|
|||||||
| Register | FAQ | Calendar | Search | Today's Posts | Mark Forums Read |
 |
|
|
Thread Tools | Display Modes |
|
#1
 27-January-2012, 18:21
|
|||
|
|||
 [NEW] Orange "Bright Box" router hacking :-)
Here is the brand new Orange "Bright Box", manufactured by "Astoria Networks" (whoever they are) only released this week.
http://help.orange.co.uk/orangeuk/su...ireless-router Here is mine, taken apart and photographed: http://www.flickr.com/photos/2200869...7629056125153/ This little box is amazingly fast, with a 320Mhz CPU and 64Mb ram! There is a brilliant USB sharing/NAS feature built it, also (see screenshot attached), with configurable users etc. 4-PIN header pinout (it's called "J3" on the PCB): ================================ [o o o o] "J3" 1 2 3 ^---- unmarked (GROUND) 1: Not connected 2: Tx data (connect to Rx on PC) 3: Rx data (connect to Tx on PC) (4): [unlabelled] GROUND ================================ I just attached my PL-2303 USB to serial converter, found ground, Tx & Rx, and powered the little beauty on. Here is the boot log (there is a 4-pin header inside... how convenient for me): BOOT LOG:
Code:
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LSYN
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
ROMM
====
HELO
ZBSS
RAMM
====
Copyright (C) 2011 Arcadyan Technology.
SPIFLASH:
JEDEC ID: 0xc22017, size: 8192KB
block: 64KB(64), sector: 4KB(1024)
NVRAM(0) MAGIC checking passed!
NVRAM(0) CRC checking passed!
total 7 of NVRAM(0) entries loaded
NVRAM(1) MAGIC checking passed!
NVRAM(1) CRC checking passed!
total 7 of NVRAM(1) entries loaded
BOOTLOADER version 1.0.9 for BrightBox
Build Date: Wed Nov 9 10:21:21 2011 (glen_lin@buildbed)
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Memory Test Passed!
Total Memory: 67108864 bytes (64MB)
HW Version: 01
Board IP address 192.168.1.1
Board IP netmask 255.255.255.0
Gateway IP address 0.0.0.0
Server IP address 192.168.1.99
Boot image (1 or 2) 1
MAC address number 1
MAC address base 74-31-70-B5-A3-7C
*** Press any key to stop auto run (3 seconds) ***
Auto run second count down: 0
Loading primary image ...
Finished loading 8257536 bytes
DATE : Mon Nov 28 17:30:50 2011
VER : v0.09.82.0001
CRC : 3C15DF56
Code Address: 0x80002000, Entry Address: 0x801d8520
Decompression OK!
Entry at 0x801d8520
Starting program at 0x801d8520
Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011
Detected Broadcom 0x6328 CPU revision 10b0
CPU frequency is 320 MHz
64MB of RAM installed
registering 32 GPIOs
console [early0] enabled
CPU revision is: 0002a075 (Broadcom BCM63281)
board_bcm9632x: board name: AR7516AAW
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003f00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00003f00
On node 0 totalpages: 16128
free_area_init_node: node 0, pgdat 8024bb30, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 ro rootfstype=squashfs
wait instruction: enabled
Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:80
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61368k/64512k available (1912k kernel code, 3124k reserved, 436k data, 120k init, 0k highmem)
Calibrating delay loop... 318.46 BogoMIPS (lpj=159232)
Mount-cache hash table entries: 512
--Kernel Config--
SMP=0
PREEMPT=0
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
net_namespace: 536 bytes
/proc/net/netfilter/nf_cli_bw_mon created
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bio: create slab
Code:
root@BrightBox:/home/default # cat /proc/cpuinfo system type : bcm632x/AR7516AAW (0x6328/0x10B0) processor : 0 cpu model : Broadcom BCM63281 V7.5 BogoMIPS : 318.46 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 114
Code:
root@BrightBox:/home/default # cat /proc/meminfo MemTotal: 61508 kB MemFree: 30200 kB Buffers: 3656 kB Cached: 11844 kB SwapCached: 0 kB Active: 7200 kB Inactive: 11308 kB Active(anon): 3008 kB Inactive(anon): 0 kB Active(file): 4192 kB Inactive(file): 11308 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 3016 kB Mapped: 1944 kB Slab: 6824 kB SReclaimable: 836 kB SUnreclaim: 5988 kB PageTables: 312 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 30752 kB Committed_AS: 6204 kB VmallocTotal: 1032148 kB VmallocUsed: 5416 kB VmallocChunk: 990548 kB
Code:
Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011
Code:
root@BrightBox:/proc # cat mtd dev: size erasesize name mtd0: 00001000 00001000 "manuf" mtd1: 00001000 00001000 "nvram" mtd2: 006e0000 00001000 "rootfs" mtd3: 007e0000 00001000 "priimg" mtd4: 00010000 00001000 "pricfg" mtd5: 0000e000 00001000 "bootldr" Will update when more info available... Last edited by unlokia; 27-January-2012 at 20:12. 
|
|
#2
27-January-2012, 20:52
|
|||
|
|||
 Re: Orange "Bright Box": Taken apart and boot output monitored
I just made a backup of the /dev/mtdX devices (all) and ZIPped it, and uploaded to Rapidshare. The command syntax I used was
Code:
cat /dev/mtdX > filename Where the "X" in "mtdX" is the number of the partition, and "filename" is the output file: https://rapidshare.com/files/1946813...htBox_MTDs.zip MOBILE BROADBAND FUNCTIONALITY Also, it appears this router has been designed to work with USB mobile broadband dongles as well, so that you can broadcast your mobile broadband, when the dongle is in the USB port. Apparently it is in "Beta", but it's a good feature!  Here is a "usb_modeswitch" script of some sort, which pertains to aforementioned Mobile broadband dongles:
Code:
root@BrightBox:/etc/hotplug.d/3g # cat umts_modes_switch_for_3g.sh
#!/bin/sh
echo "action name is ${ACTION}" > /dev/console
echo "product name is ${PRODUCT}" > /dev/console
case "$ACTION" in
remove)
