Go Back   The Scream! > COMPUTER RELATED > Hardware > ADSL Router Mods

Reply
 
Thread Tools Display Modes
  #121  
Old 17-April-2013, 04:07
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

I think unlokia has solved this for you but I'll just add this..


The Bright box runs embeded linux so may read ext / ext2 / ext3 natively although I have not tried this, some apple OSs' also read this natively also I belive although I could be wrong As I've only ever used a Mac once.

To mount HFS+ though I would imagine that would most certainly mean reverse engineering the firmware which is not something I could do.

To put stuff from your Mac onto disk and share it over the network you could try ext /ext2
If you use the above hidden admin links and enable manufacturer mode then the brightbox will give you root telnet and you should be able to mount ext partitions if it does not automatically.

Please make sure you have a backup if you try this as I have not tried it.
Reply With Quote
  #122  
Old 17-April-2013, 04:14
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

I forgive you

Yes, that would be good, but it won't be yet, if ever, since I am currently working on another Orange product - the "San Diego" mobile 'phone

Take care.
Originally Posted by unlokia View Post

Nice piece of hardware, I'm not into smartphones yet. I was looking at the Bt vision box (the black one) but from what I've seen they are winCE based and the serial access is all locked off at the CPU, Anybody have any sugestion for router or embeded linux based hardware they want hacking?

Peace
Reply With Quote
  #123  
Old 17-April-2013, 04:17
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

so has it been hacked and can i use another isp
Originally Posted by caledonia666 View Post


Yes you will need a telnet client and a PC you can connect to the bright box over ethernet and set the IP address of manually.

if so please explain in easy steps
Originally Posted by caledonia666 View Post

All In due time
Reply With Quote
  #124  
Old 19-April-2013, 18:43
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

I think unlokia has solved this for you but I'll just add this..


The Bright box runs embeded linux so may read ext / ext2 / ext3 natively although I have not tried this, some apple OSs' also read this natively also I belive although I could be wrong As I've only ever used a Mac once.

To mount HFS+ though I would imagine that would most certainly mean reverse engineering the firmware which is not something I could do.

To put stuff from your Mac onto disk and share it over the network you could try ext /ext2
If you use the above hidden admin links and enable manufacturer mode then the brightbox will give you root telnet and you should be able to mount ext partitions if it does not automatically.

Please make sure you have a backup if you try this as I have not tried it.
Originally Posted by whitenight639 View Post
Hi Whitenight, thanks for helping out. The issue is not so much with the format of the drive (as I'm happy to work with FAT32/NTFS even though HFS+ would be useful). The issue is that the Brightbox doesn't seem to recognise a partition of a drive if it is on a harddrive where other partitions also exist.

i.e. the Brightbox only seems to work with external drives that have only a single partition (of a valid format).

Do you think this is something that could modified through the root telnet?

At the moment I have a gorgeous 4TB drive sat next to my BB with no way to link them - a little frustrating

Forgive me if I've not understood anything from your post - I'm a networking novice.
Attached Thumbnails
Click image for larger version

Name:	photo-7.JPG
Views:	1978
Size:	594.0 KB
ID:	2355  
Reply With Quote
  #125  
Old 19-April-2013, 19:13
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

That's Strange, I am able to easily have 2 types of partition on one USB drive show up on the BB and they show up as a network shared folder.




It could be the size of the partition maybe? tell me again the size and filesystem of each partition on your drive? also this might sound stupid but looking at it but is it extrnally powered as i doubt the BB will have enough juice coming thru the usb to power that peice of art.

Also when creating my partitions both are setup as primary partitions.
Reply With Quote
  #126  
Old 19-April-2013, 21:08
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

That's Strange, I am able to easily have 2 types of partition on one USB drive show up on the BB and they show up as a network shared folder.




It could be the size of the partition maybe? tell me again the size and filesystem of each partition on your drive? also this might sound stupid but looking at it but is it extrnally powered as i doubt the BB will have enough juice coming thru the usb to power that peice of art.

Also when creating my partitions both are setup as primary partitions.
Originally Posted by whitenight639 View Post
It could be that Basil has a "GUID" partition scheme on his drive (the default for Intel Macs/Mac drives) whereas a PC/Linux user would generally have a partition scheme of the type "MBR" (Master Boot Record).
Reply With Quote
  #127  
Old 19-April-2013, 21:13
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Hi Whitenight, thanks for helping out. The issue is not so much with the format of the drive (as I'm happy to work with FAT32/NTFS even though HFS+ would be useful). The issue is that the Brightbox doesn't seem to recognise a partition of a drive if it is on a harddrive where other partitions also exist.

i.e. the Brightbox only seems to work with external drives that have only a single partition (of a valid format).

Do you think this is something that could modified through the root telnet?

At the moment I have a gorgeous 4TB drive sat next to my BB with no way to link them - a little frustrating

Forgive me if I've not understood anything from your post - I'm a networking novice.
Originally Posted by iambasil View Post

Hello Basil

One question - when you partitioned and formatted the large drive you wish to use, did you use "Disk Utility" in Mac OS X to do so? If so, I think it defaults to "GUID" partition type, whereas Windows/Linux disks on x86 PC hardware use "MBR" (Master Boot Record) partition types as default, which could be where the issue is here. I would not expect a layman to know the difference between these, so this situation you have could well be caused by that being the case.



~~@@ UPDATE @@~~



I just created a 3-partitioned flash drive, using "GUID" partition scheme, as follows:


GUID (also known as GPT) partitioned drive:

Partition 1: FAT32

Partition 2: NTFS

Partition 3: EXT3


I then plugged this drive into Bright Box, and only the FAT32 and NTFS partitions were mounted and became shared on the network, with R/W access. The EXT3 is unavailable. Based upon this, I cannot see that "GUID" partition schemes are the problem. I am at a loss, for now.


@whitenight639


I doubt that a *Desktop* external drive is being bus powered over USB; I'm certain that this is likely to be a mains adaptor powered drive.




~~@@ UPDATE 2 @@~~

Your problem *could* be in the USB controller chipset used by the Lacie drive - there could be some incompatibility between it and the hardware/firmware used in Bright Box. I'll investigate further.

@iambasil:


You may like to try and see if there is a firmware update available for your Lacie "Blade Runner" drive, as that *could* be the issue, and it can't hurt to try it


Take care.

Last edited by unlokia; 19-April-2013 at 22:37.
Reply With Quote
  #128  
Old 19-April-2013, 23:43
ctrlaltdeny ctrlaltdeny is offline
Registered User
 
Join Date: Apr 2013
Posts: 1
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Anyone know where I can find a copy of the WWW folder from the EE branded firmware of the Brightbox like there is for the Orange branded version? Thanks
Reply With Quote
  #129  
Old 20-April-2013, 00:57
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

So i put FAT32, NTFS, HFS+ and ext4 partition on one drive and it again only mounted the NTFS and FAT32 partition although going into telnet and rooting around the other partitions do show up but are not mounted and does not look like those filesystems are recognised, which is what I expected.



