/lib/preinit/40_run_failsafe_hook
/lib/upgrade/keep.d/busybox
/lib/wifi/mac80211.sh
/pineapple
/sbin/fdisk
/sbin/led
/usr/bin/pineapple
/usr/bin/aircrack-ng
/usr/bin/pineap
/usr/bin/uuencode
/usr/lib/libaircrack-ce-wpa-1.5.2.so
/usr/lib/libaircrack-ce-wpa.la
/usr/lib/libaircrack-ce-wpa.so
/usr/lib/libaircrack-osdep-1.5.2.so
/usr/lib/libaircrack-osdep.la
/usr/lib/libaircrack-osdep.so
/usr/lib/libprotobuf-lite.so
/usr/lib/libprotobuf-lite.so.15
/usr/lib/libprotobuf-lite.so.15.0.1
/usr/lib/libwifi.so
/usr/sbin/aireplay-ng
/usr/sbin/airmon-ng
/usr/sbin/airodump-ng
/usr/sbin/airodump-ng-oui-update
/usr/sbin/C2CONNECT
/usr/sbin/C2DISCONNECT
/usr/sbin/C2EXFIL
/usr/sbin/cc-client
/usr/sbin/http_sniffer
/usr/sbin/log_daemon
/usr/sbin/pineapd
/usr/sbin/resetssids
/www

Create a new folder called "overlay" (in my case) and copy all the folders/directories and files above inside. It's time to build our own firmware. In order to respect as much as possible comparing the original firmware, I will download the OpenWrt image builder using version 19.07.2.

wget https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64.tar.xz
tar xJf openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64.tar.xz

Everything is good so far, and it is almost possible to build our firmware. However, before we do that we have to do four things.

The first thing is that we need the list of all packages (opkg) pre-installed in the WiFi Pineapple firmware to include them in our custom firmware and make the overlay files work. The second thing to do is to replace 3 files (/lib/netifd/wireless/mac80211.sh, /lib/netifd/hostapd.sh and /lib/wifi/mac80211.sh) that are specific to the Tetra device with the one we want to flash. Let's say the WZR-HP-G450H for this example. The third thing to do is to replace the hash for the root user by a hash defined by myself. This will be useful later to SSH to the router once the firmware is installed just in case we need to debug at a later time. The last thing to do is to bypass the limitation device space by adding a script which will mount the USB key at startup to have more storage space.

1 - Get the packages list (usr/lib/opkg/status):

cat _tetrafw.bin.extracted/sysupgrade-pineapple-tetra/_root.extracted/squashfs-root/usr/lib/opkg/status | grep -e Package:                                                                                                                                   

