soft_hack.md

soft_hack.md

Soft hack to open telnet

You need gateway 3(mgl03) connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'

Login: admin

Password is empty

After opening telnet, it is better to install custom firmware (only for Xiaomi Gateway 3 mgl03).

Read here: https://github.com/zvldz/mgl03_fw/tree/main/firmware#the-easy-way

Open telnet command should also work with:

• lumi.gateway.mgl03 - Mi Smart Home Hub
• lumi.gateway.acn01 - Aqara Hub M1S CN
• lumi.gateway.aeu01 - Aqara Hub M1S EU
• lumi.aircondition.acn05 - Aqara Air Conditioning Controller P3
• lumi.gateway.sacn01 - Smart USB Wall Outlet Hub

Aqara Hub E1 (ZHWG16LM usb stick)

You need gateway E1 connected to MiHome. And also ip and gateway token.

1 way (recommended)

Via XiaomiGateway3 component, version 2+.

You must input in the 'Open Telnet command' field(as it is without changing anything):

{"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}

2 way (recommended if not using Home Assistant)

php-miio (https://github.com/skysilver-lab/php-miio)

You may need to change id.

php miio-cli.php --ip GW_IP --token GW_TOKEN --sendcmd '{"id":123,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; /bin/riu_w 101e 53 3012; telnetd"}}'

3 way (maybe problem with sequence id)

python-miio (https://github.com/rytilahti/python-miio)

miiocli device --ip GW_IP --token GW_TOKEN raw_command set_ip_info '{"ssid":"\"\"","pswd":"123123 ;  /bin/riu_w 101e 53 3012 ; telnetd"}'

Login: root

Password is empty

I am not author, I just tested and improved and published.

Enable telnet on Aqara G3 hub

way 3 it does not work
DEBUG:miio.device:Detected model lumi.aircondition.acn05
Model: lumi.aircondition.acn05
Hardware version: Linux
Firmware version: 4.0.6_0006

C:\Programs\Python\Python311>miiocli device --ip 192.168.0.13 --token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx raw_command set_ip_info '{"ssid":"""","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}'
Running command raw_command
ERROR:miio.miioprotocol:Got error when receiving: {'code': -9999, 'message': 'user ack timeout'}
Error: Unable to recover failed command

Is there any solution for lumi.gateway.mgl001?

Enabling telnetd Permanently on lumi.gateway.mgl001

I found a solution to enable telnetd permanently on the lumi.gateway.mgl001 gateway.

mkdir /data/scripts/
echo 'telnetd &' > /data/scripts/post_init.sh
echo 'fw_manager.sh -r' >> /data/scripts/post_init.sh
chmod +x /data/scripts/post_init.sh
sync

This script creates a custom initialization file that starts telnetd permanently after a reboot.

Spoiler How It Works

The Linux OS initializes using the /etc/init.d/rcS script, which includes the following logic at the end:

CUSTOM_POST_INIT=/data/scripts/post_init.sh
if [ -x ${CUSTOM_POST_INIT} ]; then
    ${CUSTOM_POST_INIT} &
else
    fw_manager.sh -r
fi

By default, the /data/scripts/post_init.sh file does not exist, so the system executes fw_manager.sh -r.
The fw_manager.sh script does not include a telnetd launch command.

By creating /data/scripts/post_init.sh with the following content:

telnetd &
fw_manager.sh -r

telnetd & - runs telnetd in the background.
fw_manager.sh -r - executes the default program, maintaining the original system behavior.

Since the if [ -x ${CUSTOM_POST_INIT} ]; then condition checks for the executable bit, we must make the script executable with chmod +x /data/scripts/post_init.sh.

Verify the executable permissions:

~ # ls -laF /data/scripts/post_init.sh 
-rwxr-xr-x    1 root     root            27 Jan  1 00:03 /data/scripts/post_init.sh*

The x flags confirm the file is executable.