Code:
root@BrightBox:/ # df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                 5568      5568         0 100% /
/dev/sda1              1010680     20152    990528   2% /ramdisk/mnt/usb1_1
/dev/sda2              1726140        56   1726084   0% /ramdisk/mnt/usb1_2

Code:
root@BrightBox:/ # ls -al /ramdisk/mnt
drwxr-xr-x    6 root     root            0 .
drwxrwxr-x    7 root     root            0 ..
drwxr-xr--    2 root     nasusers        0 usb1_1
drwxr-xr--    2 root     nasusers        0 usb1_2
drwxr-xr--    2 root     nasusers        0 usb1_3
drwxr-xr--    2 root     nasusers        0 usb1_4
So seeing as both me and unlokia get more than one to mount then Maybe the problem is the size of the partitions, as NTFS and FAT32 have limitations,


FAT32
The boot sector uses a 32-bit field for the sector count, limiting the FAT32 volume size to 2 TB for a sector size of 512 bytes and 16 TB for a sector size of 4,096 bytes


Maximum Sizes on NTFS Volumes
In theory, the maximum NTFS volume size is 2 32 clusters. However, even if there were hardware available to supply a logical volume of that capacity, there are other limitations to the maximum size of a volume.
One of these limitations is partition tables. By industry standards, partition tables are limited to 2 32 sectors. Sector size, another limitation, is a function of hardware and industry standards, and is typically 512 bytes. While sector sizes might increase in the future, the current size puts a limit on a single volume of 2 terabytes (2 32 * 512 bytes, or 2 41 bytes).
For now, 2 terabytes should be considered the practical limit for both physical and logical volumes using NTFS.

This is why I asked for the size of your partitions, maybe you could experiment by booting gparted and putting 2 extra, small partitions on the disk and see what the brightbox does.
Reply With Quote
  #130  
Old 20-April-2013, 13:50
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Guys, this is looking more promising. Thanks so much for your continued efforts.

The partitions were 1.8TB (FAT32) and 2.2TB (HFS+) and it is mains powered. I've just also created a third partition (FAT) at 200GB (reducing the HFS+ to 2TB). It also appears to be GUID (see bottom right of 1st screengrab).

After reconnecting the drive to the BB and a restart of everything, 10 mins later OSX recognised the BB in Finder (as it did before), but after another 10 mins it still can't connect (see 2nd screengrab - just get spinning at bottom right). I have to head out but will check back when I return!

I did try and check the firmware version, but Lacie's firmware updater didn't even recognise the drive. The drive was only just released, which could be why.

Thanks guys!

B

Additional boring detail: I didn't use DiskUtility to partition it originally as the Lacie installer has some thing that allegedly only allows the 'eco-mode' to work if you install their 'disk manager' software (which I've yet to figure out). I did have a little experience with the Master Boot Record business as I set up another drive as MBR (from memory) in order to have an NTFS and HFS+ on the same drive (allowing me to backup my Windows 'Bootcamp' partition on the same drive as I backup my OSX).
Attached Thumbnails
Click image for larger version

Name:	Screen shot 2013-04-20 at 13.32.15.png
Views:	195
Size:	115.6 KB
ID:	2356   Click image for larger version

Name:	Screen shot 2013-04-20 at 13.43.33.png
Views:	163
Size:	37.2 KB
ID:	2357  
Reply With Quote
  #131  
Old 20-April-2013, 16:52
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

@iambasil:

Hi Basil I hope you're enjoying/you've enjoyed the gorgeous weather?!

Just a point of note, and pardon me for asking an obvious question... but you have *enabled* the drive to be shared, in the settings, haven't you?:

http://help.ee.co.uk/system/selfserv...D=VIEW_ARTICLE

The good news is that I have just taken delivery of a brand spanking new "EE" branded Bright Box, due to my Orange one having a rather un-tactile power switch, so I'll be hacking again within the next day or three

Taken from the above URL, is a screenshot pertaining to drive formats supported:



Take care, God bless you,

Matt.

Last edited by unlokia; 20-April-2013 at 17:01.
Reply With Quote
  #132  
Old 20-April-2013, 17:16
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

@iambasil:

Hi Basil I hope you're enjoying/you've enjoyed the gorgeous weather?!

Just a point of note, and pardon me for asking an obvious question... but you have *enabled* the drive to be shared, in the settings, haven't you?

The good news is that I have just taken delivery of a brand spanking new "EE" branded Bright Box, due to my Orange one having a rather un-tactile power switch, so I'll be hacking again within the next day or three

Take care, God bless you,

Matt.
Originally Posted by unlokia View Post
Thanks Matt, good question re: enabling it. I have no idea how to switch this on or off. Some investigation I did with the drive directly connected to mac (Mac1):
  • Under the 'Sharing & Permissions' when I go to Get Info, it says 'You can read & write'
  • I opened up Windows through Parallels (which creates a network to share my OSX drive). I could access all partitions through this
  • I got another Mac (Mac2) and wirelessly enabled file sharing from Mac1. Mac2 could only access (read+write) the HFS+ partition through filesharing, not the FAT/FAT32 partitions.
Where would I check/enable the share settings?

Update on the connection from my last post - 3 or 4 hours later and it was still the spinning and still saying 'connecting'. The drive was active and I could hear it whir during this though.

Sorry this hasn't been straight forward, and I realise that this kind of troubleshooting isn't really the purpose of this thread - so apologies for that, and many thanks for your support guys.

B

****Update****
I've just re-read your post. Yup, sharing is enabled on the router. Small stick drives work no problems. I'm happy for only the FAT32 partition to be shared, but I'm failing!
Reply With Quote
  #133  
Old 20-April-2013, 17:20
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Thanks Matt, good question re: enabling it. I have no idea how to switch this on or off. Some investigation I did with the drive directly connected to mac (Mac1):
  • Under the 'Sharing & Permissions' when I go to Get Info, it says 'You can read & write'
  • I opened up Windows through Parallels (which creates a network to share my OSX drive). I could access all partitions through this
  • I got another Mac (Mac2) and wirelessly enabled file sharing from Mac1. Mac2 could only access (read+write) the HFS+ partition through filesharing, not the FAT/FAT32 partitions.
Where would I check/enable the share settings?

Update on the connection from my last post - 3 or 4 hours later and it was still the spinning and still saying 'connecting'. The drive was active and I could hear it whir during this though.

