DWR-M960 -v1.1.50Beta1
Discovered a hidden way to change the DWR-M960 Telnet password. The Telnet port is open, but when attempting to log in using "root", the password is consistently incorrect. So I decided to extract the firmware using binwalk. After extraction, I obtained two HTML files for system commands.Two specific web UI pages allow running commands:
Log in to the router and change the URL to 192.168.0.1/syscmd.htm or 192.168.0.1/debug.htm
These commands will remove the root password, allowing Telnet login without it. We now have root shell access for these routers. Unfortunately, in the root shell, you can't create any files or change anything. I decided to upgrade BusyBox, but it seems the device doesn't have much space, and the root shell was not allowing us to download or make any changes even after remounting. I was not able to make any changes. Every time the router reboots, you need to start this process again.
