Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
projects:zte_mf28x [2024/08/07 10:30] – Andreas Böhlerprojects:zte_mf28x [2024/08/07 10:33] (current) – Andreas Böhler
Line 41: Line 41:
 You need an exploit to get access to the stock firmware. Prepare the following: You need an exploit to get access to the stock firmware. Prepare the following:
  
-  * TFTP server - tftpd-hpa on Linux is tested, and tftpd64 on Windows is known to work+<WRAP round important 80%> 
 +**Required files** 
   * Static build of busybox for ARM, e.g. from https://busybox.net/downloads/binaries/1.21.1/ (Pick ARMV7 version)   * Static build of busybox for ARM, e.g. from https://busybox.net/downloads/binaries/1.21.1/ (Pick ARMV7 version)
 +  * exploit.dat from https://cloud.aboehler.at/index.php/s/GDixspLf4jgg8pT. Please use the password ''%%nzjmaBARoM%%''
 +  * OpenWrt factory image - this is **not** listed in the table above. Please download it from [[https://firmware-selector.openwrt.org/]]
 +</WRAP>
 +
 +Then do the following preparatory steps:
 +
 +  * Set up a TFTP server - tftpd-hpa on Linux is tested, but tftpd32 should work as well
   * Rename busybox to "telnetd" and put it to your TFTP root directory   * Rename busybox to "telnetd" and put it to your TFTP root directory
-  * Download the exploit.dat from https://cloud.aboehler.at/index.php/s/GDixspLf4jgg8pT. Please use the password ''%%nzjmaBARoM%%'' +  * Put the OpenWrt **factory.bin** file to your TFTP directory as zte.bin
-  * Put the OpenWrt factory.bin file to your TFTP directory as zte.bin (e.g. from https://firmware-selector.openwrt.org/?version=23.05.4&target=ipq40xx%2Fgeneric&id=zte_mf287pro)+
   * Assign your computer the IP address 192.168.0.22   * Assign your computer the IP address 192.168.0.22
  
Line 58: Line 66:
 <WRAP round important 80%> <WRAP round important 80%>
 For the MF287 and MF287+, you need to replace ''%%mtdXX%%'' with ''%%mtd13%%'' and ''%%mtdblockXX%%'' with ''%%mtdblock13%%''! For the MF287 and MF287+, you need to replace ''%%mtdXX%%'' with ''%%mtd13%%'' and ''%%mtdblockXX%%'' with ''%%mtdblock13%%''!
-For the MF287Pro, you need to replace ''%%mtdXX%%'' with ''%%mtd17%%'' and ''%%mtdblock13%%'' with ''%%mtdblock17%%''!+For the MF287Pro, you need to replace ''%%mtdXX%%'' with ''%%mtd17%%'' and ''%%mtdblockXX%%'' with ''%%mtdblock17%%''!
 </WRAP> </WRAP>