- Author bought a cheap TP-Link router to practice hardware hacking, including accessing UART and firmware extraction.
- Used UART connection to get a root shell and dumped flash partitions via tftp, then extracted firmware directly from the flash chip using a CH341A programmer.
- Analyzed the firmware and found plaintext credentials, including WPS password and ISP PPPoE credentials, which persisted even after a factory reset.
- Discovered default admin:admin credentials for the web interface and cracked the unsalted MD5 hash of the root password (1234) within seconds.