Antminer Hack S9 /S15 / S17 / Sx aso. SSH and so on for free

[fubly]

HACK FIRMWARE and SSH and EXPLOIT for free

FIRMWARE

• buy this ftdi https://amzn.to/2EUBb3P
• install cooltherm http://freeware.the-meiers.org/#CoolTerm Mac/Win/Linux/Raspi (DONATE)
• connect to any antminer board
• Connect ftdi to usb
• start CoolTerm
• Set 115000
• power on your miner
• login as usual: root admin

Code:

vi /www/pages/cgi-bin/upgrade.cgi

• remove line 45,46,46,48,49,50,51,52,77,78 (move with up and press d to remove a line. 77 and 78 are the last fi on that function)
• press ESC : wq
• open your antminer website and upload what ever you want

SSH on any Antminer

• buy this ftdi https://amzn.to/2EUBb3P
• install cooltherm http://freeware.the-meiers.org/#CoolTerm Mac/Win/Linux/Raspi (DONATE)
• connect to any antminer board
• Connect ftdi to usb
• start CoolTerm
• Set 115000
• login as usual: root admin

Code:

dropbearkey -t rsa -f /config/dropbear_rsa_host_key -y

• reboot -f
• power off your antminer
• disconnect ftdi
• power on
• login via ssh as usual

EXPLOIT Antminer (not only S15 or 17)

The exploit uses a security issue on Lighttpd!

• research your self
• if you use Kali Linux search for XSS, Lighttpd, remote execution
• It's hard to find but not impossible!
• do not spend any cent on this exploit use the above instructions
• if you have found the script use dos2linux to convert the script (it's a Win script)
• the code to execute is: dropbearkey -t rsa -f /config/dropbear_rsa_host_key -y
• Why? Because if you set a new dropbearkey ssh service will start from alone

Stop PM me if you will not pm your real name to me!

Hint: It works also above 1.4.32

[1714776254]

1714776254

[1714776254]

1714776254

[PassThePopcorn]

Do you know the pinout for the ftdi to connect it to the miner? or would any console cable work?
https://www.amazon.com/dp/B07MY6F8TP/

[cfbtcman]

I have everything but dont work, what is supposed to use as terminal to login, Putty or coolterm?
We need to connect energy to the databoard or not?

[Artemis3]

I have everything but dont work, what is supposed to use as terminal to login, Putty or coolterm?
We need to connect energy to the databoard or not?

Power the controller, no need for hashboards.
This is a serial link, old fashioned method you may not be familiar with depending on your age, so use a serial terminal, not ssh client; forget putty.

If you do it correctly you should get a prompt when you plug the cable and hit enter; probably login and password.

[cfbtcman]

Putty can use serial terminal too, but i use coolterm and i cant get nothing.
Why there is no connections scheme, can someone put some pictures of the connections scheme?

[Artemis3]

Why? Did you made the cable yourself? Just search online for FTDI usb cable pinout... I believe it involves a chip, due to usb, unless you want to make a direct rj45 to serial which i happen to have one lol. Cisco switches and such use them in both the true serial and usb variants that go into an rj45 jack and serial/usb on the other side. Oh, if you are using a true serial port, make sure its enabled in the bios. Some bios are set to "auto" and won't turn it on if nothing is plugged at boot.

I haven't touched putty in over a decade, but if it can do true serial then its a matter of picking the right port and speed parameters (115kbps 8,n,1).
If unsure test the program with something else if you have anything that still connects via serial (such as the aforementioned router, or an old fashioned pc).

[s3binator]

For the exploit, I searched and tried the few exploits on exploit-db. I haven't found anything thats a windowns script. The others didin't seem to work (were for older versions than lighttpd 1.4.32, which is whats on the newest firmware.) Has anyone else had more luck?

Thanks

[cfbtcman]

Why? Did you made the cable yourself? Just search online for FTDI usb cable pinout... I believe it involves a chip, due to usb, unless you want to make a direct rj45 to serial which i happen to have one lol. Cisco switches and such use them in both the true serial and usb variants that go into an rj45 jack and serial/usb on the other side. Oh, if you are using a true serial port, make sure its enabled in the bios. Some bios are set to "auto" and won't turn it on if nothing is plugged at boot.

I haven't touched putty in over a decade, but if it can do true serial then its a matter of picking the right port and speed parameters (115kbps 8,n,1).
If unsure test the program with something else if you have anything that still connects via serial (such as the aforementioned router, or an old fashioned pc).

I bought one already cable in Amazon from USB to RJ45, but like i told you nothing works.
The connections are in the RJ45 or in the boards points like old JTAGs ?

[Artemis3]

I bought one already cable in Amazon from USB to RJ45, but like i told you nothing works.
The connections are in the RJ45 or in the boards points like old JTAGs ?

Both apparently. I did saw the 3 pin header on S9s, but this may vary with controller model/revision.

[fubly]

I have everything but dont work, what is supposed to use as terminal to login, Putty or coolterm?
We need to connect energy to the databoard or not?

see the first post (edited today)!

[cfbtcman]

Both apparently. I did saw the 3 pin header on S9s, but this may vary with controller model/revision.

Both? If both where is diagram for board connections?
This post seems a joke!

see the first post (edited today)!

This sounds like one enigma, why dont do this like if this was for very stupid people?
Put some pictures of connections, or a video in youtube, why not?