if [ -e /tmp/3g_out_times ] ; then
echo "remove usb second times" > /dev/console
else
touch /tmp/3g_out_times
# echo hotplug umts > /dev/console
# echo action @${ACTION} > /dev/console
# echo subsystem @${SUBSYSTEM} > /dev/console
# echo physdevpath @${PHYSDEVPATH} > /dev/console
# echo devpath @${DEVPATH} > /dev/console
# echo modalias @${MODALIAS} > /dev/console
# echo major @${MAJOR} > /dev/console
# echo minor @${MINOR} > /dev/console
# echo devicename @${DEVICENAME} > /dev/console
# for real 3G dongle, not storage remove....
case "${PRODUCT}" in
"12d1/141b/0")
echo "E175x Series 3G card out (E1750/Eg
i=0
while [ "$i" != "5" ]
do
i=$(($i+1))
sleep 1
if [ ! -e /tmp/read_lock_3g_dogn
i=5
fi
done
rm -f /tmp/3g_in_times
rm -f /tmp/3g_umts_mode_switch_done
rm -f /tmp/3g_pppd_dial_up_ready
rm -f /dev/ttyUSB*
rm -f /tmp/3g_dongle_ready_in_times
rm -f /tmp/arc_3g_dongle_product_info.tt
/usr/sbin/sh_3g_stop.sh
rm -f /tmp/read_lock_3g_dogle_file
/usr/sbin/util_sys_cli bgCmd "/usr/sbi"
;;
"12d1/1c08/102")
echo "E173 Series 3G card out (E173)" >g
i=0
while [ "$i" != "5" ]
do
i=$(($i+1))
sleep 1
if [ ! -e /tmp/read_lock_3g_dogn
i=5
fi
done
rm -f /tmp/3g_in_times
rm -f /tmp/3g_umts_mode_switch_done
rm -f /tmp/3g_pppd_dial_up_ready
rm -f /dev/ttyUSB*
rm -f /tmp/3g_dongle_ready_in_times
rm -f /tmp/arc_3g_dongle_product_info.tt
/usr/sbin/sh_3g_stop.sh
rm -f /tmp/read_lock_3g_dogle_file
/usr/sbin/util_sys_cli bgCmd "/usr/sbi"
;;
*)
echo "Not available for the Product ID "
;;
esac
fi
;;
add)
[ ${PRODUCT} == "12d1/1446/0" ] && {
if [ -e /tmp/3g_in_times ] ; then
echo " 12d1/1446/0 second times " > /dev/console
else
touch /tmp/3g_in_times
rm -f /tmp/3g_out_times
umts_modeswitch 12d1 1446 > /dev/console
fi
}
# E173 dongle
[ ${PRODUCT} == "12d1/1c0b/102" ] && {
if [ -e /tmp/3g_in_times ] ; then
echo " 12d1/1c0b/102 second times " > /dev/conse
else
# E173 need modeswitch twice if it's inserted b.
switchAgain=0
if [ -e /tmp/3g_out_times ] ; then
switchAgain=1
fi
touch /tmp/3g_in_times
rm -f /tmp/3g_out_times
#echo "start to modeswitch for 12d1/1c0b/102" >e
umts_modeswitch 12d1 1c0b > /dev/console
if [ $switchAgain == "1" ] ; then
#echo "AGAIN!!! start to modeswitch fore
umts_modeswitch 12d1 1c0b > /dev/console
fi
fi
}
# for real 3G dongle, not storage remove....
case "${PRODUCT}" in
"12d1/141b/0")
if [ -e /tmp/3g_dongle_ready_in_times ] ; then
echo " 12d1/141b/0 second times " > /dee
else
UMTS_PIN_CODE="`/bin/util_ccfg_cli get "
touch /tmp/3g_dongle_ready_in_times
echo "PIN CODE was ${UMTS_PIN_CODE}" >/e
# Be careful, the following task must p.
/usr/sbin/sh_3g_wan_pre_init.sh ${PRODU&
rm -f /tmp/3g_out_times
fi
;;
# E173
"12d1/1c08/102")
if [ -e /tmp/3g_dongle_ready_in_times ] ; then
echo " 12d1/1c08/102 second times " > /e
else
UMTS_PIN_CODE="`/bin/util_ccfg_cli get "
touch /tmp/3g_dongle_ready_in_times
echo "PIN CODE was ${UMTS_PIN_CODE}" >/e
# Be careful, the following task must p.
/usr/sbin/sh_3g_wan_pre_init.sh ${PRODU&
rm -f /tmp/3g_out_times
fi
;;
*)
echo "Not available for the Product ID $1"
;;
esac
;;
esac
return 0
Please find a link to a ZIP, containing the WEB UI, copied from the "www" folder. It may be incomplete, I have no idea, but here is what I have: https://rapidshare.com/files/3216522...ghtBox_www.zip [UPDATE] Telnet can be started, if you are connected via the serial port. You just do:
Code:
busybox telnetd username: admin password: Mobile broadband info popup =================== Last edited by unlokia; 27-January-2012 at 23:05.
|
|
#3
27-January-2012, 23:11
|
|||
|
|||
|
Partition booting and flashing, from backups
TO RE-FLASH PARTITIONS, YOU NEED A TFTP SERVER RUNNING ON A HOST WITH A **STATIC** IP OF: 192.168.1.99, NETMASK OF 255.255.255.0, CONNECTED DIRECTLY TO THE ROUTER *OR* ON A LOCAL NETWORK WITH THE SAME SUBNET (255.255.255.0).
