To access the built-in TFTP server, you need a TFTP client that can provide a password along with the file write request. Once such client can be found at http://redsand.net/projects/linksys-tftp/linksys-tftp.php

Once you've used the SecretCGICommands to enable the TFTP server, and you've used the ShadowDataHack to temporarily change the protected admin password, then you can start writing files to the device to do certain things:

• image files
• passwd.txt

 @<UPGRADE_DOWNLOAD_START>@@
 Write passwd start
 ###################################
 # Error: Write passwd failed. #
 ###################################