1,解锁ssh的关键源码

保存以下代码为main.go文件在D:\OpenWrt\gee1s文件夹内:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
package main

import (
"crypto/hmac"
"crypto/sha1"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"hash"
"io"
"net"
"net/http"
"strconv"
"strings"
"time"
)

const (
localTokenUrl = "/local-ssh/api?method=get"
routerInfoUrl = "/cgi-bin/turbo/proxy/router_info"
localSshUrl = "/local-ssh/api?method=valid&data=%s"
)

const (
retry = 10
sleepSecond = 10 * time.Second
)

type LocalTokenResp struct {
Data string
}

type LocalSshResp struct {
Data string
}

type RouterInfoResp struct {
Data RouterInfoData
}

type RouterInfoData struct {
Uuid string
}

var ErrorSystemBusy = errors.New("系统忙,请稍后重试")
var address = "192.168.199.1"

func main() {
var input string
var n int
var ip net.IP
var err error

for {
fmtPrint("请输入极路由管理IP,然后按回车继续(不输入则默认192.168.199.1): ")

n, err = fmt.Scanln(&input)
if err != nil && err.Error() != "unexpected newline" {
fmtPrintFln("输入有误,请重新输入: %v", err)
continue
}

if n == 0 {
input = address
}

ip = net.ParseIP(input)
if ip == nil {
fmtPrintFln("输入非合法IP,请重新输入")
continue
}

address = ip.String()
fmtPrintFln("极路由IP为: %s", address)
break
}

launchSsh()

fmtPrint("按回车退出...")
_, _ = fmt.Scanln(&input)
}

func launchSsh() {
var localToken string
var uuid string
var cloudToken string
var port string
var err error

for i := 0; i <= retry; i++ {
if i != 0 {
time.Sleep(sleepSecond)
fmtPrintFln("----------------------------------------------------------------")
fmtPrintFln("第%d次重试", i)
}

fmtPrintFln("开始获取UUID")
uuid, err = getUUID()
if err != nil {
fmtPrintFln("获取uuid出错: %v", err)
continue
}
fmtPrintFln("获取uuid成功: %s ", uuid)

fmtPrintFln("开始获取local_token")
localToken, err = getLocalToken()
if err != nil {
fmtPrintFln("获取local_token出错: %v", err)
continue
}
fmtPrintFln("获取local_token成功: %s", localToken)

fmtPrintFln("开始生成cloud_token")
cloudToken, err = getCloudToken(uuid, localToken)
if err != nil {
fmtPrintFln("生成cloud_token出错: %v", err)
continue
}
fmtPrintFln("生成cloud_token成功: %s", cloudToken)

fmtPrintFln("开始获取local_ssh")
port, err = getLocalSsh(cloudToken)
if err != nil {
fmtPrintFln("获取local_ssh出错: %v", err)
continue
}
fmtPrintFln("获取local_ssh成功,端口号: %s,有效期5分钟,请及时更改为永久ssh", port)
return
}
fmtPrintFln("获取local_ssh出错,请检查IP是否有误,UUID,LocalToken是否正常获取")
fmtPrintFln("极路由IP为: %s", address)
fmtPrintFln("UUID为: %s", uuid)
fmtPrintFln("LocalToken为: %s", localToken)
fmtPrintFln("CloudToken为: %s", cloudToken)
}

func getLocalSsh(cloudToken string) (port string, err error) {
var osr *LocalSshResp
osr = &LocalSshResp{}

err = httpGet(generateUrl(localSshUrl, cloudToken), osr)
if err != nil {
return
}

if !strings.Contains(osr.Data, "Success: ssh port is ") {
err = errors.New(fmt.Sprint("Unknown error:", osr.Data))
}

port = strings.ReplaceAll(osr.Data, "Success: ssh port is ", "")
return
}

func getUUID() (uuid string, err error) {
var rir *RouterInfoResp
rir = &RouterInfoResp{}