Package: procps-ng-pkill
Package: kmod-usb-storage
Package: terminfo
Package: iwinfo
Package: openssh-sftp-server
Package: tcpdump-mini
Package: libc
Package: php7-mod-openssl
Package: libbz2-1.0
Package: kmod-usb-net-asix-ax88179
Package: opkg
Package: wget
Package: kmod-usb-core
Package: libpthread
Package: ubus
Package: iw
Package: kmod-crypto-manager
Package: kmod-crypto-pcompress
Package: libuci20130104
Package: busybox
Package: pineap
Package: chat
Package: kmod-rtl8187
Package: kmod-crypto-hash
Package: kmod-nf-reject6
Package: protobuf-lite
Package: nano
Package: kmod-crypto-aead
Package: kmod-usb-wdm
Package: bash
Package: kmod-rt2800-usb
Package: openssl-util
Package: kmod-nf-flow
Package: kmod-lib-crc-ccitt
Package: kmod-rtlwifi
Package: kmod-mt76-usb
Package: getrandom
Package: openssh-server
Package: rtl8192cu-firmware
Package: ssmtp
Package: libusb-1.0-0
Package: kmod-nf-nathelper
Package: kmod-pppoe
Package: kmod-rt2x00-usb
Package: libuuid1
Package: libiconv-full2
Package: procps-ng-ps
Package: kmod-pppox
Package: kmod-ipt-conntrack
Package: kmod-nf-reject
Package: base-files
Package: kmod-lib-crc16
Package: kmod-nf-nat
Package: php7-cgi
Package: libpcre
Package: kmod-crypto-crc32c
Package: macchanger
Package: kmod-rt2800-lib
Package: php7-mod-sockets
Package: netifd
Package: php7-mod-hash
Package: libnl-route200
Package: kmod-usb-serial-pl2303
Package: autossh
Package: python-light
Package: resetssids
Package: uboot-envtools
Package: kmod-usb-ohci
Package: kmod-mii
Package: dnsmasq
Package: procd
Package: libuclient20160123
Package: usbutils
Package: ubusd
Package: libnl200
Package: kmod-rt2x00-lib
Package: hostapd-utils
Package: libelf1
Package: kmod-usb-ehci
Package: python-base
Package: libxtables12
Package: libiwinfo20181126
Package: kmod-usb-net-rndis
Package: libmbedtls12
Package: block-mount
Package: kmod-fs-vfat
Package: kmod-usb2
Package: firewall
Package: libxml2
Package: kmod-nf-ipt
Package: libblkid1
Package: kmod-rtlwifi-usb
Package: libsqlite3-0
Package: ubi-utils
Package: php7-mod-mbstring
Package: kmod-ip6tables
Package: fstools
Package: uclient-fetch
Package: kmod-ath9k
Package: ethtool
Package: uci
Package: kmod-fs-ext4
Package: kmod-mt76x2-common
Package: libip4tc2
Package: libubox20191228
Package: rt2800-usb-firmware
Package: kmod-ledtrig-timer
Package: php7-mod-json
Package: kmod-usb-net-asix
Package: kmod-nls-utf8
Package: libgmp10
Package: zoneinfo-core
Package: kmod-nls-cp437
Package: mtd
Package: wpad
Package: aircrack-ng-hak5
Package: usb-modeswitch
Package: php7-mod-session
Package: urandom-seed
Package: libffi
Package: libcomerr0
Package: ppp
Package: kmod-leds-gpio
Package: kmod-gpio-button-hotplug
Package: logd
Package: rtl-sdr
Package: libreadline8
Package: kmod-usb-net
Package: kmod-mt76x02-common
Package: kmod-rtl8192c-common
Package: librt
Package: kmod-mac80211
Package: libopenssl1.1
Package: kmod-usb-serial
Package: kmod-dnsresolver
Package: openssh-keygen
Package: libjson-script
Package: python-sqlite3
Package: kmod-rtl8192cu
Package: uclibcxx
Package: libblobmsg-json
Package: libip6tc2
Package: iptables
Package: openwrt-keyring
Package: ath9k-htc-firmware
Package: kmod-mt76x02-usb
Package: libnl-core200
Package: kmod-libphy
Package: kmod-mt76x2u
Package: libext2fs2
Package: jshn
Package: kmod-ipt-core
Package: e2fsprogs
Package: kmod-ledtrig-default-on
Package: kmod-usb-acm
Package: ca-certificates
Package: kmod-ppp
Package: libopenssl-conf
Package: php7-fpm
Package: libncurses6
Package: librtlsdr
Package: netcat
Package: kmod-crypto-null
Package: libpcap1
Package: libss2
Package: libjson-c2
Package: python-openssl
Package: kmod-nf-conntrack
Package: php7
Package: libcurl4
Package: kmod-fs-nfs
Package: usign
Package: ip6tables
Package: http_sniffer
Package: zlib
Package: kmod-nf-ipt6
Package: ca-bundle
Package: log_daemon
Package: at
Package: python-logging
Package: procps-ng
Package: kmod-nls-iso8859-1
Package: ncat
Package: kmod-nf-conntrack6
Package: kmod-scsi-generic
Package: libgcc1
Package: kmod-usb-ledtrig-usbport
Package: kmod-usb-uhci
Package: libstdcpp6
Package: kmod-ath
Package: kmod-mt76-core
Package: ubox
Package: kernel
Package: libnl-tiny
Package: kmod-ath9k-htc
Package: libwifi
Package: openssh-client
Package: usbreset
Package: libubus20191227
Package: kmod-fs-nfs-common
Package: libltdl7
Package: php7-mod-sqlite3
Package: libatomic1
Package: kmod-usb-storage-extras
Package: kmod-nls-base
Package: libgdbm
Package: cc-client
Package: fwtool
Package: jsonfilter
Package: libnl-nf200
Package: hostapd-common
Package: kmod-eeprom-93cx6
Package: wireless-tools
Package: kmod-ipt-offload
Package: kmod-ath9k-common
Package: kmod-usb-net-cdc-ether
Package: wireless-regdb
Package: kmod-scsi-core
Package: urngd
Package: kmod-slhc
Package: libnet-1.2.x
Package: kmod-cfg80211
Package: nginx
Package: libustream-mbedtls20150806
Package: ppp-mod-pppoe
Package: kmod-lib-crc-itu-t
Package: kmod-ipt-nat
Package: libnl-genl200
Package: kmod-ledtrig-netdev

Let's copy the output somewhere since we will need this later.

