Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What models this applies to? My 2013-era technicolor c2100t DSL modem branded Century Link has bin conf file format not same. #3

Open
porteusconf opened this issue Jan 13, 2024 · 1 comment

Comments

@porteusconf
Copy link

Thanks for this help. May want to list some model numbers that this repo works with or does not work with.

My c2100t DSL has a different conf file format, so this repo won't help as is, but I hope to use some of your tricks. My goal is to tweak the conf file to see if it has a setting enable_support_console which might help me get into a currently hidden gui pages, such as for voip, disabling the phone-home tr-069 backdoor, etc. I can do most of these tweaks via telnet, but a gui would be nice. At 192.168.0.1/sc_login.html I see a login webpage (different from usual login) saying:

"Support Console Login
The support console is password protected and for support personal use only.

I think username may or may not be "support' and am using john to try to crack hash for support username, one of 4 in /var/passwd (tho I'm unsure if web/telnet logins even use /var/passed at all. In the BusyBox shell I am root)

admin:ZWFEDMOlJsHLc:0:0:Administrator:/:/bin/sh
support:93w3dxGvxiwrU:0:0:Technical Support:/:/bin/sh
user:ucFjFaNuflT46:0:0:Normal User:/:/bin/sh
nobody:K9ArR06Djlc5M:0:0:nobody for ftp:/:/bin/sh

WARNING: As noted elsewhere, even with newest firmware, if you turn on telnet, it does NOT honor the LAN-only setting, and port 22 is open on the internet! You have been warned! If I get anywhere I'll setup my own gist for the c2100t (which may also work with c2000t) and link to it here. My conf file info:

$ wc C2100TConfig-2023-10-14.conf 
    0     2 86088 C2100TConfig-2023-10-14.conf

$ cat C2100TConfig-2023-10-14.conf 
TCH-CHKSUM02�e+�� 0xfae44bf�����0x89537b87������7H2sSXk++WhZAW+CrVMvPJyaoII09S3rF6KZoNFw6Tux5lCcGYCicdf0icnyx/1mDyr/0bJUM5T+QXLk1PlnOsDa4vE5petAPI+C36ktbd/v4o3VVDOjMALrlPRlfHSD6knS1Yi9r54uDcqXGLUTmOvImG0eoVm8RP/
...
JUttWneM7nyaytsJwomVn3zU7yTEowGA4vniZZ19kBuxMl3XNQTZT0GRtoVYfIOERtTQLx0OwpsV6DBuFAeZKUlYw6Upy4r0OVgvnyShRpK1mLeskMFw6FQnNqyoJ5D2VJ92gCoTgs51Bn5UBQx+RZCQISFY0L9K644qjIIiHNQUvqywcHYrdN1g9onU8Ns4TjKiYggaJz/dF7UnLMLycJxIA==
$ 
@antnks
Copy link
Owner

antnks commented Jan 14, 2024

This has been tested on multiple newer models of Technicolor: TG389ac, TG789vac, Telia X1
Older models may use different encryption. Can you tar the whole rootfs and share together with a sample config file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants