[General Questions and Answers] timematcher:
Goal has been successfully achieved by a little bit of research and careful experimentation. Got to the middle of this post to find the complete solution.

I have a 4g Router Model: R660 also called 4g Wingle. The manufacturer is unknown as there is no branding on the device. But some say it is a GadgetIT product. I have scoured the internet and I cannot find the vendor named GadgetIT. But that is a separate discussion.

Main Goal: My main goal is to enable Virtual Server/Port forwarding in the device. The UI available when the device is connected is available at 192.168.1.1 with credentials admin/admin and Looks like this:

[IMG="R660 Router Information/configuration page."]https://i.imgur.com/ptiIpyh.png[/IMG]

This device is marketed by ISP PTCL as CHARJI EVO . The users of PTCL charji on this forum might say that port forwarding is not possible in this device but I disagree. and I have evidence to support otherwise but again that is a separate discussion.

What I have found so far?

I am able to telnet to this device at 192.168.1.1 via admin/admin credentials. Here is what I get.:

[IMG="Telnet Access to 192.168.1.1 via Admin/Admin"]https://i.imgur.com/coovq9D.png[/IMG]

Version

LNX.LE.4.1-41009-9x35

But admin is not root. There is a separate user called root which obviously has a different password. I have tried all common router password (not sure what all will constitute...but i have tried many).

The goal here is to root this device so that I can perform the necessary changes such as the following:

[IMG="Change DMZ in mobileap_cfg.xml"]https://i.imgur.com/crFP5cd.png[/IMG]

As you might have guessed by now, that i cannot unless I am root which I am not.

So I need your help guys. Here are other interesting things to look at:

[IMG="Whats available under the hood."]https://i.imgur.com/Lmp3w1I.png[/IMG]

I could edit mobileap_cfg.xml but I cannot because the file is readonly and I was unable to chmod it to 777 with an error message "Operation not permitted" indicating that I am not root and I can not make that happen.

The second thing i would like to do is to enable SNMP monitoring which I cannot do from the main interface because the vendor hid the option.

Lastly, enable firewall.

Interestingly, all these options are available in a tab called "Security" which the vendor has hidden from the configuration interface available at 192.168.1.1

So I am inviting the expert comments of all hackers that can help me make get it sorted out. Ideally, it would be awesome to have these options enabled from the UI (I am willing to hack, root this device and modify firmware if needed) to get this done.

This can potentially help millions of PTCL Charji Users who cannot run any kind of server using this device (including game servers) and any kind of listening services (sockets or WEB or FTP) r those who would like use torrents but suffer from terrible low download speeds on torrents because of not being able to open ports for incoming connections that significantly raise download speeds for torrent.

More details:

[IMG="Passwd contents"]https://i.imgur.com/qBjvCFQ.png[/IMG]

mobileap_cfg.xml ownership and permissions:

[IMG="mobileap_cfg permissions"]https://i.imgur.com/HQ1bjuc.png[/IMG]

Appreciate your help. Waiting to hear helpful responses soon. Successfully rooted without any busy box.

Solution Achieved successfully- See Steps & detail as follows:

I was able to switch device to bootloader mode and was able to change root password and now I am able to switch to root mode when logged in via admin using telnet. I have successfully change the DMZ but i have yet to observe its effects. If it works, I will work on changing other values as well.

[IMG="Su Mode :P"]https://i.imgur.com/QBYd886.png[/IMG]

Detail:

The device closely resembles D-Link DWR 901 But mind you, it is NOT DWR 901. Even thought the radio matches, if you flash the firmware from DWR 901 (which will be successful), the device will NOT work. Since there is no available source of the original firmware of the device, the device will be of no use anymore. So do not do it.

Similary D-Link's DWM 222 is also similar to this device (only that DWM 222) is a 3G modem. I downloaded both firmwares and found out upon extraction of these firmwares, that it contains the following files.

[IMG="DWM 222 firmware internal files"]https://i.imgur.com/cXovcvI.png[/IMG]

Files that you actually need are present in this archive -

WARNING

Use at your own RISK!!. Flashing this directly to your Charji will brick you Charji device. So just follow the procedure I described and do not try to flash it directly otherwise it will render your device unable to connect even though everything will look all right in the software. The device will never connect again...ever!

https://www.dropbox.com/s/hqa2m4499pyrj3z/R660A-Donot-Flash-it-On-Charji-It-Will-Brick-Your-device.7z?dl=0

There is a file called dl.exe which can turn the device into download mode assumung you have the PTCL Charji Wingle R660 plugged into the USB port.

After that running adb devices command will list all the devices.

[IMG="adb devices"]https://i.imgur.com/iJlRnJC.png[/IMG]

After that you need to run the following commands

adb shell
passwd

The adb shell command will take you to the shell.

The passwd command executed from shell will tell you to enter a new password for root user

You will have to provide a secure password for it to be accepted.

After that, it will update the root password.

exit the shell using the exit or quit command or simply close the command prompt.

Now, you can telnet to the device using the command

telnet 192.168.1.1

Login with username admin and password admin (if these are your credentials to access the router page, Use your credentials. Mine were admin/admin)

The issue the following command to switch to root mode

su

It will ask for root password. Enter the password you set using the adb shell you had used before. and viola. You will turn to root mode.

[IMG="Root Mode"]https://i.imgur.com/Lf4ushY.png[/IMG]

You you have two ways to fix the NAT/DMZ problem.

Either you can directly use the vi editor (my OpenEmbedded Linux OS installed on the device has only vi support) to edit the file mobileap_cfg.xml and update DMZ value and port forwarding values.

[IMG="mobileap_cfg.xml"]https://i.imgur.com/xtIxflb.png[/IMG]

[IMG="My mobileap_cfg.xml file"]https://i.imgur.com/rhMyn7i.png[/IMG]

or you can enable the security tab by editing the menu.js file which is located in /WEBSERVER/www/ directory. Now I had a PTCL Charji R660. If you have a different device, your files will be located elsewhere with different sets of issues.

[IMG="webserver pages now editable and accessible under root"]https://i.imgur.com/yIp8So7.png[/IMG]

You can do whatever you want! :)

Older Updates

Update# 02:

DMZ is now working !! :)

[IMG="DMZ tested"]https://i.imgur.com/g45nxKZ.png[/IMG]

Update# 03

Successfuly unlocked the hidden security tab but still untested. Will test it shortly.

[IMG="Security Tab unlocked"]https://i.imgur.com/ohHwmSK.jpg[/IMG]

Update # 04

Successfully unlocked Wizard

[IMG="Connection Wizard, PTCL Charji"]https://i.imgur.com/JYoy4Y4.png[/IMG]

Update# 05

NAT Rules persisting and working, tested by download torrents and using CanYouSeeMe.ORG

[IMG="NAT Rules"]https://i.imgur.com/3RQk4EQ.png[/IMG]

[IMG="NAT Types and NAT settings"]https://i.imgur.com/u495KnF.png[/IMG]

Torrents Downloads working on max available speeds

[IMG="Torrent Download via Qbittorent"]https://i.imgur.com/MYXTzM6.png[/IMG]