HowTo: Enable ssh root access στο Gennet Oxygen router της Tellas

[markelos]

Το fw 4.63 βρίσκεται προς το παρόν εδώ http://www.multiupload.com/IECHVF5KOP
Thanks to nEC

[markelos]

Ok I tried it! We don't have to downgrade! Users with fw 5.0.0 installed, follow the guide with 2 variations.
1) Replace the password of fmac with Ooxu7gook4 as provided by ikrepirdhu
2) The profile file doesn't exist so you have to create it, containing the two lines provided by the guide

[ `cat /etc/passwd | grep toor | wc -l` -ne 1 ] && echo 'toor:$1$XBE5gSzT$PPbHJsQL/43rxCYvMNO8L/:0:0:Admin User,,,:/:/bin/sh' >> /etc/passwd
[ `cat /etc/init.d/S10Firewall | grep unlock | wc -l` -ne 1 ] && echo '/etc/scripts/unlock-system.sh' >> /etc/init.d/S10Firewall

[neon2k8]

Το fw 4.63 βρίσκεται προς το παρόν εδώ http://www.multiupload.com/IECHVF5KOP
Thanks to nEC

Μπράβο nEC δόξα το θεό!

[d1t1]

I dont speak greek too! ikrepirdhu is an albanian name, i mean it isnt a name at all, dont worry im albanian too!

Anyway, HERE IS ALL YOU NEED
My router is from tring.al , it doesnt have your product password, it couldnt take any king of other firmware
like TEL02 or original fw from gennet site! At the end my product password was pipivAlNev0

So here is what i did to make it happen, get root access:
make a backup of your configuration!
first of all i did taked the idea when ikrepirdhu mentioned for the firewall file ,so how to put something there when you cant restore the backup image if you dont have the product password. If i put something it will be executed immediately because thats how firewall works! by typing at the end of the some commnad starting with "& mycommand"

i got a little weasly so i got to the web configuration > firewall > port forward > Add New
by using firebug addon for firefox i could edit the page code! i did: type tcp(because if i ), typed a random port 222 ,typed some host at "forward to" like 192.168.1.66 "inspect element" at change port
by editing
1: like here
http://i28.lulzimg.com/5d2d238652.jpg
change this
<input type="text" name="d_port" maxlength="5" size="5">
to this
<input type="text" name="d_port" maxlength="1111" size="1111">

And second by editing the javascript so i could put more than just numbers
http://i28.lulzimg.com/837b7d1a0a.jpg
The javascript code that is like this http://pastebin.com/Qjc7eYrx or this http://tinypaste.com/f6a3aa53
edit it and change it like this http://pastebin.com/sDdyCiUM or this http://tinypaste.com/f1f47d1c

After that you will be able to write what you want at change port to: *
so we write "222 & $command"
like this
222 & echo "toor1$XBE5gSzT$PPbHJsQL/43rxCYvMNO8L/:0:0:Admin User,,,:/:/bin/sh" >> /etc/passwd
anyway it doesnt work by editing /etc/passwrd because there is a protection ,when you try to edit it, the root will be disabled immediately. and you will not be able to ssh or telnet at your router anymore unless you reset configuration!

So i thinked other way, first when you type "222 & $command" and SAVE the command will be executed but after it says changes saved you can click BACK at firefox button and you wont have to inspect element again because it is saved temporary at firefox! DOnt refresh or you will inspect element!
I typed
222 & ls -la /srv/www/ > /srv/www/t.txt
and when browsed 192.168.1.1/t.txt i read a file storage that is indexed by lighttpd of the router, so i typed
222 & rm /srv/www/t.txt /srv/www/storage
and
222 & ln -s / /srv/www/storage
then browsed 192.168.1.1/storage and i could download everything from my router even /etc/product/password.txt
but somehow at my linux(bt5): fmac -s -p pipivAlNev0 backupimage.img it worked but after restore backup at the router with changed passwd file(added toor user with his hash) and with reboot of the router there was no way to login as "toor" at ssh or telnet, somehow it protected the /bin/sh users!
anyway i thinked and i thinked, there was this folder /etc/clish , we all know clish is a linux shell software that limits the commands for the specified users that login at shell or telnet! So i put an USB FLASH DRIVE, browsed "192.168.1.1/storage/mnt/my flash manufecter" and then go to firewall and type:
222 & cp -a "/etc/clish" "/mnt/my flash manufecter"
then edit at my pc the file inside my flash clish/wlan-commands.xml and at the end it looks like this
**************************************
<COMMAND name="wlan del macfilter"
help="Delete MAC address from the wireless MAC Filtering list">
<PARAM name="macaddress"
help="MAC Address"
ptype="MACADDRESS" />
<ACTION>/etc/clish/wlanacl_script.pl del ${macaddress}
</ACTION>
</COMMAND>