2 - I will download the OpenWrt image of my router (version 19.07.2), unpack-it, and copy the 3 files /lib/netifd/wireless/mac80211.sh, /lib/netifd/hostapd.sh and /lib/wifi/mac80211.sh in the folder/directory i named "overlay".

wget https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin -O wzr-hp-g450h.bin && binwalk -eM wzr-hp-g450h.bin        
--2021-11-06 21:45:15--  https://downloads.openwrt.org/releases/19.07.2/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin
Resolving downloads.openwrt.org (downloads.openwrt.org)... 168.119.138.211, 2a01:4f8:251:321::2
Connecting to downloads.openwrt.org (downloads.openwrt.org)|168.119.138.211|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4128772 (3.9M) [application/octet-stream]
Saving to: ‘wzr-hp-g450h.bin’

wzr-hp-g450h.bin                                100%[======================================================================================================>]   3.94M   144KB/s    in 24s     

2021-11-06 21:45:41 (166 KB/s) - ‘wzr-hp-g450h.bin’ saved [4128772/4128772]


Scan Time:     2021-11-06 21:45:42
Target File:   /home/yoda/Downloads/wzr-hp-g450h.bin
MD5 Checksum:  ae35327223114c1595d17c6fdebdcfcc
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x1D26185B, created: 2020-02-27 21:05:12, image size: 1586206 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x677FDD55, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.14.171"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 5050948 bytes

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -le -d 'squashfs-root-0' '%e'' might not be installed correctly

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'': [Errno 2] No such file or directory: 'sasquatch', 'sasquatch -p 1 -be -d 'squashfs-root-0' '%e'' might not be installed correctly
1586270       0x18345E        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2522858 bytes, 1172 inodes, blocksize: 262144 bytes, created: 2020-02-27 21:05:12


Scan Time:     2021-11-06 21:45:42
Target File:   /home/yoda/Downloads/_wzr-hp-g450h.bin.extracted/40
MD5 Checksum:  242f879c4eb348ab14aa45837926c39e
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
4128736       0x3EFFE0        CRC32 polynomial table, big endian
4155760       0x3F6970        eCos RTOS string reference: "ecoscentric,redboot-fis-partitions"
4183981       0x3FD7AD        Certificate in DER format (x509 v3), header length: 4, sequence length: 16512
4227276       0x4080CC        Ubiquiti firmware header, header size: 264 bytes, ~CRC32: 0x302D6862, version: "-RSPRO"
4340172       0x4239CC        xz compressed data
4363980       0x4296CC        Unix path: /lib/firmware/updates/4.14.171
4398681       0x431E59        Neighborly text, "neighbor table overflow!tics"
4418408       0x436B68        Neighborly text, "NeighborSolicitsports"
4418428       0x436B7C        Neighborly text, "NeighborAdvertisements"
4421478       0x437766        Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
4771840       0x48D000        ELF, 32-bit MSB MIPS64 shared object, MIPS, version 1 (SYSV)
5046144       0x4CFF80        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5046260       0x4CFFF4        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5046384       0x4D0070        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5046500       0x4D00E4        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"


Scan Time:     2021-11-06 21:45:44
Target File:   /home/yoda/Downloads/_wzr-hp-g450h.bin.extracted/_40.extracted/console
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/netifd/wireless/mac80211.sh overlay/lib/netifd/wireless/mac80211.sh
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/netifd/hostapd.sh overlay/lib/netifd/hostapd.sh
cp _wzr-hp-g450h.bin.extracted/squashfs-root/lib/wifi/mac80211.sh overlay/lib/wifi/mac80211.sh

3 - I will generate my own hash and then modify the existing one in /etc/shadow for the root user:

Note: In my example I've defined root as password.

cat overlay/etc/shadow                                                                               
root:$1$DhqYuxhs$p/O7aro1npF4yvkRT7qJK.:16786:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::

echo 'root' | openssl passwd -1 -stdin                                                                                                                                      
$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1

sed -i.sedbackup 's/^\(root:\)[^:]*\(:.*\)$/\1$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1\2/' overlay/etc/shadow

cat overlay/etc/shadow
root:$1$YxFLPZho$24cgp7UqDzHVvzJWWJqvm1:16786:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::

4 - I will use a modified version of the script /etc/hotplug.d/block/20-sd which is normally used by the WiFi Pineapple Nano to mount the micro SD during the boot process and also give more memory to the device. Since my router doesn't have any SD port, I will use the USB port instead.