(I use atftpd on Ubuntu, and store my images in /tftpboot) I connect to my Bright Box via serial header & PL2303 USB to serial converter, turn Bright Box ON, then hit any key quickly to get:
Code:
BrightBox> You need to download, unZIP and copy the contents of file: https://rapidshare.com/files/1946813...htBox_MTDs.zip ...to your tftp root folder (as mentioned, in Ubuntu using "atftpd", mine is set to /tftpboot). You need to rename them as follows: bootloader manuf nvram pricfg priimg rootfs Rename "bootloader" to "bootldr.bin", and "priimg" to "sysimg.bin" From:
Code:
BrightBox>
Code:
help
Code:
BrightBox>help
Available commands:
u Update flash image or bootloader
m Change the board's manufacture setting
c Change the board's setting
b Boot program from flash image or from host
r Reset the board
help Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
### BOOTING ONLY, WITHOUT FLASHING YET ### To boot from "sysimg.bin" stored on your tftp server, type (only TYPE what is in blue!):
Code:
BrightBox>b tftp To boot from internal "priimg" partition, type (only TYPE what is in blue!):
Code:
BrightBox>b pri ### FLASHING ~~ **POTENTIAL BRICKING AHEAD!!** ### To FLASH your backup of "sysimg.bin", type (only TYPE what is in RED!): !!! THIS WILL FLASH AND OVERWRITE YOUR "priimg" partition - BE WARNED !!!
Code:
BrightBox>u pri !!! THIS WILL FLASH AND OVERWRITE YOUR "bootloader" partition - BE WARNED !!!
Code:
BrightBox>u boot I have yet to work out how to flash "pricfg" (my settings) back to my Bright Box, to overwrite the stupid ";" semicolon bug I injected, which prevents it from totally booting (the Web UI allows you to backup/restore - why doesn't the terminal?!) Last edited by unlokia; 28-January-2012 at 20:08.
|
|
#4
28-January-2012, 15:06
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
Thoughts? Ideas? Comments?
|
|
#5
28-January-2012, 16:30
|
||||
|
||||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
v interesting, I like it
|
|
#6
28-January-2012, 16:36
|
|||
|
|||
Re: Orange "Bright Box": Taken apart and boot output monitored
v interesting, I like it why thanks.
|
|
#7
28-January-2012, 17:29
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
### WORD OF ADVICE ###
DO NOT put Semicolons ";" in the ADSL username... it caused my Bright Box to hang on boot, with this repeated message:
Code:
ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists ioctl failed. check if wl0.1 exists 
|
|
#8
29-January-2012, 17:06
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
I have now managed to reset my "Bright Box" back to factory defaults. I must have been holding the reset button down too long. D'oh!
See post #12, for how to reset ### RUNNING AN FTP SERVER FROM THE BOX #### From the serial console, do:
Code:
bftpd -d username: admin password: x Last edited by unlokia; 30-January-2012 at 15:16.
|
|
#9
29-January-2012, 21:39
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
Glad you like the router.
|
|
#10
29-January-2012, 22:25
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
Resetting the Bright Box to factory defaults
=========================== For a normal & fully functioning Bright Box, once it has fully booted (around 5 mins is safe) you can reset it to factory defaults, by holding in the "reset" button (recessed, so a paperclip or pin is needed) for 7 secs will successfully reset it. However, if, like me, you have a brightbox taken apart, connected to a serial port interface (Mine is a PL2303-based USB to serial converter) and monitored via "Hyper Terminal", "PuTTy", "minicom" (Linux) or "gtkterm" (Linux), you can hold down the "reset" button and start the 7 sec count, as soon as you see the word "Hooking" in the serial terminal (show in the code below, in red), which happens ~20 secs from switch on. If you have, like me, tried semicolon ";" injection methods in the web UI, in order to start "telnetd" service (which is what caused mine to hang, and I couldn't work out how to reset it, after trying for a DAY!) then the only way I worked out how to reset it, is from the green paragraph above.
Code:
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LSYN
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
ROMM
====
HELO
ZBSS
RAMM
====
Copyright (C) 2011 Arcadyan Technology.
SPIFLASH:
JEDEC ID: 0xc22017, size: 8192KB
block: 64KB(64), sector: 4KB(1024)
NVRAM(0) MAGIC checking passed!
NVRAM(0) CRC checking passed!
total 7 of NVRAM(0) entries loaded
NVRAM(1) MAGIC checking passed!
NVRAM(1) CRC checking passed!
total 7 of NVRAM(1) entries loaded
BOOTLOADER version 1.0.9 for BrightBox
Build Date: Wed Nov 9 10:21:21 2011 (glen_lin@buildbed)
Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz
Memory Test Passed!
Total Memory: 67108864 bytes (64MB)
HW Version: 01
Board IP address 192.168.1.1
Board IP netmask 255.255.255.0
Gateway IP address 0.0.0.0
Server IP address 192.168.1.99
Boot image (1 or 2) 1
MAC address number 1
MAC address base 74-31-70-B5-A3-7C
*** Press any key to stop auto run (3 seconds) ***
Auto run second count down: 0
Loading primary image ...
Finished loading 8257536 bytes
DATE : Mon Nov 28 17:30:50 2011
VER : v0.09.82.0001
CRC : 3C15DF56
Code Address: 0x80002000, Entry Address: 0x801d8520
Decompression OK!
Entry at 0x801d8520
Starting program at 0x801d8520
Linux version 2.6.30 (glen_lin@buildbed) (gcc version 4.1.2) #1 Mon Nov 28 17:16:00 CST 2011
Detected Broadcom 0x6328 CPU revision 10b0
CPU frequency is 320 MHz
64MB of RAM installed
registering 32 GPIOs
console [early0] enabled
CPU revision is: 0002a075 (Broadcom BCM63281)
board_bcm9632x: board name: AR7516AAW
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003f00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00003f00
On node 0 totalpages: 16128
free_area_init_node: node 0, pgdat 8024bb30, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 ro rootfstype=squashfs
wait instruction: enabled
Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:80
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61368k/64512k available (1912k kernel code, 3124k reserved, 436k data, 120k init, 0k highmem)
Calibrating delay loop... 318.46 BogoMIPS (lpj=159232)
Mount-cache hash table entries: 512
--Kernel Config--
SMP=0
PREEMPT=0
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
net_namespace: 536 bytes
/proc/net/netfilter/nf_cli_bw_mon created
NET: Registered protocol family 16
registering PCI controller with io_map_base unset
bio: create slab
RED = time to hold down reset for 7 secs, when you see "HOOKING..." in red (~20 secs from power switch ON, counting "0" when you first hold in the reset switch, and "7" when you let go; 7 REAL seconds, counting from 0-7 [not many people do that - they count "one..." the instant they hold it down, which is wrong"]) #### BACKUP YOUR BRIGHT BOX PARTITIONS #### 1/ Download the attached ZIP file, extract the shell script, and copy it to a USB drive (FAT/FAT32). 2/ Plug the USB drive into the Bright Box, and wait about 1 min for it to mount 3/ Using serial console/telnet (see above for how to start telnet) navigate to /mnt/ 4/ Run the shell script (it's in the USB drive, right? VITAL!), to make backups of your partitions:
Code:
./backup_brightbox_partitions.sh Source of script:
Code:
#!/bin/sh echo "### backing up your partitions to USB drive ####" echo "##################################################" echo "### in five seconds... ###" sleep 5 echo "##################################################" echo "processing..." cat /dev/mtd0 > manuf echo "### mtd0 done ###" cat /dev/mtd1 > nvram echo "### mtd1 done ###" cat /dev/mtd2 > rootfs echo "### mtd2 done ###" cat /dev/mtd3 > priimg echo "### mtd3 done ###" cat /dev/mtd4 > pricfg echo "### mtd4 done ###" cat /dev/mtd5 > bootldr echo "### mtd5 done ###" sleep 2 echo "All done. Backups are saved in the USB drive you plugged into Bright Box" Last edited by unlokia; 30-January-2012 at 15:20.
