soft_hack.md

soft_hack.md

Soft hack to open telnet

You need gateway 3(mgl03) connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

Login: admin

Password is empty

After opening telnet, it is better to install custom firmware (only for Xiaomi Gateway 3 mgl03).

Read here: https://github.com/zvldz/mgl03_fw/tree/main/firmware#the-easy-way

Open telnet command should also work with:

• lumi.gateway.mgl03 - Mi Smart Home Hub
• lumi.gateway.acn01 - Aqara Hub M1S CN
• lumi.gateway.aeu01 - Aqara Hub M1S EU
• lumi.aircondition.acn05 - Aqara Air Conditioning Controller P3
• lumi.gateway.sacn01 - Smart USB Wall Outlet Hub

Aqara Hub E1 (ZHWG16LM usb stick)

You need gateway E1 connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component, version 2+.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ;  /bin/riu_w 101e 53 3012 ; telnetd"}'

Login: root

Password is empty

I am not author, I just tested and improved and published.

Enable telnet on Aqara G3 hub

Trying to make it work but I'm not able to get it. My fw version is to old and I've tried to use the code shown in the image and also serrj_sv's way (https://community.home-assistant.io/t/xiaomi-mijia-smart-multi-mode-gateway-zndmwg03lm-support/159586/61). The code shown in the image get no response. The later returns ok, but still unable to telnet (asks for password). Any ideas?

Also, the first method shown here isn't possible

Aqara G3 Hub (lumi.camera.gwpagl01) https://github.com/Wh1terat/aQRootG3

@Wh1terat I'm trying to get your code working. I make the QR code, scan it with camera, all good to this point. After it fails, what specifically do I do? Reset the camera and add to Aqara app? fill in ssid/pwd in app and then use camera to scan legit QR code? thanks

@Wh1terat I'm trying to get your code working. I make the QR code, scan it with camera, all good to this point. After it fails, what specifically do I do? Reset the camera and add to Aqara app? fill in ssid/pwd in app and then use camera to scan legit QR code? thanks

No need to reset the camera, just try to add it to the app with a legit QR code. Be aware most firmwares for the last year or two have been patched and are no longer vulnerable. There are methods to downgrade.

I got lucky! I got the firmware that works
It must be working because I can use the G3 in Home Assistant
Is there a way to downgrade G2H Pro firmware?

@wizardofozzie niceboygithub/AqaraGateway#179

@wizardofozzie niceboygithub/AqaraGateway#179

@Wh1terat that's crazy- thanks so much!

For G2hPro, I have downgraded to firmware 3.3.4 but telnet won't work. I booted an SD with custom firmware onto the camera but telnet 192.168.1.101 is refused. Any ideas?

@wizardofozzie niceboygithub/AqaraGateway#179

@Wh1terat that's crazy- thanks so much!

For G2hPro, I have downgraded to firmware 3.3.4 but telnet won't work. I booted an SD with custom firmware onto the camera but telnet 192.168.1.101 is refused. Any ideas?

i think the new g2h pro camera fix the bug ,so you can not use telnet. Because my g2h pro can use telnet.

Is there any solution for lumi.gateway.mgl001?

what can be the problem?

$ GW_IP=192.168...
$ GW_TOKEN=32414f48...
$ miiocli device --ip $GW_IP --token $GW_TOKEN info
Model: lumi.gateway.acn008
Hardware version: Linux
Firmware version: 4.0.5_0005

$ miiocli device --ip $GW_IP --token $GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ php miio-cli.php --ip $GW_IP --token $GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'
PHP Deprecated:  Creation of dynamic property miIO::$bind_ip is deprecated in /php-miio/miio.class.php on line 51

Deprecated: Creation of dynamic property miIO::$bind_ip is deprecated in /php-miio/miio.class.php on line 51
Устройство 192.168.130.181 доступно и ответило:
{"id":123,"error":{"code":-9999,"message":"user ack timeout"},"exe_time":4000}

Seemingly the Info for 1.5.5_0006 is wrong. I got in without UART by executing the commands and later login via admin/admin

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; /bin/riu_w 101e 53 3012 ; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ telnet 10.0.x.x
Trying 10.0.x.x...
Connected to 10.0.x.x.
Escape character is '^]'.

rlxlinux login: admin
Password:
Login incorrect
rlxlinux login: admin
Password:
Lumi Linux version 3.0

---

| | || | |||
| | _ _ _____ _ | | _ ____ _ _ _ _
| || || || | | | || | _ | | | |\ / /
| || || || | | || | | || | | | | || |/
||_||||||| ||||| ||___|_/_/

For further information check:
https://www.aqara.com

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2.
but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

I press the reset button 5 times, then pause 2 times, pause, 2 times, pause etc. the sequence is 5 2 2 2 2 2 2

however no login, I cannot find user and password

way 3 it does not work
DEBUG:miio.device:Detected model lumi.aircondition.acn05
Model: lumi.aircondition.acn05
Hardware version: Linux
Firmware version: 4.0.6_0006

C:\Programs\Python\Python311>miiocli device --ip 192.168.0.13 --token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command