Rooting, firmware analysis and persistent credentials of TP-Link TL-841N

4 hours ago

Author bought a cheap TP-Link router to practice hardware hacking, including accessing UART and firmware extraction.
Used UART connection to get a root shell and dumped flash partitions via tftp, then extracted firmware directly from the flash chip using a CH341A programmer.
Analyzed the firmware and found plaintext credentials, including WPS password and ISP PPPoE credentials, which persisted even after a factory reset.
Discovered default admin:admin credentials for the web interface and cracked the unsalted MD5 hash of the root password (1234) within seconds.
Highlighted significant security vulnerabilities: credentials stored in plaintext and not erased by factory reset, exposing previous owner's information.

Tenda firmware versions contain an undocumented authentication backdoor allowing administrative access without valid credentials.
An attacker can bypass password verification via the backdoor, tracked as CVE-2026-11405, to gain full control.
Affected devices include specific firmware versions of US_FH1201, US_W15E, US_AC10, US_AC5, and US_AC6.

Revived a broken 2017 MacBook Pro with a broken keyboard into a personal private cloud.
Installed Ubuntu 24.04 Desktop using an old Raspberry Pi SD card as installer.
Fixed Broadcom Wi-Fi drivers with a script that runs on every restart.

A group of arcade enthusiasts discovered the obscure 1982 Taito game 'Adventure Canoe' on the Taito Egret II Mini, a mini arcade console with 40 pre-installed games.
The game was largely unknown, with minimal pre-2021 mentions, and no original cabinets, PCBs, or art records existed, making it a forgotten title for nearly 40 years.
The author borrowed the Egret II Mini to reverse-engineer it, starting with hardware inspection, finding UART ports, and analyzing boot logs, but faced limitations without soldering tools.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found in all major distributions since 2011.
It allows unprivileged local attackers to get a dangling kernel pointer, write to arbitrary addresses, and hijack function tables for privilege escalation.
The bug exists in Linux versions 2.6.39 to 7.1 and was fixed in April 2026.

Tenda firmware versions contain an undocumented authentication backdoor allowing administrative access without valid credentials.
An attacker can bypass password verification via the backdoor, tracked as CVE-2026-11405, to gain full control.
Affected devices include specific firmware versions of US_FH1201, US_W15E, US_AC10, US_AC5, and US_AC6.

Revived a broken 2017 MacBook Pro with a broken keyboard into a personal private cloud.
Installed Ubuntu 24.04 Desktop using an old Raspberry Pi SD card as installer.
Fixed Broadcom Wi-Fi drivers with a script that runs on every restart.

A group of arcade enthusiasts discovered the obscure 1982 Taito game 'Adventure Canoe' on the Taito Egret II Mini, a mini arcade console with 40 pre-installed games.
The game was largely unknown, with minimal pre-2021 mentions, and no original cabinets, PCBs, or art records existed, making it a forgotten title for nearly 40 years.
The author borrowed the Egret II Mini to reverse-engineer it, starting with hardware inspection, finding UART ports, and analyzing boot logs, but faced limitations without soldering tools.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found in all major distributions since 2011.
It allows unprivileged local attackers to get a dangling kernel pointer, write to arbitrary addresses, and hijack function tables for privilege escalation.
The bug exists in Linux versions 2.6.39 to 7.1 and was fixed in April 2026.

Hasty Briefsbeta