|
|
#11
30-January-2012, 15:57
|
|||
|
|||
|
Re: Orange "Bright Box": Taken apart and boot output monitored
I'm still astounded that 661 people have viewed this thread, and yet only ONE person has replied!
Last edited by unlokia; 31-January-2012 at 06:35.
|
|
#12
01-February-2012, 00:32
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Someone reply...
Last edited by unlokia; 01-February-2012 at 01:48.
|
|
#13
01-February-2012, 07:29
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
How does it perform as a router?
|
|
#14
01-February-2012, 14:33
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
How does it perform as a router?
|
|
#15
01-February-2012, 19:30
|
|||
|
|||
|
How to serve a web page from "Bright Box"
Okay. I downloaded another version of "busybox" called "busybox-mips" as a temporary hack, so that I have more commands I can run on Bright Box.
### HOW TO SERVE A WEB PAGE ### 1/ Download: https://rapidshare.com/files/3545138...ght_box_v1.zip 2/ UnZIP the file, and place the three files inside, into the root of a USB drive, and plug it into Bright Box USB port. 3/ From serial console/telnet, cd to /mnt/ and execute the "start_www.sh" script (you type what is in blue):
Code:
root@BrightBox:/mnt/usb1_1 # ./start_www.sh
Code:
#!/bin/sh # simple Bright Box server start script - VERY rough. # kill the built-in http server off killall arc_httpd #make a ramdisk folder for faster running mkdir /ramdisk/www #copy an imageof Bright Box :-) cp ./bbox.jpg /ramdisk/www #create a temporary, basic html page echo " [UPDATE] I just ran "strings" on "arc_httpd" binary, and got:
Code:
/lib/ld-uClibc.so.0
_init
_fini
__uClibc_main
_Jv_RegisterClasses
libarc_osix.so
_DYNAMIC_LINKING
__RLD_MAP
_GLOBAL_OFFSET_TABLE_
__dso_handle
libmapi_mid_core.so
libmapi_sys.so
libmapi_sw.so
libmapi_ccfg.so
libmapi_xdsl.so
libmapi_wlan.so
libmapi_nat.so
libmapi_lan.so
libmapi_atm.so
libmapi_3g.so
libmapi_wan.so
libmapi_vlan.so
libmapi_fw.so
libmapi_iptables.so
libmapi_nas.so
libpthread.so.0
libbcm_ethswctl.so
libarc_hal.so
libmhdl_sys.so
libmhdl_sw.so
libmhdl_ccfg.so
libmhdl_xdsl.so
libmhdl_wlan.so
libmhdl_nat.so
libmhdl_lan.so
libmhdl_atm.so
libmhdl_3g.so
libmhdl_wan.so
libmhdl_vlan.so
libmhdl_fw.so
libmhdl_nas.so
libmhdl_iptables.so
libmhdl_mid_core.so
libmhdl_clientmon.so
strlen
strncpy
sscanf
hsearch_r
hdestroy_r
strsep
hcreate_r
strpbrk
set_cgi
strchr
unlink
stdout
fprintf
exit
strcpy
fcntl
fgets
fputs
memset
sprintf
fflush
fopen
fclose
snprintf
inet_ntoa
atoi
accept
__errno_location
perror
strcmp
strtoul
strstr
strncmp
chdir
signal
socket
setsockopt
bind
listen
stderr
getpid
fork
userinfo
strcspn
str2arglist
init_check_list
fileno
fgetc
__fgetc_unlocked
Slurp_buf_buf
gmtime
strftime
no_cache
send_not_found
send_ok
fputc
__fputc_unlocked
sysinfo
CFG_get
inet_addr
init_user_config
user_logout
user_islogin
fdopen
strncasecmp
strspn
strcasecmp
HTTP_INDEX
mime_handlers
HTTP_HIDDEN_PAGES
HTTP_HIDDEN_PAGE_NUM
match_urn
bypass_check
HTTP_LOGIN
HTTP_LOGIN_ERR
HTTP_LOGIN_DUP
send_redirect
shutdown
HTTP_SERVER_PORT
HTTP_NEEDNT_AUTH