err = httpGet(generateUrl(routerInfoUrl), rir)
if err != nil {
return
}

uuid = rir.Data.Uuid
return
}

func getLocalToken() (localToken string, err error) {
var ltr *LocalTokenResp
ltr = &LocalTokenResp{}

err = httpGet(generateUrl(localTokenUrl), ltr)
if err != nil {
return
}

localToken = ltr.Data
return
}

func getCloudToken(uuid, localToken string) (cloudToken string, err error) {
var key [sha1.Size]byte
var msg []byte
var expectedMAC []byte

msg, err = tokenToMsg(localToken)
if err != nil {
return
}

key = sha1Sum(uuid)
expectedMAC = hmacSha1Sum(msg, key[:])
cloudToken = base64.StdEncoding.EncodeToString(expectedMAC)

return
}

func httpGet(url string, data interface{}) (err error) {
var resp *http.Response
var body []byte

url = strings.ReplaceAll(url, "+", "%2B")

resp, err = http.Get(url)
if err != nil {
return
}

body, err = io.ReadAll(resp.Body)
if err != nil {
return
}

if strings.Contains(string(body), "系统忙,请稍后重试") {
err = ErrorSystemBusy
return
}

err = json.Unmarshal(body, data)
if err != nil {
fmtPrintFln("json Unmarshal error: %s", string(body))
return
}

return
}

func generateUrl(api string, a ...any) (url string) {
api = fmt.Sprintf(api, a...)
url = "http://" + address + api
return
}

func tokenToMsg(localToken string) (msg []byte, err error) {
var decodedLocalToken []byte
var splitToken []string
var timestamp int
var msgStr string

decodedLocalToken, err = base64.StdEncoding.DecodeString(localToken)
if err != nil {
return
}
splitToken = strings.Split(string(decodedLocalToken), ",")

timestamp, err = strconv.Atoi(splitToken[2])
if err != nil {
return
}

timestamp += 1
splitToken[2] = strconv.Itoa(timestamp)
msgStr = strings.Join(splitToken[:3], ",")
msg = []byte(msgStr)

return
}

func sha1Sum(uuid string) (checksum [sha1.Size]byte) {
var data []byte
data = []byte(uuid)
checksum = sha1.Sum(data)
return
}

func hmacSha1Sum(msg, key []byte) (expectedMAC []byte) {
var mac hash.Hash
mac = hmac.New(sha1.New, key)
mac.Write(msg)
expectedMAC = mac.Sum(nil)
return
}

func fmtPrintFln(format string, a ...any) {
fmt.Printf(format, a...)
fmt.Println()
}

func fmtPrint(a ...any) {
fmt.Print(a...)
}

2,生成windows可执行文件

a,确保安装 Go
下载地址(Windows 安装包)

安装完后在命令行中验证:

1
go version

b,打开命令提示符(cmd)并运行

D:\OpenWrt\gee1s内打开终端,执行以下代码,生产launch_ssh.exe文件在D:\OpenWrt\gee1s

1
go build -o launch_ssh.exe main.go

3,解锁SSH

右键launch_ssh.exe文件选择管理员运行,此次解锁只有5分钟的有效期,在有效期内用ssh工具登录路由器,执行以下命令使永久解锁SSH

1
2
3
4
5
uci set firewall.@zone[1].input='ACCEPT'
uci set dropbear.@dropbear[0].enable='1'
uci commit
/etc/init.d/dropbear enable
/etc/init.d/dropbear start

4,验证

退出SSH后再次进入在SSH输入以下命令

1
ssh root@192.168.199.1

如果成功,就是永久 SSH登录已启用。

极路由1s的默认ip地址是192.168.199.1,用户名/密码是admin/admin,过程中不用修改

5,刷入breed

a,WinSCP登录路由器,把breed-mt7628-hiwifi-hc5661a.bin文件放入/tmp/文件夹内

b,SSH登录路由器执行下边命令

1
mtd -r write /tmp/breed-mt7628-hiwifi-hc5661a.bin u-boot

完成后reset

6,输入固件

reset后输入192.168.1.1登录路由器,刷入需要刷入的固件

要刷入其他固件就再次reset