Sorry this hasn't been straight forward, and I realise that this kind of troubleshooting isn't really the purpose of this thread - so apologies for that, and many thanks for your support guys.

B

****Update****
I've just re-read your post. Yup, sharing is enabled on the router. Small stick drives work no problems. I'm happy for only the FAT32 partition to be shared, but I'm failing!
Originally Posted by iambasil View Post
Hello

You are very welcome.

When you say you "enabled file sharing from Mac1" - would you post screenshots, and explain a little further, since there are myriad ways files can be shared using Macs.

Thanks
Reply With Quote
  #134  
Old 20-April-2013, 17:33
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Hello
When you say you "enabled file sharing from Mac1" - would you post screenshots, and explain a little further, since there are myriad ways files can be shared using Macs.
Originally Posted by unlokia View Post
Thanks, sure..
In the 'Sharing' settings of Mac1, I enable filesharing (see attached).
On Mac2 I connect using the admin credentials of Mac1. This gives me full access to the files on Mac1 from Mac2.
I couldn't see the FAT or FAT32 partitions - only the HFS+ one (which allowed me to write to it also).

**update**
Also, it's shared using AFP
Attached Thumbnails
Click image for larger version

Name:	Screen shot 2013-04-20 at 17.29.07.png
Views:	178
Size:	23.0 KB
ID:	2358  
Reply With Quote
  #135  
Old 20-April-2013, 17:50
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Thanks, sure..
In the 'Sharing' settings of Mac1, I enable filesharing (see attached).
On Mac2 I connect using the admin credentials of Mac1. This gives me full access to the files on Mac1 from Mac2.
I couldn't see the FAT or FAT32 partitions - only the HFS+ one (which allowed me to write to it also).

**update**
Also, it's shared using AFP
Originally Posted by iambasil View Post
Ah!

This is what I thought you'd done. What you have done is enabled the files on the Mac to be shared to other people on the same network as that to which the Mac is connected, but this has no bearing on your ability/inability to view the shared drive plugged into Bright Box.

You've basically carried out the same procedure for the Mac, as is done on the Bright Box when you enable "USB File Sharing" - you're sharing a drive connected to the device upon which you are making these sharing changes - it ONLY affects that device (in this example, your Mac).

I hope this clarifies what you're doing, and where to go next?

Thank you.
Reply With Quote
  #136  
Old 20-April-2013, 17:57
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

The reason I tested the filesharing from mac to mac was because I thought I may have it limited on the hard drive itself. And then I realised you were referring to the router (where it is enabled already).

I am encouraged that you and whitenight seem to have got multiple partitions viewable through the Brightbox. But in all honesty, I have no idea where to go next!
Reply With Quote
  #137  
Old 20-April-2013, 19:04
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

The reason I tested the filesharing from mac to mac was because I thought I may have it limited on the hard drive itself. And then I realised you were referring to the router (where it is enabled already).

I am encouraged that you and whitenight seem to have got multiple partitions viewable through the Brightbox. But in all honesty, I have no idea where to go next!
Originally Posted by iambasil View Post
As a matter of proving, you could try removing the HFS+ Mac OS X partition, and try having only FAT32 and NTFS parts, and see if that helps - just as a process of elimination.

I enjoy helping you I love a challenge!
Reply With Quote
  #138  
Old 21-April-2013, 01:21
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Gosh... I can give it a go for testing, but I'll need an HFS+ on this drive in future.

To be honest, given all these issues, I'm beginning to think I should let go of the hard drive backup thoughts and just trust the cloud as a solution. This is so painful... and even if I do manage it, I'm then gonna need to thing of protecting my external drives somehow. If only this was all more simple.... anyway, I'll try what you suggested tomorrow and see what happens.

Thanks Matt, I'm sure I echo the thoughts of many in the appreciation I have of the efforts of people like yourself and whitnight who are out there with the interest and patience to try and help folk like me. Many thanks.
Reply With Quote
  #139  
Old 21-April-2013, 08:12
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Gosh... I can give it a go for testing, but I'll need an HFS+ on this drive in future.

To be honest, given all these issues, I'm beginning to think I should let go of the hard drive backup thoughts and just trust the cloud as a solution. This is so painful... and even if I do manage it, I'm then gonna need to thing of protecting my external drives somehow. If only this was all more simple.... anyway, I'll try what you suggested tomorrow and see what happens.

Thanks Matt, I'm sure I echo the thoughts of many in the appreciation I have of the efforts of people like yourself and whitnight who are out there with the interest and patience to try and help folk like me. Many thanks.
Originally Posted by iambasil View Post
So have you been able to view your multiple partitions on the brightbox through the webUI?

So if your getting the partitions show up in the BB webUI but you cannot browse them from your Mac then it narrows it down to a networking issue.

I'll look into it when I'm back from the Mrs'.
Reply With Quote
  #140  
Old 21-April-2013, 10:54
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Anyone know where I can find a copy of the WWW folder from the EE branded firmware of the Brightbox like there is for the Orange branded version? Thanks
Originally Posted by ctrlaltdeny View Post

The EE should have the same WWW folder, I can't remember off the top of my head but Have you had a root around the bin directory? the BB makes use of symlinks quite alot in the filessystem, I will post the path for you when i get back home.
Reply With Quote
  #141  
Old 21-April-2013, 14:43
iambasil iambasil is offline
Screamer
 
Join Date: Apr 2013
Posts: 11
Default Re: [NEW] Orange "Bright Box" router hacking :-)

So have you been able to view your multiple partitions on the brightbox through the webUI?

So if your getting the partitions show up in the BB webUI but you cannot browse them from your Mac then it narrows it down to a networking issue.

I'll look into it when I'm back from the Mrs'.
Originally Posted by whitenight639 View Post
Hi white night, nope I've not seen any partitions from this drive on the network yet unfortunately. Also nothing on web UI. Frustrating... it seems like it should be working given your experience.
Reply With Quote
  #142  
Old 21-April-2013, 17:19
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Hi white night, nope I've not seen any partitions from this drive on the network yet unfortunately. Also nothing on web UI. Frustrating... it seems like it should be working given your experience.
Originally Posted by iambasil View Post

Don't give up, we'll get to the bottom of it soon, I'm not at home yet but I just wonder if unlockia is running the manufacturer mode firmware as I am, and if this mounts all readable / acessable filesystems by default, maybe the stock firmware dosn't? or only mounts one share at a time?

I'll do some more looking into your issue when im home, And post the easy how to guide on how to unlock the BB for other ISPs.
Reply With Quote
  #143  
Old 21-April-2013, 18:02
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

How to open the "EE" (or "Orange") Bright Box router:


http://www.youtube.com/watch?v=yvVd-TXfXe0


Okay, so I took some screenshots of my "Orange" branded box with "EE" firmware, and my pure "EE" box (the new one which has TORX T9 screws!) and here are the firmware differences:



The boot code is a different, higher version on the "EE" branded box, which came in the post last week.

