Orbic/Kajeet RC400L

The Orbic RC400L is an inexpensive LTE modem primarily designed for the US market, and the original device for which Rayhunter is developed.

It is also sometimes sold under the brand Kajeet RC400L. This is the exact same hardware and can be treated the same.

You can buy an Orbic using bezos bucks, or on eBay.

Please check whether the Orbic works in your country, and whether the Orbic RC400L supports the right frequency bands for your purpose before buying.

Supported Bands

The Network Installer

Since Rayhunter 0.6.0 there is an alternative, experimental installation procedure at ./installer orbic-network that is supposed to eventually replace ./installer orbic. It does not require any USB driver installation and works identically on Windows, Mac and Linux. From our testing it works much more reliably on Windows than ./installer orbic does.

The drawback is that the device's admin password is required.

1. Connect to the Orbic's network via WiFi or USB tethering
2. Run ./installer orbic-network
3. The installer will ask you to log into the admin UI on localhost:4000. The password for that is the same as the WiFi password.
4. As soon as you're logged in, the installer will continue and reboot the device.

note: On Kajeet devices the default admin password is $m@rt$p0tc0nf!g, on most other orbic devices the default admin password is the same as the wifi password. If the password has been changed you can reset it by pressing the button under the back case until the unit restarts.

Obtaining a shell

After running through the installation procedure, you can obtain a root shell by running adb shell or ./installer util shell. Then, inside of that shell you can run /bin/rootshell to obtain "fakeroot."

If you are using the network installer, there will not be a rootshell and ADB will not be enabled by the installer. Instead you can use ./installer util orbic-start-telnet and connect to the hotspot using nc 192.168.1.1 23. On Windows you might not have nc and will have to use WSL for that.