#!/bin/bash

device=`basename $DEVPATH`
devNum=$(echo $device | awk -F "" '{print $4}')

[[ $ACTION == "add" ]] && {
    mkdir -p /dev/sdcard
    mkdir -p /sd

    [[ $devNum == "" ]] && {
        rm -rf /dev/sdcard/sd
        ln -s /dev/$device /dev/sdcard/sd
    } || {
        rm -rf /dev/sdcard/sd$devNum
        ln -s /dev/$device /dev/sdcard/sd$devNum

        [[ $devNum == "1" ]] && {
            logger "Add USB key as SD"
            umount /sd
            mount /dev/sdcard/sd$devNum /sd && {
                [[ -e "/sd/etc" ]] || {
                    sleep 5
                    ln -s /etc/ /sd/etc
                }
            }

            if [[ -e "/sd/modules/" ]]; then
                logger "Link modules in /sd/modules/"
                for module in `ls /sd/modules/`; do
                    if [[ ! -d "/pineapple/modules/$module" ]]; then
                        ln -s /sd/modules/$module /pineapple/modules/$module
                    fi
                done
            fi

            if [[ ! -f "/sd/usr/lib/python2.7/encodings/__init__.pyc" ]]; then
                logger "Add extra packages here"
                opkg update && opkg --dest sd install python-logging python-openssl python-sqlite3 python-codecs && python -m compileall
            fi
        }

        [[ $devNum == "2" ]] && {
            logger "Add swap"
            swapoff /dev/sdcard/sd$devNum
            swapon /dev/sdcard/sd$devNum
        }
    }
}

[[ $ACTION == "remove" ]] && {
    [[ $devNum == "" ]] && {
        umount /sd
        rm -rf /dev/sdcard/sd
    }

    [[ $devNum == "1" ]] && {
        rm -rf /dev/sdcard/sd$devNum
    }

    [[ $devNum == "2" ]] && {
        swapoff /dev/sdcard/sd$devNum
    }
}

Copy this script above and replace it with the existing one in overlays/etc/hotplug.d/block/20-sd. Also, you may have noticed the presence of an additional package install command on line 38. This is because the original WiFi Pineapple firmware contains so many packages per-install that it is impossible to put everything in our firmware. 32 MB is too small compare to 2 GB for the Tetra. Therefore, If during the firmware compilation you get the error "file-system partition too big", you will have to remove some packages from the compilation command to add them in this file. They will be automatically installed on the USB key the first time the router will boot.

Ok, now we have everything we need to compile our firmware.

cd openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64
sudo make image PROFILE=WZRHPG450H PACKAGES="at autossh base-files bash block-mount ca-certificates chat dnsmasq e2fsprogs ethtool firewall hostapd-utils ip6tables iwinfo kmod-ath kmod-ath9k kmod-ath9k-htc kmod-crypto-manager kmod-fs-ext4 kmod-fs-nfs kmod-fs-vfat kmod-gpio-button-hotplug kmod-ipt-offload kmod-leds-gpio kmod-ledtrig-default-on kmod-ledtrig-netdev kmod-ledtrig-timer kmod-lib-crc-itu-t kmod-mt76x2u kmod-nf-nathelper kmod-rt2800-usb kmod-rtl8187 kmod-rtl8192cu kmod-scsi-generic kmod-usb-acm kmod-usb-ledtrig-usbport kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rndis kmod-usb-ohci kmod-usb-serial-pl2303 kmod-usb-storage-extras kmod-usb-uhci kmod-usb-wdm kmod-usb2 libbz2-1.0 libcurl4 libelf1 libffi libgdbm libgmp10 libiconv-full2 libltdl7 libnet-1.2.x libnl200 libustream-mbedtls20150806 libxml2 logd macchanger mtd nano ncat netcat nginx openssh-client openssh-server openssh-sftp-server openssl-util php7-cgi php7-fpm php7-mod-hash php7-mod-json php7-mod-mbstring php7-mod-openssl php7-mod-session php7-mod-sockets php7-mod-sqlite3 ppp ppp-mod-pppoe procps-ng-pkill procps-ng-ps rtl-sdr ssmtp tcpdump-mini uboot-envtools uci uclibcxx uclient-fetch urandom-seed urngd usb-modeswitch usbreset usbutils wget wireless-tools wpad busybox libatomic1 libstdcpp6 libubus20191227 -wpad-basic -dropbear" FILES=../overlay/