Take care you folks.

Last edited by unlokia; 22-April-2013 at 03:35.
Reply With Quote
  #144  
Old 22-April-2013, 12:56
lunarsi lunarsi is offline
Screamer
 
Join Date: Aug 2001
Location: Near a nice park
Posts: 4
Cool Re: [NEW] Orange "Bright Box" router hacking :-)

Ok, I have successfully changed the ISP username by hijacking the javascript after the check for @fs and before the form is submitted to the backend, ie without any need for telnet...!

Big thanks to whitenight639 for providing the info about atmpvc.htm which got me thinking it was possible...

Sorry it's not the most elegant of solutions but it works. Notes follow in italics

1. You need Firefox
2. Install Firebug addon. This is a javascript debugger
3. Log into your Brightbox router
4. Go to Basic Set-Up but leave the username ending in @fs
5. From the firefox Menus:Tools>Web Developer>FireBug>Open Firebug. or F12 key shortcut
6. In the firebug pane: click on script and enable
7. In the firebug pane: search for: return subForm(f, cPage, subFormWANADSLETHConf, 3)
8. In the firebug pane: you should now be able to see something like this:

PHP Code:
600    if (ATM_Protocol!="0"&&ATM_Protocol!="1")
601    {
602        setCfg("ATM_AUTODNS"+if_str,f.ATM_AUTODNS.value);
603        setCfg("ATM_DNSA"+if_str,f.ATM_DNSA.value);
604        setCfg("ATM_DNSB"+if_str,f.ATM_DNSB.value);
605    }
606    return subForm(fcPagesubFormWANADSLETHConf3); 


The script you are looking at will be atmpvc.htm?t=some-random-number.

9. In the firepug pane: put in a breakpoint by clicking on the line number, line 606 in my view. You will know when you have done this as a red circle will appear to the left of the line number
10. In the router window click on the button: Save Settings
11. In the firebug pane: The javascript execution should now be paused where you put the breakpoint. You will know this as there will be a little play triangle inside the red circle
12. In the firebug pane: Click on console and enable it
13. In the firebug pane: in the box at the bottom where you will find >>> type the following command:
PHP Code:
setCfg("ISP_Username1","bthomehub@btbroadband.com"


Put whatever username you need for your isp between the inverted commas and press return. You will know that it has executed when the firebug pane echos your command.
14. In the fire bug pane: return to the script page and find the continue button on the top right and press it. It looks like a play button. Or press F8 instead
15. The brighbox should now apply the settings and when the Basic-Setup page is reloaded you should find that the username should be set. Note you cannot Save Settings on this page again without redoing these steps to bypass the check for @fs in the username

If your ISP requires a blank password, BT does not, then after step 13 you can force this with the command:
PHP Code:
setCfg("ISP_Password1",""


I performed all this on an Orange Brightbox and it worked fine. I attached it to my DSL line and everything was good BUT I could not log in to the router. I did not worry about this at that point. I assumed maybe it would need to be disconnected from the DSL because it was using a disallowed ISP username, so I decided to look at it later when I had a bit of time. I was able to log in to the router a couple of days later and found that the router had uprgaded itself to the EE firmware so that is probably why I could not log in at first. So I wonder whether the router locks itself when autoupdating. I'm glad that I didn't disconnect it and try to sort it immediately!!

I'm very happy as I have now have a decent router running and I can put this Homehub rubbish in the back of the cupboard for emergency use only. Yay!

I rechecked these instructions on the EE firmware and they are the same. Good luck if you try this.

Reply With Quote
  #145  
Old 22-April-2013, 13:20
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)


I performed all this on an Orange Brightbox and it worked fine. I attached it to my DSL line and everything was good BUT I could not log in to the router. I did not worry about this at that point. I assumed maybe it would need to be disconnected from the DSL because it was using a disallowed ISP username, so I decided to look at it later when I had a bit of time. I was able to log in to the router a couple of days later and found that the router had uprgaded itself to the EE firmware so that is probably why I could not log in at first. So I wonder whether the router locks itself when autoupdating. I'm glad that I didn't disconnect it and try to sort it immediately!!

I'm very happy as I have now have a decent router running and I can put this Homehub rubbish in the back of the cupboard for emergency use only. Yay!

I rechecked these instructions on the EE firmware and they are the same. Good luck if you try this.

Originally Posted by lunarsi View Post
Nice work bro, its a different way than I have done it, maybe you can use the script to set other TR69 Params, and with unlockia having run an alternative webserver on the box you could create a fully alternative web admkin interface with all of the params settable, it would be totally customisable, great work.

the solution I came up with is as follows, and requires telnet:

Code:
Also posted here:
http://pastebin.com/j8nyerip

Orange and EE Brightbox Unlocking Instructions:
Prerequisites:

A)Access to a telnet client on a pc with wired ethernet that you can 
set the IP address of manually.

B)A list of the following information for your new service provider:

Broadband Username:
Broadband Password:
Protocol: PPPoA / PPPoE
VPI/VCI: (normally 0/38 in UK)
Encapsulation: LLC / VC MUX
Internet IP Address: or Dynamic
IP Address: (if static)
Subnet Mask: (if static)
DNS IP Address: or obtain from ISP
Primary DNS: or obtain from ISP
Secondary DNS: or obtain from ISP
Connection Type: always connected / triggered by traffic
Idle Time: (minutes)
Authentication Protocol: CHAP / PAP / Auto
MTU: (576~1492) 

1:Set your PC IP address to 192.168.1.99
(It helps to disable other network connection that could interfere, if 
they are on the same subnet).

2: Connect brightbox via Ethernet cable to PC and Turn the 
brightbox on.

3:Login to the webUI at http://192.168.1.1 with the admin details 
printed on your brightbox.4:Go to the following URL in another Browser Tab 
http://192.168.1.1/u132xzp32aai.htm

Click on the Manufacturer mode and click the confirm to the 
warning.


5:Wait for around 4 minutes, get a brew then turn the router off 
and on again.


6:On your PC open a Telnet connection by opening a command 
line and typing telnet, windows users may need to download and 
install Putty Telnet /SSH client, Linux will do Telnet from terminal 
natively in most Distros. So in linux you enter the following 
information and press return: 

Telnet
Open
192.168.1.1
Admin
Password
Then you should get the Brightbox promt asking for username 
(Admin) and Password (password). Once logged in you will get a 
root terminal. 