init_bypass_list
daemon
childProcessHandler
MD5Update
MD5Init
MD5Final
__ctype_b
script_handlers
Osix_osSystem
system
mapi_fw_cmdctl
sleep
strcat
user_list
_CB_CGI_CFG_ARY
admin_ip
user_escape
CFG_str2id
CFG_list
str_escape
CFG_get_str
script_Args
cgi_show_result
post_buf
init_cgi
get_cgi
user_name
user_login
HTTP_LOGIN_OK
ps_cgi_cmds
str_unescape
CFG_set_str
as_cgi_cmds
ftok
msgget
msgsnd
Tr69Rpcmethod_SendMsg
clearerr
ferror
select
cgi_safe_fread
cgi_waitfor
feof
cgi_safe_fwrite
CFG_id2str
do_script
do_auth
do_file
attach
CGI_do_DSL_CONF_ps
CGI_do_DSL_RETRAIN_ps
CGI_do_DNS_CONF_ps
CGI_do_DDNS_CONF_ps
CGI_do_LAN_CONF_ps
CGI_do_LAN_DHCP_REV_CONF_ps
CGI_do_LAN_DHCP_REV_DEL_CONF_ps
CGI_do_SYS_CONF_ps
CGI_do_SYS_RESET_ps
CGI_do_SYS_MFRESET_ps
CGI_do_SYS_BOOT_ps
CGI_do_SYS_RMT_MGMT_ps
CGI_do_WIFI_CONF_ps
CGI_do_WIFI_WEP_CONF_ps
CGI_do_WIFI_SSID_CONF_ps
CGI_do_WIFI_SSID_SEC_ps
CGI_do_WIFI_SSID_QOS_CONF_ps
CGI_do_WIFI_ADV_CONF_ps
CGI_do_WIFI_MAC_CONF_ps
CGI_do_WIFI_WPA_CONF_ps
CGI_do_WIFI_WPS_CONF_ps
CGI_do_WIFI_WPS_ENROLL_CONF_ps
CGI_do_WIFI_WPS_STARTPBC_CONF_ps
CGI_do_WIFI_DOT1X_CONF_ps
CGI_do_WAN_ATM_CONF_ps
CGI_do_WAN_ADSL_ETH_CONF_ps
CGI_do_WAN_CONN_ps
CGI_do_WAN_DISC_ps
CGI_do_NAT_CONF_ps
CGI_do_NAT_ADDRMAP_ps
CGI_do_NAT_VIRTUALSERVER_ps
CGI_do_NAT_APP_ps
CGI_do_NTP_CONF_ps
CGI_do_WANETH_CONN_ps
CGI_do_WANETH_DISC_ps
CGI_do_LOG_CLR_ps
CGI_do_TR69_CONF_ps
CGI_do_FW_CONF_ps
CGI_do_FW_FILTER_CONF_ps
CGI_do_FW_FILTER_DEL_ps
CGI_do_FW_SCHEDULE_CONF_ps
CGI_do_FW_SCHEDULE_DEL_ps
CGI_do_FW_URL_LIST_CONF_ps
CGI_do_FW_URL_LIST_CLEAR_ps
CGI_do_FW_MAC_CONF_ps
CGI_do_FW_DMZ_CONF_ps
CGI_do_FW_SPI_CONF_ps
CGI_do_UPNP_CONF_ps
CGI_do_QOS_CONF_ps
CGI_do_QOS_RULE_CONF_ps
CGI_do_QOS_RULE_EDIT_CONF_ps
CGI_do_NAS_USER_CONF_ps
CGI_do_UMTS_PINCODE_CONF_ps
CGI_do_NAS_CONF_ps
CGI_do_NAS_BASIC_CONF_ps
CGI_do_DSL_CONF_as
CGI_do_DSL_RETRAIN_as
CGI_do_DNS_CONF_as
CGI_do_DDNS_CONF_as
CGI_do_LAN_CONF_as
CGI_do_LAN_DHCP_REV_CONF_as
CGI_do_LAN_DHCP_REV_DEL_CONF_as
CGI_do_SYS_CONF_as
CGI_do_SYS_RESET_as
CGI_do_SYS_MFRESET_as
CGI_do_SYS_BOOT_as
CGI_do_SYS_RMT_MGMT_as
CGI_do_WIFI_CONF_as
CGI_do_WIFI_WEP_CONF_as
CGI_do_WIFI_SSID_CONF_as
CGI_do_WIFI_SSID_SEC_as
CGI_do_WIFI_SSID_QOS_CONF_as
CGI_do_WIFI_ADV_CONF_as
CGI_do_WIFI_MAC_CONF_as
CGI_do_WIFI_WPA_CONF_as
CGI_do_WIFI_WPS_CONF_as
CGI_do_WIFI_WPS_ENROLL_CONF_as
CGI_do_WIFI_WPS_STARTPBC_CONF_as
CGI_do_WIFI_DOT1X_CONF_as
CGI_do_WAN_ATM_CONF_as
CGI_do_WAN_ADSL_ETH_CONF_as
CGI_do_WAN_CONN_as
CGI_do_WAN_DISC_as
CGI_do_NAT_CONF_as
CGI_do_NAT_ADDRMAP_as
CGI_do_NAT_VIRTUALSERVER_as
CGI_do_NAT_APP_as
CGI_do_NTP_CONF_as
CGI_do_WANETH_CONN_as
CGI_do_WANETH_DISC_as
CGI_do_LOG_CLR_as
CGI_do_TR69_CONF_as
CGI_do_FW_CONF_as
CGI_do_FW_FILTER_CONF_as
CGI_do_FW_FILTER_DEL_as
CGI_do_FW_SCHEDULE_CONF_as
CGI_do_FW_SCHEDULE_DEL_as
CGI_do_FW_URL_LIST_CONF_as
CGI_do_FW_URL_LIST_CLEAR_as
CGI_do_FW_MAC_CONF_as
CGI_do_FW_DMZ_CONF_as
CGI_do_FW_SPI_CONF_as
CGI_do_UPNP_CONF_as
CGI_do_QOS_CONF_as
CGI_do_QOS_RULE_CONF_as
CGI_do_QOS_RULE_EDIT_CONF_as
CGI_do_NAS_USER_CONF_as
CGI_do_NAS_USER_DEL_CONF_as
CGI_do_USB_MOUNT_DEL_CONF_as