If you want to see all of the available profiles, the command is:

sudo make info

And again, as I explained above, if you get the error "file-system partition too big", remove some packages from the make image command and add them in the script overlay/etc/hotplug.d/block/20-sd then try again.

If everything went well, the output for the firmware compilation should be something like this:

Building images...
24+1 records in
25+0 records out
1638400 bytes (1.6 MB, 1.6 MiB) copied, 0.0193714 s, 84.6 MB/s
Image Name:   MIPS OpenWrt Linux-4.14.171
Created:      Sun Nov  7 09:24:14 2021
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    1586152 Bytes = 1548.98 KiB = 1.51 MiB
Load Address: 80060000
Entry Point:  80060000
Parallel mksquashfs: Using 1 processor
Creating 4.0 filesystem on /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs, block size 262144.
Pseudo file "/dev" exists in source filesystem "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/root-ar71xx/dev".
Ignoring, exclude it (-e/-ef) to override.
[=========================================================================================================================\] 2010/2010 100%

Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
  compressed data, compressed metadata, compressed fragments,
  no xattrs, compressed ids
  duplicates are removed
Filesystem size 13423.49 Kbytes (13.11 Mbytes)
  32.32% of uncompressed filesystem size (41536.29 Kbytes)
Inode table size 19146 bytes (18.70 Kbytes)
  22.31% of uncompressed inode table size (85815 bytes)
Directory table size 24610 bytes (24.03 Kbytes)
  44.17% of uncompressed directory table size (55717 bytes)
Number of duplicate files found 243
Number of inodes 2516
Number of files 1940
Number of fragments 77
Number of symbolic links  412
Number of device nodes 1
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 163
Number of ids (unique uids + gids) 1
Number of uids 1
  unknown (0)
Number of gids 1
  unknown (0)
padding image to 00d20000
padding image to 00d1c000
padding image to 00d20000
padding image to 00d40000
106+1 records in
107+0 records out
14024704 bytes (14 MB, 13 MiB) copied, 0.0473437 s, 296 MB/s
make[4]: Entering directory '/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/target/linux/ar71xx/image'
cp /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/vmlinux /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h
/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/staging_dir/host/bin/patch-cmdline /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h "board=WZR-HP-G450H console=ttyS0,115200"
search space used is default of 16KB
/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/staging_dir/host/bin/lzma e /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h -lc1 -lp2 -pb2  /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.bin.lzma
mkimage -A mips -O linux -T kernel -a 0x80060000 -C lzma  -e 0x80060000 -n 'MIPS OpenWrt Linux-4.14.171' -d /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.bin.lzma /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage
Image Name:   MIPS OpenWrt Linux-4.14.171
Created:      Sun Nov  7 09:24:25 2021
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    1586206 Bytes = 1549.03 KiB = 1.51 MiB
Load Address: 80060000
Entry Point:  80060000
if [ 0 -eq 0 ]; then filename="/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw"; fstype=${filename##*\.}; case "${fstype}" in *) bs=`stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage`;; esac; ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=${bs} conv=sync;  cat /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; if [ -n "64" ]; then case "${fstype}" in squashfs*) padjffs2 /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin 64; ;; esac; fi; if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin is too big (> $((33095680-4*64*1024)) bytes)" >&2; rm -f /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; else if [ 0 -gt 262144 ]; then if [ `stat -c%s "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage"` -gt 0 ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage is too big (> 0 bytes)" >&2; else if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw is too big (> $((33095680-4*64*1024)) bytes)" >&2; else ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=0 conv=sync; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; fi; else ( dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/vmlinux-wzr-hp-g450h.uImage bs=0 conv=sync; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/root.squashfs-raw ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; if [ `stat -c%s /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin` -gt $((33095680-4*64*1024)) ]; then echo "Warning: /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin is too big (> $((33095680-4*64*1024)) bytes)" >&2; rm -f /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; fi; fi; fi
1+0 records in
1+0 records out
1586270 bytes (1.6 MB, 1.5 MiB) copied, 0.00191968 s, 826 MB/s
padding image to 00ea0000
if [ -e "/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin" ]; then ( echo -n -e "# Airstation Public Fmt1\x00\x00\x00\x00\x00\x00\x00\x00"; dd if=/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin; ) > /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-tftp.bin; buffalo-enc -p WZR-HP-AG450H -v 1.99 -i /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin -o /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/wzr-hp-g450h.enc; buffalo-tag -b WZR-HP-AG450H -p WZR-HP-AG450H -a ath -v 1.99 -m 1.01 -l mlang8 -w 3 -c 0x80041000 -d 0x801e8000 -f 1 -r M_ -i /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/tmp/wzr-hp-g450h.enc -o /home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-factory.bin; fi
29952+1 records in
29952+1 records out
15335428 bytes (15 MB, 15 MiB) copied, 0.074174 s, 207 MB/s
make[4]: Leaving directory '/home/yoda/Downloads/openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/target/linux/ar71xx/image'