7:enter the following:/bin/arc_tr69

8:Wait 5 minutes you will see output like: Register LANDevice 
Successful
Message Q 0x0 create
Run Tr69_Task task id=0x803
Run Tr69_TimerTask task id=0xc04

If this has not changed after a few minutes press Ctr+C to return 
to root prompt, continue with step 8.

8:enter the following:/bin/util_ccfg_cli reinit
You should see:
Reinit Successfully !9:Go back to your web browser and Log into the WebUI like before 
but with;

User:Admin
Password:password

Now go and change all of your ADSL settings to your new ISP 
EXCEPT for username leave that, Note because we restored 
factory firmware settings it will have forgotten all of the advanced 
Broadband ADSL settings So make sure you have them to hand 
first. 

10:enter the following:
/bin/util_ccfg_cli get username@wan#001

And it may output your existing setting, of not don't worry continue 
to set it.

11:enter the following:
/bin/util_ccfg_cli set username@wan#001=YOORUSERNAME@myISP.com

obviously substitute YOORUSERNAME@myISP.com for your real 
credentials from ISP.
12:Check that it has changed by doing step 9 again.

13:enter the following:
/bin/util_ccfg_cli commitcfg [flash]

This is important otherwise your changes will not be saved

14:enter the following:
rebootNow you can wait and log in to the WebUI to see your changed 
username, 
note however that the pages Javascript will not let you save any 
settings on that page, hence why we changed them before in step 

9.if you got some wrong or forgot some then you can either change 
the username in the webUI back to the old one and re-enter 
setting then repeat what we just did, or you can set the settings 
via telnet just like we did with the username, but 'getting' and 
'setting' different parameters of that wan#001 section,
The list of these TR69 sections and params are available by 
entering: /bin/util_ccfg_cli showcfg If this does not produce a 

list of settable parameters then the list is available on the pastebin 
here: http://pastebin.com/9bXSKAqZ
Reply With Quote
  #146  
Old 22-April-2013, 13:24
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Ok, I have successfully changed the ISP username by hijacking the javascript after the check for @fs and before the form is submitted to the backend, ie without any need for telnet...!

Big thanks to whitenight639 for providing the info about atmpvc.htm which got me thinking it was possible...



I performed all this on an Orange Brightbox and it worked fine. I attached it to my DSL line and everything was good BUT I could not log in to the router. I did not worry about this at that point. I assumed maybe it would need to be disconnected from the DSL because it was using a disallowed ISP username, so I decided to look at it later when I had a bit of time. I was able to log in to the router a couple of days later and found that the router had uprgaded itself to the EE firmware so that is probably why I could not log in at first. So I wonder whether the router locks itself when autoupdating. I'm glad that I didn't disconnect it and try to sort it immediately!!

Originally Posted by lunarsi View Post

try loging in with username: admin passwordassword because the manufacturer mode of the firmware will automatically default to these values, maybe the same for your situation / firmware, if not u can set them with a serial connection and interupting the boot process as unlockia has previously described.
Reply With Quote
  #147  
Old 22-April-2013, 14:45
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

Just incase peeps missed the long list of TR69 params that are settable on the BB:

Code:
root@BrightBox:/ # /bin/util_ccfg_cli showcfg

Section: manuf
phase=manuf
configmode=ADSL

Section: mgmtAccount
username=admin
password=password

Section: lan#001
netsection=lan
ifname=br0
ip4addr=192.168.1.254
ip4mask=255.255.255.0
proto=static
dhcp4s_eb=1
dhcp4pool_s=192.168.1.2
dhcp4pool_e=192.168.1.252
dhcp4lease=172800
dhcp_vendor_option=
domainname=workgroup
defaultroute=0
vlan=1
dhcp_reserved_client_001=
dhcp_reserved_client_002=
dhcp_reserved_client_003=
dhcp_reserved_client_004=
dhcp_reserved_client_005=
dhcp_reserved_client_006=
dhcp_reserved_client_007=
dhcp_reserved_client_008=
dhcp_reserved_client_009=
dhcp_reserved_client_010=
dhcp_reserved_client_011=
dhcp_reserved_client_012=
dhcp_reserved_client_013=
dhcp_reserved_client_014=
dhcp_reserved_client_015=
dhcp_reserved_client_016=
dhcp_reserved_client_017=
dhcp_reserved_client_018=
dhcp_reserved_client_019=
dhcp_reserved_client_020=
dhcp_reserved_client_021=
dhcp_reserved_client_022=
dhcp_reserved_client_023=
dhcp_reserved_client_024=
dhcp_reserved_client_025=
dhcp_reserved_client_026=
dhcp_reserved_client_027=
dhcp_reserved_client_028=
dhcp_reserved_client_029=
dhcp_reserved_client_030=
dhcp_reserved_client_031=
dhcp_reserved_client_032=

Section: lan#002
netsection=lan
ifname=br1
ip4addr=192.168.2.1
ip4mask=255.255.255.0
proto=static
dhcp4s_eb=1
dhcp4pool_s=192.168.2.2
dhcp4pool_e=192.168.2.254
dhcp4lease=43200
dhcp_vendor_option=
domainname=guest
defaultroute=0
vlan=2
dhcp_reserved_client_001=
dhcp_reserved_client_002=
dhcp_reserved_client_003=
dhcp_reserved_client_004=
dhcp_reserved_client_005=
dhcp_reserved_client_006=
dhcp_reserved_client_007=
dhcp_reserved_client_008=
dhcp_reserved_client_009=
dhcp_reserved_client_010=
dhcp_reserved_client_011=
dhcp_reserved_client_012=
dhcp_reserved_client_013=
dhcp_reserved_client_014=
dhcp_reserved_client_015=
dhcp_reserved_client_016=
dhcp_reserved_client_017=
dhcp_reserved_client_018=
dhcp_reserved_client_019=
dhcp_reserved_client_020=
dhcp_reserved_client_021=
dhcp_reserved_client_022=
dhcp_reserved_client_023=
dhcp_reserved_client_024=
dhcp_reserved_client_025=
dhcp_reserved_client_026=
dhcp_reserved_client_027=
dhcp_reserved_client_028=
dhcp_reserved_client_029=
dhcp_reserved_client_030=
dhcp_reserved_client_031=
dhcp_reserved_client_032=