CGI_do_USB_SHARED_CONF_as
CGI_do_USB_SHARED_DEL_CONF_as
CGI_do_UMTS_PINCODE_CONF_as
CGI_do_NAS_CONF_as
CGI_do_NAS_BASIC_CONF_as
ioctl
waitpid
setsid
dup2
setenv
alarm
execvp
_cfg_get
_cfg_set
LAN_IP4ADDR_set
LAN_DHCP_LOG_100_LST_get
LAN_DHCP_CLIENT_NUM_get
LAN_PORT_STATUS_004_LST_get
LAN_DHCP_REV_024_LST_get
WANETH_PROTO_set
WANETH_VLAN_get
WANETH_VLAN_set
WANETH_PASSWORD_get
WANETH_PASSWORD_set
WANETH_STATIC_DNS_set
WANETH_PRI_DNS_set
WANETH_SEC_DNS_set
WANETH_TYPE_get
WANETH_STATUS_get
WANETH_STATUS_MAC_get
WANETH_STATUS_IP_get
WANETH_STATUS_MASK_get
WANETH_STATUS_GW_get
WANETH_STATUS_DNS_PRI_get
WANETH_STATUS_DNS_SEC_get
WANETH_STATUS_RATE_get
WAN_PROTO_set
WAN_VLAN_get
WAN_VLAN_set
WAN_PASSWORD_get
WAN_PASSWORD_set
WAN_STATIC_DNS_set
WAN_PRI_DNS_set
WAN_SEC_DNS_set
WAN_PVC_STATUS_008_LST_get
WAN_PPP_STATUS_get
WAN_PPP_CON_TIME_get
WAN_STATUS_IP_get
SYSTEM_LANG_CODE_get
SYSTEM_LANG_CODE_set
SYSTEM_TIME_ZONE_get
SYSTEM_TIME_ZONE_set
SYSTEM_GUI_STYLE_get
SYSTEM_GUI_STYLE_set
SYSTEM_HOST_NAME_get
SYSTEM_HOST_NAME_set
SYSTEM_WAN_TYPE_get
SYSTEM_WAN_TYPE_set
SYSTEM_ACTIVE_WAN_TYPE_get
SYSTEM_ACTIVE_WAN_TYPE_set
SYSTEM_PPP_PASS_THRU_get
SYSTEM_PPP_PASS_THRU_set
SYSTEM_CURRENT_TIME_get
SYSTEM_RUNTIME_CODE_VER_get
SYSTEM_BOOT_CODE_VER_get
SYSTEM_SERIAL_NUM_get
SYSTEM_LAN_MAC_002_LST_get
SYSTEM_WAN_MAC_008_LST_get
SYSTEM_WLAN_MAC_002_LST_get
SYSTEM_HARDWARE_VER_get
SYSTEM_SECURITY_LOG_100_LST_get
WIRELESS_WPS_PCB_get
WIRELESS_WPS_PCB_set
WIRELESS_CHAN_LST_get
WIRELESS_WPS_STATUS_get
WIRELESS_CHANBOND_LST_get
WIRELESS_PWS_TYPE_get
WIRELESS_PWS_ENCRTYPE_get
WIRELESS_AP_PIN_get
WIRELESS_SEC_KEY_get
WIFISSID_WLAN_STATUS_002_LST_get
WIFIMACFILTER_FILTER_ENABLE_get
WIFIMACFILTER_FILTER_ENABLE_set
WIFIMACFILTER_FILTER_ACCESS_get
WIFIMACFILTER_FILTER_ACCESS_set
WIFIMACFILTERADDR_MACFILTER_ADDR_get
WIFIMACFILTERADDR_MACFILTER_ADDR_set
DOT1X_CYPHER_SUITE_get
DOT1X_CYPHER_SUITE_set
DOT1X_DOT1XREKEYSECONDS_get
DOT1X_DOT1XREKEYSECONDS_set
DOT1X_DOT1XREKEYPACKETS_get
DOT1X_DOT1XREKEYPACKETS_set
DOT1X_SSNREKEYSECONDS_get
DOT1X_SSNREKEYSECONDS_set
DOT1X_SSNREKEYPACKETS_get
DOT1X_SSNREKEYPACKETS_set
DOT1X_DOT1XREKEYING_get
DOT1X_DOT1XREKEYING_set
DOT1X_SSNREKEYING_get
DOT1X_SSNREKEYING_set
DOT1X_STRICTUPDATE_get
DOT1X_STRICTUPDATE_set
DOT1X_ENABLEOS_get
DOT1X_ENABLEOS_set
DOT1X_ENABLEWEP_get
DOT1X_ENABLEWEP_set
DOT1X_ENABLEACL_get
DOT1X_ENABLEACL_set
DOT1X_ENABLESSN_get
DOT1X_ENABLESSN_set
DOT1X_WPA2FLAG_get
DOT1X_WPA2FLAG_set
DOT1X_ENABLESSNPSK_get
DOT1X_ENABLESSNPSK_set
DOT1X_SSNPSK256KEYFILED_get
DOT1X_SSNPSK256KEYFILED_set
DOT1X_WEPKEYSIZE_get
DOT1X_WEPKEYSIZE_set
DOT1X_DEFAULTKEYID_get
DOT1X_DEFAULTKEYID_set
DOT1X_SSNPSKASCIIKEY_get
DOT1X_SSNPSKASCIIKEY_set
DOT1X_SSNPSK256KEY_get
DOT1X_SSNPSK256KEY_set
DOT1X_SRV_TYPE_get
DOT1X_SRV_TYPE_set
DOT1X_ACC_SRV_PORT_get
DOT1X_ACC_SRV_PORT_set
DOT1X_TXPERIOD_get
DOT1X_TXPERIOD_set
DOT1X_SUPPTIMEOUT_get
DOT1X_SUPPTIMEOUT_set
DOT1X_REAUTHCOUNT_get
DOT1X_REAUTHCOUNT_set
DOT1X_ENABLE1XAUTHEN_get
DOT1X_ENABLE1XAUTHEN_set
DOT1X_ROLE_get
DOT1X_ROLE_set
HTTPD_WAIT_TIMEOUT_get
HTTPD_WAIT_TIMEOUT_set