</VIEW>
</CLISH_MODULE>
**************************************
and changed it like this
**************************************
<COMMAND name="wlan del macfilter"
help="Delete MAC address from the wireless MAC Filtering list">
<PARAM name="macaddress"
help="MAC Address"
ptype="MACADDRESS" />
<ACTION>/etc/clish/wlanacl_script.pl del ${macaddress}
</ACTION>
</COMMAND>
<COMMAND name="wlan d1t1 bin-sh"
help="bin-sh">
<ACTION>/bin/sh
</ACTION>
</COMMAND>
</VIEW>
</CLISH_MODULE>

**************************************
At the end there is an edited example of wlan-commands.xml
Then saved and putted my usb at router and thennnnnn typed at firewall>addnew
222 & cp -a "/etc/clish/wlan-commands.xml" "/etc/wlan-commands.xml.bak"
and typed again
222 & cp -a "/mnt/my flash manufecter/clish/wlan-commands.xml" "/etc/clish/wlan-commands.xml"
So when i logged in as admin with ssh , i typed "wlan d1t1 bin-sh" and booom root access active shell
so here is what i did next:
passwd -u root #to unlock root password
passwd root #to change root password
and then loged in at ssh with username root and my password that i changed!
vi /etc/issue #change issue to change message before login at ssh
vi /etc/motd #change motd to change message after login at ssh
#for transfer of the new file get_status_dsl.pl that has the new Uptime status for the dsl i could use usb flash driver or i could use netcat at my pc and wget at my router like in this image http://i28.lulzimg.com/c955283f4b.jpg
i changed the colors of the webpage at /srv/www/styles/default.css
i changed the logo at /srv/www/icons/logo.png
And thats it root access unlimited stuff

Anyway the forcesnr somehow it doesnt work or maybe it works only in the midnight !!weird!!
I shared because your shares together helped me to get root access, im mad for root!



Links
fmac: http://www.mediafire.com/?11vamu7j22xbibz
clish edited wlan-comm.. example: http://www.mediafire.com/?5r9b26q5pb5skpd

[ikrepirdhu]

I dont speak greek too! ikrepirdhu is an albanian name, i mean it isnt a name at all, dont worry im albanian too!

hi brother , its good to not be alone in here .

even d1t1 isnt a name at all


really good the firebug way

i had some other test after the root access and i added some binaries to the system (by crosscompiling them) like quagga (routing daemon) asterisk (pbx) etc

as per the root password you just can open the firmware file (not the backup) in a hex editor and search for the string "password.txt" .

this was how i found the other passes for the Greek/Telia version of the firmware

[d1t1]

hi brother , its good to not be alone in here .

even d1t1 isnt a name at all


really good the firebug way

i had some other test after the root access and i added some binaries to the system (by crosscompiling them) like quagga (routing daemon) asterisk (pbx) etc

as per the root password you just can open the firmware file (not the backup) in a hex editor and search for the string "password.txt" .

this was how i found the other passes for the Greek/Telia version of the firmware

yeah i know about the hex way to get password.txt passs! anyway im at your PM now

[neon2k8]

d1t1 when i tried the trick for the ipv6 firmware (to enable root access, snr changing etc.) everything went ok but this is what happened to me: the moden was synchronizing at an adsl2+ rate but all speed tests showed that my line's rate was no more than 7.500 bps maximum! Example: modem says 13.500 bps downstream, speed test says... 7.000!!!! This has happened with ipv6 firmware only. If i use the greek tellas 4.63 ipv4 only firmware, everything works fine. Is there a way to make sure that the modem not only synchronizes in a adsl2+ rate but achieves an according rate in speedtests too?