Section: lan#003
netsection=lan
ifname=br2
ip4addr=192.168.3.1
ip4mask=255.255.255.0
proto=static
dhcp4s_eb=1
dhcp4pool_s=192.168.3.2
dhcp4pool_e=192.168.3.254
dhcp4lease=43200
dhcp_vendor_option=
domainname=guest2
defaultroute=0
vlan=3
dhcp_reserved_client_001=
dhcp_reserved_client_002=
dhcp_reserved_client_003=
dhcp_reserved_client_004=
dhcp_reserved_client_005=
dhcp_reserved_client_006=
dhcp_reserved_client_007=
dhcp_reserved_client_008=
dhcp_reserved_client_009=
dhcp_reserved_client_010=
dhcp_reserved_client_011=
dhcp_reserved_client_012=
dhcp_reserved_client_013=
dhcp_reserved_client_014=
dhcp_reserved_client_015=
dhcp_reserved_client_016=
dhcp_reserved_client_017=
dhcp_reserved_client_018=
dhcp_reserved_client_019=
dhcp_reserved_client_020=
dhcp_reserved_client_021=
dhcp_reserved_client_022=
dhcp_reserved_client_023=
dhcp_reserved_client_024=
dhcp_reserved_client_025=
dhcp_reserved_client_026=
dhcp_reserved_client_027=
dhcp_reserved_client_028=
dhcp_reserved_client_029=
dhcp_reserved_client_030=
dhcp_reserved_client_031=
dhcp_reserved_client_032=

Section: wanctl
type=ADSL
password_vis=0

Section: wanETH
ifname=eth3
proto=5
vlan=1
ipassigned=1
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=60
retrytime=30
keepalivetime=60
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0
password_vis=0

Section: wan#001
ifname=atm0
proto=2
vlan=1
ipassigned=1
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=bthomehub@btbroadband.com
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#002
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#003
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#004
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#005
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#006
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#007
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: wan#008
ifname=
proto=0
vlan=1
ipassigned=0
ip4addr=0.0.0.0
ip4mask=0.0.0.0
ip4gateway=0.0.0.0
authprotocol=0
username=
password=
idletime=0
retrytime=0
keepalivetime=0
mtu=1492
connecttype=0
static_dns=0
pri_dns=0.0.0.0
sec_dns=0.0.0.0

Section: system
lang_code=0
time_zone=PST8PDT
gui_style=1
remote_mgmt_en=0
remote_mgnt_ip=0.0.0.0
remote_mgnt_mask=255.255.255.255
host_name=
wan_type=0
active_wan_type=1
ppp_pass_thru=0
default_ip=192.168.1.1
ccfg_bk_fname=backup.bin
hidepage=0
hidekey=5;m6ek

Section: dns
pri_dns_server_ip=0.0.0.0
pri_dns_bind_to_if=1
sec_dns_server_ip=0.0.0.0
sec_dns_bind_to_if=0
third_dns_server_ip=0.0.0.0
third_dns_bind_to_if=0

Section: wireless
WIRELESS_ENABLE=1
AP_CHMODE=11ng40plus
AP_PRIMARY_CH=0
CTRY_CODE=GB
DTIM_PERIOD=1
BEACON_INTERVAL=100
FRAG_THRESH=2346
RTS_THRESH=2347
WMM_MODE=1
WPS_MODE=1
WPS_PIN=
WPS_PCB=
POWER_SAVING=0
WPS_APLOCK_LIMIT=3

Section: wifissid#001
AP_SSID=wlan
BSS_ENABLE=1
MAX_ASSOC=8
AP_SECMODE=2
AP_CYPHER=0
AP_WPA=2
AP_WPA_AUTH=0
broadcast=1
PSK_KEY=password
WEP_KEYA=WKEY1
WEP_KEYB=WKEY2
WEP_KEYC=WKEY3
WEP_KEYD=WKEY4
AP_PRIMARY_KEY=0
vlan=1
dn_bw_enable=1
up_bw_enable=1
upstream_bw=0
dnstream_bw=0

Section: wifissid#002
AP_SSID=MISSID01
BSS_ENABLE=0
MAX_ASSOC=6
AP_SECMODE=0
AP_CYPHER=0
AP_WPA=2
AP_WPA_AUTH=0
broadcast=1
PSK_KEY=WPA_PSKEY
WEP_KEYA=WKEY1
WEP_KEYB=WKEY2
WEP_KEYC=WKEY3
WEP_KEYD=WKEY4
AP_PRIMARY_KEY=0
vlan=1
dn_bw_enable=0
up_bw_enable=0
upstream_bw=0
dnstream_bw=0

Section: wifissid#003
AP_SSID=MISSID02
BSS_ENABLE=0
MAX_ASSOC=6
AP_SECMODE=0
AP_CYPHER=0
AP_WPA=2
AP_WPA_AUTH=0
broadcast=1
PSK_KEY=WPA_PSKEY
WEP_KEYA=WKEY1
WEP_KEYB=WKEY2
WEP_KEYC=WKEY3
WEP_KEYD=WKEY4
AP_PRIMARY_KEY=0
vlan=1
dn_bw_enable=0
up_bw_enable=0
upstream_bw=0
dnstream_bw=0

Section: wifimacfilter
FILTER_ENABLE=0
FILTER_ACCESS=0

Section: wifimacfilteraddr#001
MACFILTER_ADDR=

Section: dot1x
cypher_suite=0x22
dot1XRekeySeconds=3600
dot1XRekeyPackets=1000
ssnRekeySeconds=2000000
ssnRekeyPackets=1000
dot1XRekeying=2
ssnRekeying=2
strictUpdate=1
enableOS=0
enableWEP=1
enable1X=0
enableACL=0
enableSSN=1
wpa2flag=0x01
enableSSNPSK=0
ssnpsk256keyfiled=0
WEPKeySize=5
DefaultKeyId=0
ssnpskASCIIkey=123456789
ssnpsk256key=0
srv_ip=0.0.0.0
secret_key=
nas_id=
srv_type=1
srv_port=1812
acc_srv_port=1813
idle_session_timeout=30000
reAuthPeriod=36000
quietPeriod=60
txPeriod=5000
suppTimeout=30000
reAuthCount=2
enable1Xauthen=1
role=0

Section: httpd
login_timeout=15
wait_timeout=50
remote_mgnt=0
http_browse_service=0
http_browse_port=8000

Section: tr69
Enable=1
FirstUseDate=0000-00-00T00:00:00
URL=
Username=
Password=
PeriodicInformEnable=1
PeriodicInformInterval=3600
PeriodicInformTime=0001-01-01T00:00:00
ParameterKey=1234
CommandKey=
ProvisioningCode=
ConnReqURL=
ConnReqUsername=admin
ConnReqPassword=!12345678
Tr69_m_reboot=0
TransferFaultCode=0
TransferStartTime=
TransferEndTime=
LogEnable=0

Section: pvc#001
netsection=wan001
encaps=1
vpi=0
vci=38
qos=2
pcr=7000
scr=7000
mbs=7000

Section: pvc#002
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#003
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#004
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#005
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#006
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#007
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: pvc#008
netsection=none
encaps=0
vpi=0
vci=0
qos=0
pcr=0
scr=0
mbs=0

