GL-Inet

[lacraig2]

gl_inet_routers.md

[lacraig2]

Rehosting the GL.iNet Travel Routers

In this document, we cover the rehosting of 4 travel routers:

1. Beryl AX (Linux aarch64)
2. Beryl (Linux mips32, little endian)
3. Creta (Linux mips32, big endian)
4. Slate AX (Linux ARM)

Obtaining firmware and rootfs

The firmware can be obtained from the GL.iNet Download Center: https://dl.gl-inet.com/.
OpenWRT versions also exist for some of the routers. For example, the Beryl AX OpenWRT version can be found here: https://openwrt.org/toh/gl.inet/gl-mt3000

Use wget to download the firmware and use fw2tar to extract the root file system.
Make sure to verify the checksums for data integrity.

Initializing the rehosting

Take the rootfs tarball and initialize a penguin project:

$ penguin init [rootfs]

Configuration changes

Run your configuration under penguin:

$ penguin run [path/to/config.yaml]

The Beryl AX as well as the other GL.iNet routers generally rehost right out of the box, but they are slow.

The console.log outputs a non-fatal error looking for the file /proc/gl-hw-info/model. There are also some non-fatal files missing that are detailed in pseudofiles_failures.yaml like /proc/device-tree/aliases/led-boot.

Below were the configuration file changes that were made under the pseudofiles category:

    /proc/gl-hw-info/model:
    read:
      model: const_buf
      val: "MT300A"
    write:
      model: discard
    ioctl:
      '*':
        model: return_const
        val: 0
  # /proc/device-tree/model:
  #   read:
  #     model: const_buf
  #     val: "MT300A"
  #   write:
  #     model: discard
  #   ioctl:
  #     '*':
  #       model: return_const
  #       val: 0 

The run for Beryl AX can take a while, but will eventually expose a number of open ports, including localhost:80 and localhost:443 on which an interactable webserver can be accessed via Burpsuite or otherwise.

Here is what the Beryl AX rehosting looks like:

Side note: /proc/device-tree/model also appears to be read from and may influence the depiction of the model number on the webserver (which is currently seen as "?" in the screenshot above). This was unfortunately not tested, so someone should try running the configuration with the second section uncommented to understand how that changes the appearance.

The Slate AX and Creta also rehosted without issues, encountering the same missing pseudofiles that can be recreated.

(Please note, the interface doesn't look fully identical due to some components missing... I would show you an image, but at the time of writing this Penguin was broken so I'm not able to insert a screenshot. Here's an old one which is what you should see before it tells you to enter a password, log in, and then see the dashboard view.)

Here's what the dashboard should look like if you perfectly rehosted the webserver of a travel router that did not have any connections to it (photo taken from the help page of Gl.iNet):

The current rehosting has most features on the GUI available but the bottom display is grey (everything past Ethernet). Some additional RE finagling would be needed to investigate why the HTML elements aren't showing up.

If the run doesn't expose a webserver, please double check to see that the appropriate network interfaces (lo, eth0) are up.