Calculating checksums...

We can find our new firmware under openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic

If you reached this step, congratulations! you've just cloned the original WiFi Pineapple Tetra firmware but specifically designed it for your router!

Installation

Now I'm going to send and install my new sysupgrade firmware in my router, but first make sure your router has an original OpenWrt (version 19.07.2 preferred) already install on it. For example, in my case Buffalo does not integrate at all with OpenWrt by default, so the official OpenWrt website is your friend. The next thing to do is to plug a USB key in which has at least 2 GB in the USB port of your router.

scp openwrt-imagebuilder-19.07.2-ar71xx-generic.Linux-x86_64/bin/targets/ar71xx/generic/openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin [email protected]:/tmp/
openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin                                                                                          100%   15MB   1.4MB/s   00:10
ssh [email protected]                                                                                                                                                        


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.2, r10947-65030d81f3
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# cd /tmp
root@OpenWrt:/tmp# sysupgrade -n -F openwrt-19.07.2-ar71xx-generic-wzr-hp-g450h-squashfs-sysupgrade.bin
Image metadata not found
Image check failed but --force given - will update anyway!
Cannot save config while running from ramdisk.
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Wait for 2~3 minutes, then connect to http://172.16.42.1:1471 to configure the WiFi Pineapple Tetra custom Buffalo!

You can also SSH to the WiFi Pineapple.

ssh [email protected]                                                                                                                                                         
[email protected]'s password: 


BusyBox v1.30.1 () built-in shell (ash)

                                               .NN,                            
                                    .cxxdl'    xMMO    'cdxxl'                 
                                      .c0WMNk;,NMMW:,xXMMKo.                   
                                      ...:KMMMWMMMMWMMMXc...           .       
                         ,        .l0NMMMNXMMMMMMMMMMMMXNMMMWKl'      xWd      
                       ,0Wd         .':xNMMMMMMMMMMMMMMMMNkc'.        ;KM0'    
                      lWMo            .;dNMMMMMMMMMMMMMMWx:.      .l.   dMWc   
                     :WWo   oNd   .;xKWMMMMMMMMMMMMMMMMMMMMWXx:.  dWX:   dMW;  
                    ,NWo   oMW:   .. ..,lOXWMMMMMMMMMMWN0o;.. ..   cWMl   dMN' 
                   .XMx   oWN;   lc     .loooolcooclooool.    cXl   oMWc   kMK.
                   oMW'  ,WMl   cMW:   lWMW0d:;cdd:;:o0WMWl   lMW:   OMW'  ,WMl
                   0M0   xMX.  .XMd   .lo:.,dXMMMMMMXd,.:ol.   kMK.  'NMd   KMO
                   NMd   KMk   lMN.  .;:xOxollccddcclloxOx:;.  'WM:   OM0   xMX
                   WMo  .XMx   dMK   oNMMMMWOc;;ol;;cOWMMMMNo  .XMl   kMK   dMN
                   NMx   0MO   :Kd. .lllcl;.:0WMMMMW0:.;lclll. .xK;   0MO   kMX
 __          ___ ______ _   _____ _.:W0;,oxl:::oOOo:::lxo,;0W:   _   .ONo   KMk
 \ \        / (_|  ____(_) |  __ (_);cKMMMMWk:.;,.;kWMMMMKc;.   | |        .OX:
  \ \  /\  / / _| |__   _  | |__) _ _ __   ___  __ _ _ __  _ __ | | ___  TETRA
   \ \/  \/ / | |  __| | | |  ___| | '_ \ / _ \/ _` | '_ \| '_ \| |/ _ \ 2.7.0 
    \  /\  /  | | |    | | | |   | | | | |  __| (_| | |_) | |_) | |  __/       
     \/  \/   |_|_|    |_| |_|   |_|_| |_|\___|\__,_| .__/| .__/|_|\___|   
     With OpenWRT 19.07.2                            | |   | |                  
     ---------------------                           |_|   |_|                   
root@Pineapple:~# 