Section: usb
maxSupportNum=2
enable=1
maxnum=2,1,8

Section: drive_now
drive_num=0
driveinfoa=
volumea=
driveinfob=
volumeb=

Section: printer_now
num=0
model=

Section: umts_now
num=0
Manufacturer=
model=

Section: samba_history
drive1=
drive2=
drive3=
drive4=
drive5=
drive6=
drive7=
drive8=
history='{"drive_num":"0"}'

Section: samba_sharelist
drive1=
drive2=

Section: samba
enable=1
preSmbEnb=1
def_smbEnable=1
def_computerName=EasyBox
def_computerDescription=EasyBox File Server
def_groupName=WORKGROUP
def_remoteEnable=0
smbEnable=1
computerName=DanielBox
computerDescription=Arcadyan File Server
groupName=WORKGROUP
remoteEnable=0

Section: printer
enable=1
queuename=lpt1

Section: upnp
enable=0

Section: ntp
enable=1
tz=23
interval=600
servercnt=2
server_pri=6
server_sec=7
dls=1
year=1900
month=1
day=1
hour=0
minute=0
second=0

Section: log
category=All

Section: qos_dft
total_fwg_num=8
dft_fwg=fwg00_0
lnk_num=1
lnk0=2,20000,10000,dft_lnk,1
vif0_0=20,-0,~,eth1 ppp0,,8,2,6/30,0
fwg00_0=200,w,1
fwg00_1=201,w,2
fwg00_2=202,w,4
fwg00_3=203,w,8
fwg00_4=204,w,16
fwg00_5=205,w,32
fwg00_6=206,s,2
fwg00_7=207,s,1
clsfy_seq=00 01
ru00_mac=
ru00_inif=
ru00_inphyif=eth0
ru00_srcip=
ru00_dstip=
ru00_aporproto=tcp udp
ru00_sport=
ru00_dport=5001
ru00_tos=
ru00_8021p=
ru00_ethtype=
ru00_pktlen=
ru00_act=no,no,0,
ru01_mac=
ru01_inif=
ru01_inphyif=eth0
ru01_srcip=
ru01_dstip=
ru01_aporproto=tcp udp
ru01_sport=
ru01_dport=5002
ru01_tos=
ru01_8021p=0
ru01_ethtype=
ru01_pktlen=
ru01_act=0x2e,no,7,

Section: qos_bkt

Section: pwrsave
enable=0
max_period=3
period1_b=00:00:00
period1_e=00:00:00
period2_b=00:00:00
period2_e=00:00:00
period3_b=00:00:00
period3_e=00:00:00

Section: ddns
enable=0
provider=0
username=
password=
hostname=

Section: Firewall
firewall_enable=1
filter_enable=0
mac_filter_enable=0
dmz_enable=0
dos_func=1
pingWAN=0
ripDef=0
pkt_frag_enable=0
tcp_conn_enable=1
udp_session_enable=1
ftp_srv_enable=1
h323_srv_enable=1
tftp_srv_enable=1
sip_srv_enable=1
rtsp_srv_enable=1
l2tp_srv_enable=1
pptp_srv_enable=1
ipsec_srv_enable=1
frag_wait=120
tcp_syn_wait=120
tcp_fin_wait=120
tcp_conn_idle=7200
udp_session_idle=120
h323_idle=3600
dos_session=300
dos_session_minute=250

Section: FWAccessControl#001
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#002
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#003
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#004
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#005
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#006
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#007
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#008
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#009
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWAccessControl#010
description=
start_ip=
end_ip=
block_service=
user_protocol=
user_port=
schedule_id=

Section: FWSchedule#001
name=
comment=
start_time=
end_time=

Section: FWSchedule#002
name=
comment=
start_time=
end_time=

Section: FWSchedule#003
name=
comment=
start_time=
end_time=

Section: FWSchedule#004
name=
comment=
start_time=
end_time=

Section: FWSchedule#005
name=
comment=
start_time=
end_time=

Section: FWSchedule#006
name=
comment=
start_time=
end_time=

Section: FWSchedule#007
name=
comment=
start_time=
end_time=

Section: FWSchedule#008
name=
comment=
start_time=
end_time=

Section: FWSchedule#009
name=
comment=
start_time=
end_time=

Section: FWSchedule#010
name=
comment=
start_time=
end_time=

Section: FWMACFilter
mac01n=
mac02n=
mac03n=
mac04n=
mac05n=
mac06n=
mac07n=
mac08n=
mac09n=
mac10n=
mac11n=
mac12n=
mac13n=
mac14n=
mac15n=
mac16n=
mac17n=
mac18n=
mac19n=
mac20n=
mac21n=
mac22n=
mac23n=
mac24n=
mac25n=
mac26n=
mac27n=
mac28n=
mac29n=
mac30n=
mac31n=
mac32n=

Section: FWURLBlocking
url01n=
url02n=
url03n=
url04n=
url05n=
url06n=
url07n=
url08n=
url09n=
url10n=
url11n=
url12n=
url13n=
url14n=
url15n=
url16n=
url17n=
url18n=
url19n=
url20n=
url21n=
url22n=
url23n=
url24n=
url25n=
url26n=
url27n=
url28n=
url29n=
url30n=

Section: FWDMZ#001
public_ip=
client_ip=

Section: FWDMZ#002
public_ip=
client_ip=

Section: FWDMZ#003
public_ip=
client_ip=

Section: FWDMZ#004
public_ip=
client_ip=

Section: FWDMZ#005
public_ip=
client_ip=

Section: FWDMZ#006
public_ip=
client_ip=

Section: FWDMZ#007
public_ip=
client_ip=

Section: FWDMZ#008
public_ip=
client_ip=

Section: NAT
func=1

Section: NATAddressMapping#001
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#002
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#003
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#004
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#005
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#006
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#007
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#008
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#009
srcip=
dstipb=
dstipe=

Section: NATAddressMapping#010
srcip=
dstipb=
dstipe=

Section: NATSpecialApp#001
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#002
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#003
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#004
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#005
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#006
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#007
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#008
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#009
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATSpecialApp#010
Global_Port=
Trigger_Port=
pProtocol=
tProtocol=
eFlag=

Section: NATPubServ#001
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#002
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#003
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#004
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#005
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#006
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#007
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#008
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#009
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#010
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#011
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#012
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#013
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#014
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#015
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#016
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#017
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#018
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#019
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: NATPubServ#020
Global_Port=
Protocol=
Private_IP=
Private_Port=
func=

Section: UPNPD
upnp_default_enable=0
upnp_default_upnp_igd=1
upnp_enable=1
upnp_igd=1
tr64_enable=0
ptr_enable=0
debug_log=0

