soft_hack.md

soft_hack.md

Soft hack to open telnet

You need gateway 3(mgl03) connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

Login: admin

Password is empty

After opening telnet, it is better to install custom firmware (only for Xiaomi Gateway 3 mgl03).

Read here: https://github.com/zvldz/mgl03_fw/tree/main/firmware#the-easy-way

Open telnet command should also work with:

• lumi.gateway.mgl03 - Mi Smart Home Hub
• lumi.gateway.acn01 - Aqara Hub M1S CN
• lumi.gateway.aeu01 - Aqara Hub M1S EU
• lumi.aircondition.acn05 - Aqara Air Conditioning Controller P3
• lumi.gateway.sacn01 - Smart USB Wall Outlet Hub

Aqara Hub E1 (ZHWG16LM usb stick)

You need gateway E1 connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component, version 2+.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ;  /bin/riu_w 101e 53 3012 ; telnetd"}'

Login: root

Password is empty

I am not author, I just tested and improved and published.

Enable telnet on Aqara G3 hub

Seemingly the Info for 1.5.5_0006 is wrong. I got in without UART by executing the commands and later login via admin/admin

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; /bin/riu_w 101e 53 3012 ; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ miiocli device --ip 10.0.x.x --token 445159xxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

$ telnet 10.0.x.x
Trying 10.0.x.x...
Connected to 10.0.x.x.
Escape character is '^]'.

rlxlinux login: admin
Password:
Login incorrect
rlxlinux login: admin
Password:
Lumi Linux version 3.0

---

| | || | |||
| | _ _ _____ _ | | _ ____ _ _ _ _
| || || || | | | || | _ | | | |\ / /
| || || || | | || | | || | | | | || |/
||_||||||| ||||| ||___|_/_/

For further information check:
https://www.aqara.com

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2.
but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

lumi.gateway.mgl001 here: I can activate telnet (from my linux console I can telnet it and prompting for user and password) using the key sequence 5 2 2 2 2 2 2. but I cannot login. I've tried a lot of combinatiojn (user admin, root, app), (password: 123, 123123, emopty one) without success. any idea?

Hi! Can you please tell how did you activate telnet on lumi.gateway.mgl001?

I press the reset button 5 times, then pause 2 times, pause, 2 times, pause etc. the sequence is 5 2 2 2 2 2 2

however no login, I cannot find user and password

way 3 it does not work
DEBUG:miio.device:Detected model lumi.aircondition.acn05
Model: lumi.aircondition.acn05
Hardware version: Linux
Firmware version: 4.0.6_0006

C:\Programs\Python\Python311>miiocli device --ip 192.168.0.13 --token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command