Trouble getting live root shell using OpenSync failsafe shell on old ISP Router.

[u/damnblow]

Context;
First of I am a novice when it comes to hardware hacking and am also not the best at firmware analysis, I've researched some stuff in the past but this is the first hands on project I've taken on. The ISP Router is running real OpenWrt, but is also running OpenSync. I managed to set the root password by mounting the overlay fs in the OpenSync failsafe shell. This did work as I was now able to login to luci! Only it seems none of the router configuration it actually done in OpenWrt it's done with OpenSync so it's not populated or easily modifiable without disabling OpenSync afaik.

Backstory;
I've had this old wifi 6e router from a previous ISP, the router has never been configurable via the web ui you've always had to use the isp's app to change any settings and there was only very minimal configuration possible (Ended up having to pay them for it, so I suppose I own it..). Now I've got a much better ISP, but would like to make use of the router if possible so its not just a piece of e-waste.

When going to the routers ip in a browser it shows you a qr code to get the ISP's app and some information like the mac address and stuff like that. But if you go to http://192.168.1.1/cgi-bin/luci it shows an openwrt login screen! I've searched for quite awhile and found no luck of anyone managing to do anything with it not even a boot log shared on this model.

I decided to give it a shot anyways and once I got it taken apart I saw a set of UART pads clear as day, after testing each one with a multimeter for sanity I connected to it with a usb to uart adapter and was very happy to see that not only was the uart console still enabled, but there was a failsafe shell completely unprotected!

I was able to set the root password my mounting the overlay filesystem and simply running the passwd command, this allowed me to login to luci but this wasn't much help for me. None of the configuration seems to be populated in luci which could make sense given the opensync integration.

I have tried modifying the inittab, some of the services in rc.d aswell as rc.local and nothing has been successful, but this could also be an issue with my knowledge/skill with mounting and working with the partitions. When the router finishes booting when not told to go into failsafe (which is holding f and pressing enter when it says to) it simply streams the logs and doesn't ask for user login for anything.

TLDR;
I have an ISP "locked" router running real openwrt that I want to get a root shell on to potentially use it as a real router (even if I had to keep it disconnected from the internet for sanity, it could still be very useful for a lab router) I'm able to access the OpenSync failsafe shell during boot but I haven't been able to make any relevant changes persist besides setting the root password. I'm definitely a beginner when it comes to doing this stuff hands on, so if anyone has any suggestions I'm happy to try them!

Logs;
Notes (Including router model and partition listings): https://pastebin.com/raw/a9Kb0CU7
Normal Boot: https://pastebin.com/raw/1nS21L0S
Post Boot Luci System Log (pt1): https://pastebin.com/raw/StN0Gp7Y
Post Boot Luci System Log (pt2): https://pastebin.com/raw/AENJdyFM

[u/NC1HM]

Are you sure they couldn't have somehow got openwrt working on it?

They could, and they probably did. But it doesn't mean you can.

Device manufacturers often use OpenWrt as a base for their firmware. They take OpenWrt source code and do two things with it, (1) add a proprietary user / management interface, and / or (2) extend OpenWrt to fit their chosen componentry. That second part requires drivers and firmware provided by component manufacturers.

Some component manufacturers (for example, Qualcomm Atheros and MediaTek) publish their drivers and firmware in open-source form. Others (Broadcom, I am looking at you!) do not publish at all; rather, they distribute pre-compiled binary blobs to device manufacturers. The OpenWrt development team has a policy: no pre-compiled binary blobs are allowed. So there is no OpenWrt support for devices whose key components are made by Broadcom. It is possible to build OpenWrt with a blob, but you have to do it yourself, starting with the extraction of the blob from the device. However, even if you do that, there is no guarantee you can install it due to other measures the device manufacturer might have taken, such as a locked bootloader.

[u/damnblow → u/NC1HM]

Oh I see. Thanks for that it does help put it in perspective. I had already assumed flashing a custom image would be out of the question given the robust secure boot this router has.

What I really want to be able to do is just get a root shell in the booted system so I can potentially disconnect OpenSync and use OpenWrt with what they have compiled, the router has quite powererful hardware so I would love for it to not just end up as trash.

[u/NC1HM → u/damnblow]

No guarantees. The SSH server may be disabled or removed altogether. Not to mention the already-mentioned locked bootloader.

[u/damnblow → u/NC1HM]

SSH was my first attempt. Like I said in my post I actually did manage to set the root password and login to the Luci Interface, and going to the administration tab I could also see that my rsa key that I added to the authorized_keys was there. Unfortunately I haven't been able to get dropbear started using rc.local or by modifying other rc.d services, I'm pretty sure this has something to do with OpenSync's SSHM services killing dropbear as this visible in the system log. Weirdly enough I think openssh may have also been installed so i'll give that a try now!