Section: DLNAS
upnp_av=1
upnp_default_av=1
music_num=0
video_num=0
picture_num=0
dlna_scanning=0
web_upnp_av=1

Section: adsl
op_mode=0
bit_swap_en=1
SRA_en=1

Section: snmp
agent=enable
trap=disable
communitycnt=5
community1=enable,public,ro
community2=enable,private,ro
servercnt=5
server1=disable,0.0.0.0,public

Section: qos
enable=1
bw_hs=0
bw_hs_more=0
bw_hr=0
bw_hr_more=0
bw_h=0
bw_h_more=0
bw_m=0
bw_m_more=0
bw_n=0
bw_n_more=0
bw_l=0
bw_l_more=0
bw_lr=0
bw_lr_more=0
bw_ls=0
bw_ls_more=0
rule1n=IPTV;2;;1;192.168.1.67;;0;;;;FF;01;;;30
rule2n=
rule3n=
rule4n=
rule5n=
rule6n=
rule7n=
rule8n=
rule9n=
rule10n=
rule11n=
rule12n=
rule13n=
rule14n=
rule15n=
rule16n=Default;17;;;;;;;;;;;;;40

Section: NAS
ftpd_enable=1
ftpd_port=21
smbd_enable=1
smbd_workgroup=WORKGROUP
autoshare=1
security=0
autoshare_username=
autoshare_password=
autoshare_priv=

Section: NASUSERS#001
username=
password=
priv=

Section: NASUSERS#002
username=
password=
priv=

Section: NASUSERS#003
username=
password=
priv=

Section: NASUSERS#004
username=
password=
priv=

Section: NASUSERS#005
username=
password=
priv=

Section: NASSHARES#001
name=
path=
uuid=
users=
comment=

Section: NASSHARES#002
name=
path=
uuid=
users=
comment=

Section: NASSHARES#003
name=
path=
uuid=
users=
comment=

Section: NASSHARES#004
name=
path=
uuid=
users=
comment=

Section: NASSHARES#005
name=
path=
uuid=
users=
comment=

Section: NASSHARES#006
name=
path=
uuid=
users=
comment=

Section: NASSHARES#007
name=
path=
uuid=
users=
comment=

Section: NASSHARES#008
name=
path=
uuid=
users=
comment=

Section: UMTS
func=1
operator=EE
apn=consumerbroadband
pin_code=0000
atd_no=ATDT*99#

Section: DFT_SECTION
dnld_state=PASS
root@BrightBox:/ # 
root@BrightBox:/ # /bin/util_ccfg_cli showcfg UMTS

Section: UMTS
func=1
operator=EE
apn=consumerbroadband
pin_code=0000
atd_no=ATDT*99#
root@BrightBox:/ #
Reply With Quote
  #148  
Old 22-April-2013, 15:26
unlokia unlokia is offline
Screamager
 
Join Date: Jun 2006
Posts: 237
Default Re: [NEW] Orange "Bright Box" router hacking :-)

You clever old beans!

So all my serial port hacking is now unnecessary?





#### IMPORTANT ####

I would strongly advise that people backup their router config before executing *any* of the above:


Last edited by unlokia; 22-April-2013 at 15:41.
Reply With Quote
  #149  
Old 22-April-2013, 17:18
lunarsi lunarsi is offline
Screamer
 
Join Date: Aug 2001
Location: Near a nice park
Posts: 4
Default Re: [NEW] Orange "Bright Box" router hacking :-)

try loging in with username: admin passwordassword because the manufacturer mode of the firmware will automatically default to these values, maybe the same for your situation / firmware, if not u can set them with a serial connection and interupting the boot process as unlockia has previously described.
Originally Posted by whitenight639 View Post
When I logged in, it was with my custom password. To be clear, the router's webUI would not load at all when I first put it online. So if you just hacked your ISP username on an old orange Brightbox, put the router online and can't get the webUI, then it might just be upgrading its firmware to EE. Don't panic and try later...

Not sure I want the Brightbox upgrading itself again. Wonder how to disable...?
Reply With Quote
  #150  
Old 22-April-2013, 18:29
whitenight639 whitenight639 is offline
Screamer
 
Join Date: Mar 2013
Posts: 62
Default Re: [NEW] Orange "Bright Box" router hacking :-)

When I logged in, it was with my custom password. To be clear, the router's webUI would not load at all when I first put it online. So if you just hacked your ISP username on an old orange Brightbox, put the router online and can't get the webUI, then it might just be upgrading its firmware to EE. Don't panic and try later...

Not sure I want the Brightbox upgrading itself again. Wonder how to disable...?
Originally Posted by lunarsi View Post
You could start by shutting out the ISP by turning off the TR69 stuff, There could possibly be other ways the BB looks for firmware updates, eg through a script run from it's webserver, but I would imagine it refers to the params listed above, I think the manufacturers and ISPs would want just one way to configure and deploy this stuff otherwise things would get complicated.

Code:
Section: tr69
Enable=1
FirstUseDate=0000-00-00T00:00:00
URL=
Username=
Password=
PeriodicInformEnable=1
PeriodicInformInterval=3600
PeriodicInformTime=0001-01-01T00:00:00
ParameterKey=1234
CommandKey=
ProvisioningCode=
ConnReqURL=
ConnReqUsername=admin
ConnReqPassword=!12345678
Tr69_m_reboot=0
TransferFaultCode=0
TransferStartTime=
TransferEndTime=
LogEnable=0
Code:
Section: system
lang_code=0
time_zone=PST8PDT
gui_style=1
remote_mgmt_en=0
remote_mgnt_ip=0.0.0.0
remote_mgnt_mask=255.255.255.255
host_name=
wan_type=0
active_wan_type=1
ppp_pass_thru=0
default_ip=192.168.1.1
ccfg_bk_fname=backup.bin
hidepage=0
hidekey=5;m6ek
Reply With Quote
Reply

Tags
419, adsl, beauty, brightbox, broadband, compare, delay, dhcp, dns, feature, files, firmware, flash, hack, hacking, home, key, line, lock, make, mobile, nat, network, orange, port, product, router, settings, sharing, tools, web, wireless

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Help!! Weird Router Issue The Latman Networking 17 15-January-2011 17:39
Staic IP, Port Forward, DMZ CanineKiller TalkTalk 4 03-April-2010 09:43
Make Your Own Router - secrets revealed silver Networking 356 09-February-2010 01:13
Valve's Blocks Orange Box Users MAN WHO Games 5 07-November-2007 10:54


All times are GMT +1. The time now is 13:15.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2018, vBulletin Solutions, Inc.
Copyright 1999-2014 The Scream!