HTTPD_REMOTE_MGNT_get
HTTPD_REMOTE_MGNT_set
HTTPD_HTTP_BROWSE_SERVICE_get
HTTPD_HTTP_BROWSE_SERVICE_set
HTTPD_HTTP_BROWSE_PORT_get
HTTPD_HTTP_BROWSE_PORT_set
PVC_PVC_LST_get
USB_MAXSUPPORTNUM_get
USB_MAXSUPPORTNUM_set
USB_ENABLE_get
USB_ENABLE_set
USB_MAXNUM_get
USB_MAXNUM_set
DRIVE_NOW_DRIVE_NUM_get
DRIVE_NOW_DRIVE_NUM_set
DRIVE_NOW_DRIVEINFOA_get
DRIVE_NOW_DRIVEINFOA_set
DRIVE_NOW_VOLUMEA_get
DRIVE_NOW_VOLUMEA_set
DRIVE_NOW_DRIVEINFOB_get
DRIVE_NOW_DRIVEINFOB_set
DRIVE_NOW_VOLUMEB_get
DRIVE_NOW_VOLUMEB_set
PRINTER_NOW_NUM_get
PRINTER_NOW_NUM_set
PRINTER_NOW_MODEL_get
PRINTER_NOW_MODEL_set
UMTS_NOW_NUM_get
UMTS_NOW_NUM_set
UMTS_NOW_MANUFACTURER_get
UMTS_NOW_MANUFACTURER_set
UMTS_NOW_MODEL_get
UMTS_NOW_MODEL_set
SAMBA_HISTORY_DRIVE1_get
SAMBA_HISTORY_DRIVE1_set
SAMBA_HISTORY_DRIVE2_get
SAMBA_HISTORY_DRIVE2_set
SAMBA_HISTORY_DRIVE3_get
SAMBA_HISTORY_DRIVE3_set
SAMBA_HISTORY_DRIVE4_get
SAMBA_HISTORY_DRIVE4_set
SAMBA_HISTORY_DRIVE5_get
SAMBA_HISTORY_DRIVE5_set
SAMBA_HISTORY_DRIVE6_get
SAMBA_HISTORY_DRIVE6_set
SAMBA_HISTORY_DRIVE7_get
SAMBA_HISTORY_DRIVE7_set
SAMBA_HISTORY_DRIVE8_get
SAMBA_HISTORY_DRIVE8_set
SAMBA_HISTORY_HISTORY_get
SAMBA_HISTORY_HISTORY_set
SAMBA_SHARELIST_DRIVE1_get
SAMBA_SHARELIST_DRIVE1_set
SAMBA_SHARELIST_DRIVE2_get
SAMBA_SHARELIST_DRIVE2_set
SAMBA_ENABLE_get
SAMBA_ENABLE_set
SAMBA_PRESMBENB_get
SAMBA_PRESMBENB_set
SAMBA_DEF_SMBENABLE_get
SAMBA_DEF_SMBENABLE_set
SAMBA_DEF_COMPUTERNAME_get
SAMBA_DEF_COMPUTERNAME_set
SAMBA_DEF_COMPUTERDESCRIPTION_get
SAMBA_DEF_COMPUTERDESCRIPTION_set
SAMBA_DEF_GROUPNAME_get
SAMBA_DEF_GROUPNAME_set
SAMBA_DEF_REMOTEENABLE_get
SAMBA_DEF_REMOTEENABLE_set
SAMBA_SMBENABLE_get
SAMBA_SMBENABLE_set
SAMBA_COMPUTERNAME_get
SAMBA_COMPUTERNAME_set
SAMBA_COMPUTERDESCRIPTION_get
SAMBA_COMPUTERDESCRIPTION_set
SAMBA_GROUPNAME_get
SAMBA_GROUPNAME_set
SAMBA_REMOTEENABLE_get
SAMBA_REMOTEENABLE_set
PRINTER_ENABLE_get
PRINTER_ENABLE_set
PRINTER_QUEUENAME_get
PRINTER_QUEUENAME_set
UPNP_ENABLE_get
UPNP_ENABLE_set
LOG_CATEGORY_get
LOG_CATEGORY_set
QOS_DFT_TOTAL_FWG_NUM_get
QOS_DFT_TOTAL_FWG_NUM_set
QOS_DFT_DFT_FWG_get
QOS_DFT_DFT_FWG_set
QOS_DFT_LNK_NUM_get
QOS_DFT_LNK_NUM_set
QOS_DFT_LNK0_get
QOS_DFT_LNK0_set
QOS_DFT_VIF0_0_get
QOS_DFT_VIF0_0_set
QOS_DFT_FWG00_0_get
QOS_DFT_FWG00_0_set
QOS_DFT_FWG00_1_get
QOS_DFT_FWG00_1_set
QOS_DFT_FWG00_2_get
QOS_DFT_FWG00_2_set
QOS_DFT_FWG00_3_get
QOS_DFT_FWG00_3_set
QOS_DFT_FWG00_4_get
QOS_DFT_FWG00_4_set
QOS_DFT_FWG00_5_get
QOS_DFT_FWG00_5_set
QOS_DFT_FWG00_6_get
QOS_DFT_FWG00_6_set
QOS_DFT_FWG00_7_get
QOS_DFT_FWG00_7_set
QOS_DFT_CLSFY_SEQ_get
QOS_DFT_CLSFY_SEQ_set
QOS_DFT_RU00_MAC_get
QOS_DFT_RU00_MAC_set
QOS_DFT_RU00_INIF_get
QOS_DFT_RU00_INIF_set
QOS_DFT_RU00_INPHYIF_get
QOS_DFT_RU00_INPHYIF_set
QOS_DFT_RU00_SRCIP_get
QOS_DFT_RU00_SRCIP_set
QOS_DFT_RU00_DSTIP_get
QOS_DFT_RU00_DSTIP_set
QOS_DFT_RU00_APORPROTO_get
QOS_DFT_RU00_APORPROTO_set
QOS_DFT_RU00_SPORT_get
QOS_DFT_RU00_SPORT_set
QOS_DFT_RU00_DPORT_get
QOS_DFT_RU00_DPORT_set
QOS_DFT_RU00_TOS_get
QOS_DFT_RU00_TOS_set
QOS_DFT_RU00_8021P_get
QOS_DFT_RU00_8021P_set
QOS_DFT_RU00_ETHTYPE_get