[bruiser]

Or you can do it without buying any tools: https://asicseer.com/page/security-restoring-ssh

We released it for free. If you like the tool, try ASICseer itself

[Artemis3]

[...]

Why? Have you never done serial? You just need 3 wires: TXD RXD and GND which corresponds to pins 2, 3 and 5 in a standard db-9 plug. You might need to swap TXD and RXD if you got it wrong. Don't ask me about usb because that's a whole new can of worms.



To clarify in case you somehow got it wrong: You can use either port, the rj45 or the 3 pin header for serial communications. "Both" should work... Using an rj45 for serial communications is old. The port knows when you plug this type of cable instead of Ethernet in devices with serial, there is nothing special about this. But in addition there happens to be a 3 pin header that appears to be the same. Just ignore the 3 pin header if you don't get it.

RJ-45 Pin	Signal	DB-9 Pin	Signal
1	RTS	8	CTS
2	DTR	6	DSR
3	TXD	2	RXD
4	GND	5	GND
6	RXD	3	TXD
7	DSR	4	DTR
8	CTS	7	RTS

https://www.juniper.net/documentation/en_US/release-independent/junos/topics/reference/specifications/port-rj45-db9-adapter-pinout.html

You could wire them all if you are bothered with hardware control, but my made by Cisco version cable didn't bother. I don't think they use it (cts/rts) anyway, or the data ready pins.

[tim-bc]

Or you can do it without buying any tools: https://asicseer.com/page/security-restoring-ssh

We released it for free. If you like the tool, try ASICseer itself

This tool doesn't work, I've already tried it, others have too with no luck.

Also asicseer has devfee and some of the devs / leaders are bcash proponents

[darkv0rt3x]

What are the advantages of performing this hack? What can we do with it that cannot be done without it?

[s3binator]

What are the advantages of performing this hack? What can we do with it that cannot be done without it?

The newest bitmain firmware disables ssh on boot, therefore you can not ssh into machines. Its not a big deal if you have a few machines, but there are many farms out there with hundreds or thousands of miners that automate configuration and reboots using software, this new firmware removes the ability.

They quote "security", but its bologna. Why not give the end user a choice to turn ssh on or off through portal. Any end user with a couple machines can turn ssh off, and farms that tunnel through firewalls can leave it on, our choice.  They are purposely making larger mining operations lives harder to get an upper hand.

[darkv0rt3x]

Ah ok. I got it. Absolutely agreed. There's no point in avoiding SSH connections because sooner or later someone will make it happen one way or another.

What about the exploit? What can one do with it?

[tim-bc]

The newest bitmain firmware disables ssh on boot, therefore you can not ssh into machines. Its not a big deal if you have a few machines, but there are many farms out there with hundreds or thousands of miners that automate configuration and reboots using software, this new firmware removes the ability.

They quote "security", but its bologna. Why not give the end user a choice to turn ssh on or off through portal. Any end user with a couple machines can turn ssh off, and farms that tunnel through firewalls can leave it on, our choice.  They are purposely making larger mining operations lives harder to get an upper hand.

You can do all necessary configurations, get kernel logs, do reboots etc. all through the cgi pages on the web portal. It is actually much faster than SSH on these miners because they always sit for a few seconds before you can connect via ssh.

Large mining operations can easily have someone to tweak their scripts and how they do configurations. However, unexperienced and smaller users who are clueless could easily get an ssh virus if any infected miners or control boards are put on the same network.

[Artemis3]

You can do all necessary configurations, get kernel logs, do reboots etc. all through the cgi pages on the web portal. It is actually much faster than SSH on these miners because they always sit for a few seconds before you can connect via ssh.

Large mining operations can easily have someone to tweak their scripts and how they do configurations. However, unexperienced and smaller users who are clueless could easily get an ssh virus if any infected miners or control boards are put on the same network.

This is not true and it probably means your LAN or your computer aren't performing properly, or you are using Putty or some bloated windows client rather than proper openssh from a proper operating system.

The other reason most people want ssh access is to enable the other api controls that require editing some text file. There is also diagnostics and the multitude of things you can do from a proper Linux box, as these controllers actually are, such as network debug and configuration. I have often changed dns via ssh which from ui requires a reboot which is a travesty.

And yes there are the people using scripts to automate things, why not? you can do the whole thing without ever looking at the web ui. How are you seriously going to say that a web ui is faster than a text console? It is an order of magnitude slower, simply by data transferred alone lets ignore web browser rendering... Have i seen Bitmain miners with the web ui stuck that are actually still mining? Yes i have...

s3binator is right, the alleged "security" thing is bologna, and yes, a simple ui option would at least give the owner a choice, but they don't care. Want security? Start with setting a proper password, then remove all windows computers from your mining lan, which is how 90% of the malware gets in.

[darkv0rt3x]

Hum, ok. I've learnt more in the last few posts here than with the thread instructions themselves.

I use Linux at home by default and I like the advantages of not have to deal with constant bugs and errors of window based systems and applications. I absolutely agree witht he problem of 90% or more of malware spreading mostly through Windows machines. Nothing like a terminal to avoid a ton of problems!

I like the idea of being possible to access miners through an SSH connection. If I have get a miner in my hands, I'll try to do everything via terminal!

Thanks
DarkV