I can't tell you how happy I was to be able to install the WiFi Pineapple firmware on a random router on my own...

Now I'm going to explore the different possibilities that the WiFi Pineapple offers. Especially the module section since I saw a module that talks about HackRF as I just received mine few days ago!

Anyway, as usual, thanks for reading! 🙂

[UPDATE 8/15/2022]

After receiving many of your messages regarding difficulties on how to build the firmware, I would like to officially announce that i have added to my GitHub a tool that automates the entire process of building the firmware image from start to finish!

It's pretty cool right?

GitLab repository:

https://gitlab.com/0xSamy/sweet-pineapple-builder

Sweet WiFi Pineapple Tetra Builder supports the following router so far:

Brand Device CPU (MHZ) Flash MB RAM MB More info Firmware Image
Buffalo WZR450HP2 400 32 64 https://openwrt.org/toh/buffalo/wzr-450hp2 Download latest version
Buffalo WZR600DHP 680 32 128 https://openwrt.org/toh/hwdata/buffalo/buffalo_wzr-600dhp Download latest version
Buffalo WZRHPAG300H 680 32 128 https://openwrt.org/toh/hwdata/buffalo/buffalo_wzr-hp-ag300h_v1 Download latest version
Buffalo WZRHPG300NH 400 32 64 https://openwrt.org/toh/hwdata/buffalo/buffalo_wzr-hp-g300nh_v1 Download latest version
Buffalo WZRHPG300NH2 400 32 64 https://openwrt.org/toh/hwdata/buffalo/buffalo_wzr-hp-g300nh2_v2 Download latest version
Buffalo WZRHPG450H 400 32 64 https://openwrt.org/toh/hwdata/buffalo/buffalo_wzr-hp-g450h_v1 Download latest version
D-Link DGL5500A1 720 16 128 https://openwrt.org/toh/hwdata/d-link/d-link_dgl-5500_a1 Download latest version
D-Link DIR835A1 560 16 128 https://openwrt.org/toh/d-link/dir-835_a1 Download latest version
D-Link dir-869-a1 750 16 64 https://openwrt.org/toh/hwdata/d-link/d-link_dir-869_a1 Download latest version
GL.iNet gl-ar300 560 16 128 https://openwrt.org/toh/hwdata/gl.inet/gl.inet_gl-ar300 Download latest version
GL.iNet gl-ar300m 650 16 128 https://openwrt.org/toh/gl.inet/gl-ar300m Download latest version
GL.iNet gl-ar750 650 16 128 https://openwrt.org/toh/hwdata/gl.inet/gl.inet_gl-ar750 Download latest version
GL.iNet gl-ar750s 775 16 128 https://openwrt.org/toh/hwdata/gl.inet/gl.inet_gl-ar750s Download latest version
TP-Link archer-c7-v2 720 16 128 https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c7_ac1750_v2.0 Download latest version
TP-Link archer-c7-v4 775 16 128 https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c7_v4 Download latest version
TP-Link archer-c7-v5 750 16 128 https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_c7_v5 Download latest version

I hope you enjoyed reading my article! If you did, you might also like this one: Learn how to make your own Shark Jack network attack device.

https://samy.link/blog/jabberjaw-convert-your-router-in-portable-network-attack-dev

If you liked it, please follow me on my twitter as well! @0xSamy_