[d1t1]

d1t1 when i tried the trick for the ipv6 firmware (to enable root access, snr changing etc.) everything went ok but this is what happened to me: the moden was synchronizing at an adsl2+ rate but all speed tests showed that my line's rate was no more than 7.500 bps maximum! Example: modem says 13.500 bps downstream, speed test says... 7.000!!!! This has happened with ipv6 firmware only. If i use the greek tellas 4.63 ipv4 only firmware, everything works fine. Is there a way to make sure that the modem not only synchronizes in a adsl2+ rate but achieves an according rate in speedtests too?

There are only two things why this happens!

First: You pay your isp for only 7Mbps speed regardless that the sync goes 13.5Mbps, maybe trying to put static ips same as the ips that where from the dynamic ones could get you full speed of sync, and thats why you get 7Mbps

Second: Maybe speed test servers that offer the speedtest doesnt have more than 7 or are too are busyy, dont try to speedtest because you cant know for sure whats your actual max download speed.
try like this: download something using IDM (IDM LINK:http://d1t1.googlecode.com/files/idm.exe) , start download something like this link with IDM ubuntu:http://mirror.ox.ac.uk/sites/release...sktop-i386.iso
Because ubuntu servers offer more speed than an 24Mbps adsl speed! use the IDM i provided in the link!
To know whats your speed with IDM in 10 sec whileyou started the download, the speed lets say is 1.2MB/s and that means is 1.2*8=9.6Mbps wich could be the sync of adsl(always the download goes only 1-1.5Mbps lower than the adsl sync, lets say sync is 20Mbps and you cant download more than 18.5-19Mbps).
Always calculate you download with "(downloadspeed)x8" to know how Mbps is!

I dont think firmwares does to have something with the soeed, maybe only if you use realip with ipv6, i never used one!!!!

[d1t1]

HEY GUYS , DONT TRY THE DSL UPTIME ADDON ON THE MODEM BECAUSE IT GETS HIGH CPU USAGE, UNTIL TODAY I REALIZED WHY DID THE SYNC GO DOWN! FOR THOSE WHO HAS ADDED, JUST REMOVE BY EDITING THE FILES THAT YOU ALREADY EDITED! NOW THE SYNC GOES WELL AT MY HOME

[petrogazz]

Κατάφερε κανείς να του βάλει openwrt, το έχω παροπλισμένο (γιατί μου τα έπρηξε με το wirelles) και λέω να το κάνω router;

[Geocheats2]

Παιδιά βοήθεια αν ξέρει κανείς, έπεσε στα χέρια μου το ρουτεράκι και θέλω να πάρω root access και αν είναι δυνατόν να το αναβαθμίσω με το τελευταίο firmware. Θέλω να το βάλω ως βασικό ρουτεράκι και γιαυτό χρειάζομαι 3 πράγματα snr tweak, vpn και qos τα 2 είναι εύκολα. Στο πρόβλημα όταν δίνω την εντολή

gcc -o fmac fmac.c -lcrypto

μου δίνει

fmac.c:25:25: fatal error: openssl/md5.h: No such file or directory
compilation terminated.

δοκίμασα να εγκαταστήσω gcc και openssl

[Geocheats2]

Τελικά δεν είχα κάνει upgarde τις βιβλιοθήκες

Κατάφερα να κλειδώσω από το πολύ 4,5 στα 5,8 σταθερά χωρίς αποσυνδέσεις


Έφτιαξα ένα scriptaki για εύκολη αλλαγή του snr και για να βλέπετε τα στατιστικά, απλά θέλουν αλλαγή κάποια πράγματα ώστε συνδέετε στο δικό σας και όχι στο δικό μου.

[alsthom]

Αυτό το script είναι το μόνο που χρειάζεται ή θα πρέπει πρώτα να γίνουν οι διαδικασίες της πρώτης σελίδας?

Στο snrsettings.txt δίνετε το username και το password του root χρήστη

Δεν έχω καταλάβει ποια ακριβώς είναι αυτά...
Λίγη βοήθεια?

[manolis83]

Mπορεί κάποιος να δώσει ενα λινκ για το firmware oxygen_unlock.img μετά τη διαδικασάα μέσω inux ώστε να το κάνουμε upgrade απλά για άσους δεν άχουν inux..

Ευχαριστώ πολλύ.

[markelos]

So i put an USB FLASH DRIVE, browsed "192.168.1.1/storage/mnt/my flash manufecter" and then go to firewall and type:
222 & cp -a "/etc/clish" "/mnt/my flash manufecter"

Hope you're gonna receive this...
How did you manage to mount the usb drive to 192.168.1.1/storage/mnt?