scMerlin scMerlin 2.5.9 - Service and script control menu for Asuswrt-Merlin, Feb. 12, 2025

[Ripshod]

I've just run it again:

! Suspicious string found in file /tmp/var/wwwext/scmerlin/top.htm

Shows how random false positives are. I admit it does appear to be scMerlin related, but given that these are custom scripts i'm hardly surprised. These scripts should not be there on Asus firmware, and Asus firmware is what these scanners expect to see.

 

[dave14305]

I've just run it again:

! Suspicious string found in file /tmp/var/wwwext/scmerlin/top.htm

Shows how random false positives are. I admit it does appear to be scMerlin related, but given that these are custom scripts i'm hardly surprised. These scripts should not be there on Asus firmware, and Asus firmware is what these scanners expect to see.

It’s probably finding the top output of a previous file string check from itself in the top.htm file displayed in scMerlin. Checking for vulnerabilities results in false positive vulnerabilities.

 

[Viktor Jaep]

I have scMerlin installed. I ran the script from /tmp rather than from a FAT32 USB stick. I did not get a false positive.

The list of suspicious file strings is in the script:

suspicious_strings="8ewMqdWf9K|3deCSCIoaQ|NIwZI3pvmJ|Klq1BtftKC|gSqf7pcEQQ|asi\.sh|31\.170\.22\.195|asi\.ok|asi\.ko|1-arm-le-t|1-mips-le-t|e4DtOMgfOorTPVnvSXm1D|downl_crt.sh"

Quite the comprehensive list of malware there...

 

[Martinski]

Release Notes for scMerlin 2.5.8 version (now available):

1) Fixed a cron job display issue on the webGUI.

See the following post for details & screenshots regarding the display issue:

scMerlin - scMerlin 2.5.7 - Service and script control menu for Asuswrt-Merlin, September 23, 2024

Release Notes for the scMerlin 2.5.6 version now available [2024-June-30]: 1) FIXED code to get the correct temperatures on the webGUI for the "GT-BE98_PRO" router. 2) Some code improvements.

www.snbforums.com

 

[Tarek Yag]

Thanks for the update @Martinski! I confirm that my cron job display issue got fixed with this update.
Did you forget to update this thread's title?

 

[thelonelycoder]

Did you forget to update this thread's title?

Done.

 

[AlexHK]

I noticed on my BE86U that the sitemap doesn't show (it's working on AX86U). Not that I need it, but I just wanted to post this.

Not sure how to "debug".

scMerlin 2.5.8

 

[Ripshod]

I noticed on my BE86U that the sitemap doesn't show (it's working on AX86U). Not that I need it, but I just wanted to post this.

Not sure how to "debug".

scMerlin 2.5.8

View attachment 63682

Never noticed before (never looked) but the same on the BE88U. Probably just needs a little rework for the 3006 firmware, I trust it'll be sorted in time.
(beta tester available. Hint, hint).

 

[Martinski]

I noticed on my BE86U that the sitemap doesn't show (it's working on AX86U). Not that I need it, but I just wanted to post this.

Not sure how to "debug".

scMerlin 2.5.8
...

Never noticed before (never looked) but the same on the BE88U. Probably just needs a little rework for the 3006 firmware, I trust it'll be sorted in time.
(beta tester available. Hint, hint).

Can one of you (or both) post a clear screenshot showing any error messages that may appear on the "Browser Console" window?
I might have some time next weekend to take a look at this, but note that it is a low priority at this point.
Just FYI.

 

[AlexHK]

Can one of you (or both) post a clear screenshot showing any error messages that may appear on the "Browser Console" window?
I might have some time next weekend to take a look at this, but note that it is a low priority at this point.
Just FYI.

Clicking scMerlin tab:


Clicking Sitemap tab (no error, what you see only shows because I have verbose enabled);

 

[Ripshod]

I'm not seeing any errors - just warnings
Sitemap tab:


scMerlin tab:

 

[AlexHK]

Yup, that's what I meant with "no error, what you see only shows because I have verbose enabled". If verbose is off in the console, there is nothing at all (on the sitemap tab).

 

[Ripshod]

Ah

Yup, that's what I meant with "no error, what you see only shows because I have verbose enabled". If verbose is off in the console, there is nothing at all (on the sitemap tab).

You use chrome/edge and can see mention of javascript. I tried chrome and got the exact same warnings.
But in my normal browser (firefox) the messages are totally different. I have ensured javascript is enabled in both firefox and chrome.

Additional:

 

[CaptnDanLKW]

After a recent ISP outage, I didn't bother looking at my router for about 5 days. Just noticed that my vnstats were not updating, and the scmerlin hover/tab expansion was not working, then noticed no addon tabs were listed. Not sure if this is a scmerlin issue or something else that failed to trigger.

One notable item is that the router rebooted due to a power failure while the internet was still down, so....

Scribe's uiScribe wasn't working either.

Tried restarting entware services, didnt fix the ui but vnstatd did restart.

Restarted scribe manually, scribe and uiScribe came back to life.

within scribe, from the command line see this...

sed: /tmp/menuTree.js: No such file or directory
WebUI for scMerlin is available at:
WebUI page not found

Tried restarting httpd too.

Any thoughts if this is scmerlin, or if the entware process to build the addon tabs is broke, and scmerlin is just throwing that error as a byproduct of somthing else wrong? (if the latter, any ideas? for the next time...) I am going to reboot.

 

[visortgw]

After a recent ISP outage, I didn't bother looking at my router for about 5 days. Just noticed that my vnstats were not updating, and the scmerlin hover/tab expansion was not working, then noticed no addon tabs were listed. Not sure if this is a scmerlin issue or something else that failed to trigger.

Scribe's uiScribe wasn't working either.

Tried restarting entware services, didnt fix the ui but vnstatd did restart.

Restarted scribe manually, scribe and uiScribe came back to life.

within scribe, from the command line see this...

sed: /tmp/menuTree.js: No such file or directory
WebUI for scMerlin is available at:
WebUI page not found

Tried restarting httpd too.

Any thoughts if this is scmerlin, or if the entware process to build the addon tabs is broke, and scmerlin is just throwing that error as a byproduct of somthing else wrong. (if the latter, any ideas? for the next time...) I am going to reboot...

Possible USB corruption, especially if you are using flash stick as oppsed to SSD. If you haven't already, try restalling add-ons one by one.

 

[visortgw]

I see this myself, but only occasionally. If I open a fresh session the hover/tab expansion does work, but whilst browsing the WebUI it'll just stop working like it's not even there. Don't know if I'm being dumb but it seems to happen a lot more when browsing the addon pages. Most of the time now I'm not relying on it, going through WRT tabs all the time instead. May as well not be installed.
Versions in the siggie below.
This is also frequently seen:
View attachment 63928
Before it's even suggested this is a new ssd bought same time as the router, and this behaviour has been seen over 2 installs in 3 days. SSD is clean.

@RMerlin has suggested during alpha1 that these types of issues are due to scMerlin incompatibilities due to changes in the 3006 web UI. Read above and below his response...

Asuswrt Merlin 3006.102.3 Alpha1 for GT-BE98 Pro​

 

[Ripshod]

@RMerlin has suggested during alpha1 that these types of issues are due to scMerlin incompatibilities due to changes in the 3006 web UI. Read above and below his response...

Asuswrt Merlin 3006.102.3 Alpha1 for GT-BE98 Pro​

Isn't anyone going to pick up the reins on this? Would be great if someone could - hint, hint

 

[Martinski]

...
within scribe, from the command line see this...

sed: /tmp/menuTree.js: No such file or directory
WebUI for scMerlin is available at:
WebUI page not found

This suggests that the "/tmp/menuTree.js" file was accidentally or deliberately removed sometime after the reboot startup initialization was completed, which is when each of the add-ons remounts its associated WebGUI page.

I'll issue a release shortly that will address this scenario so that every time the SSH CLI menu is run, it will check if the WebGUI page has already been mounted. If not found mounted, the script will run the code to remount the WebGUI.

 

[Martinski]

Isn't anyone going to pick up the reins on this? Would be great if someone could - hint, hint

Unfortunately, I don't own or have direct access to a BE-class router for developing purposes so that makes debugging this kind of "incompatibility issues" rather difficult (if not impossible).

Hopefully, someone else with a BE router can take a look at these types of problems.

 

[Martinski]

Release Notes for scMerlin 2.5.9 version (now available):

1) Added "export PATH" statement to give the built-in binaries higher priority than the equivalent Entware binaries.

2) Added and modified code so that every time the SSH CLI menu is run, it checks if the WebGUI page has already been mounted. If not found mounted, the script will run the code to remount the WebGUI.

3) Various code improvements & fine-tuning.