QOS_DFT_RU00_ETHTYPE_set
QOS_DFT_RU00_PKTLEN_get
QOS_DFT_RU00_PKTLEN_set
QOS_DFT_RU00_ACT_get
QOS_DFT_RU00_ACT_set
QOS_DFT_RU01_MAC_get
QOS_DFT_RU01_MAC_set
QOS_DFT_RU01_INIF_get
QOS_DFT_RU01_INIF_set
QOS_DFT_RU01_INPHYIF_get
QOS_DFT_RU01_INPHYIF_set
QOS_DFT_RU01_SRCIP_get
QOS_DFT_RU01_SRCIP_set
QOS_DFT_RU01_DSTIP_get
QOS_DFT_RU01_DSTIP_set
QOS_DFT_RU01_APORPROTO_get
QOS_DFT_RU01_APORPROTO_set
QOS_DFT_RU01_SPORT_get
QOS_DFT_RU01_SPORT_set
QOS_DFT_RU01_DPORT_get
QOS_DFT_RU01_DPORT_set
QOS_DFT_RU01_TOS_get
QOS_DFT_RU01_TOS_set
QOS_DFT_RU01_8021P_get
QOS_DFT_RU01_8021P_set
QOS_DFT_RU01_ETHTYPE_get
QOS_DFT_RU01_ETHTYPE_set
QOS_DFT_RU01_PKTLEN_get
QOS_DFT_RU01_PKTLEN_set
QOS_DFT_RU01_ACT_get
QOS_DFT_RU01_ACT_set
PWRSAVE_ENABLE_get
PWRSAVE_ENABLE_set
PWRSAVE_MAX_PERIOD_get
PWRSAVE_MAX_PERIOD_set
PWRSAVE_PERIOD1_B_get
PWRSAVE_PERIOD1_B_set
PWRSAVE_PERIOD1_E_get
PWRSAVE_PERIOD1_E_set
PWRSAVE_PERIOD2_B_get
PWRSAVE_PERIOD2_B_set
PWRSAVE_PERIOD2_E_get
PWRSAVE_PERIOD2_E_set
PWRSAVE_PERIOD3_B_get
PWRSAVE_PERIOD3_B_set
PWRSAVE_PERIOD3_E_get
PWRSAVE_PERIOD3_E_set
FWACCESSCONTROL_BLOCK_SERVICE_get
FWACCESSCONTROL_BLOCK_SERVICE_set
FWACCESSCONTROL_USER_PROTOCOL_get
FWACCESSCONTROL_USER_PROTOCOL_set
FWACCESSCONTROL_USER_PORT_get
FWACCESSCONTROL_USER_PORT_set
FWACCESSCONTROL_AVAIL_IDX_get
FWSCHEDULE_AVAIL_IDX_get
FWMACFILTER_DHCP_CLIENT_LIST_get
NAT_MAPPING_254_LST_get
DLNAS_UPNP_AV_get
DLNAS_UPNP_AV_set
DLNAS_UPNP_DEFAULT_AV_get
DLNAS_UPNP_DEFAULT_AV_set
DLNAS_MUSIC_NUM_get
DLNAS_MUSIC_NUM_set
DLNAS_VIDEO_NUM_get
DLNAS_VIDEO_NUM_set
DLNAS_PICTURE_NUM_get
DLNAS_PICTURE_NUM_set
DLNAS_DLNA_SCANNING_get
DLNAS_DLNA_SCANNING_set
DLNAS_WEB_UPNP_AV_get
DLNAS_WEB_UPNP_AV_set
ADSL_CFG_LINESTATUS_get
ADSL_CUR_LINESTATUS_get
ADSL_CFG_LINKTYPE_get
ADSL_CUR_LINKTYPE_get
ADSL_UP_RATE_get
ADSL_DN_RATE_get
ADSL_UP_NOISEMARGIN_get
ADSL_DN_NOISEMARGIN_get
ADSL_UP_ATTEN_get
ADSL_DN_ATTEN_get
ADSL_NR_OUTPUTPWR_get
ADSL_FE_OUTPUTPWR_get
ADSL_NR_FAST_FEC_get
ADSL_FE_FAST_FEC_get
ADSL_NR_INTER_FEC_get
ADSL_FE_INTER_FEC_get
ADSL_NR_FAST_CRC_get
ADSL_FE_FAST_CRC_get
ADSL_NR_INTER_CRC_get
ADSL_FE_INTER_CRC_get
ADSL_NR_LOS_DFT_get
ADSL_FE_LOS_DFT_get
ADSL_NR_FAST_HEC_get
ADSL_FE_FAST_HEC_get
ADSL_NR_INTER_HEC_get
ADSL_FE_INTER_HEC_get
ADSL_NR_ERR_PSEC_get
ADSL_FE_ERR_PSEC_get
ADSL_REC_CELLS_get
ADSL_TX_CELLS_get
ADSL_CODE_VER_get
ADSL_CFG_OPMODE_get
ADSL_CUR_OPMODE_get
ADSL_UP_SATTEN_get
ADSL_DN_SATTEN_get
SNMP_AGENT_get
SNMP_AGENT_set
SNMP_TRAP_get
SNMP_TRAP_set
SNMP_COMMUNITYCNT_get
SNMP_COMMUNITYCNT_set
SNMP_COMMUNITY1_get
SNMP_COMMUNITY1_set
SNMP_COMMUNITY2_get
SNMP_COMMUNITY2_set
SNMP_SERVERCNT_get
SNMP_SERVERCNT_set
SNMP_SERVER1_get
SNMP_SERVER1_set
NAS_MOUNTED_008_LST_get
NAS_SHARED_008_LST_get
NAS_SHARED_008_LST_set
NAS_USER_004_LIST_get
NAS_USER_004_LIST_set
NAS_ACCESS_004_LIST_get
UMTS_STAUS_get
UMTS_STATUS_IP_get
UMTS_STATUS_MASK_get
UMTS_STATUS_GW_get
UMTS_STATUS_DNS_PRI_get
UMTS_STATUS_DNS_SEC_get
FW_ACCESS_CONTROL_010_LST_get
FW_SCHEDULE_NAME_010_LST_get
FW_SCHEDULE_010_LST_get
DHCP_REV_ITEM_get
DHCP_REV_ITEM_set
inet_aton
memcpy
memcmp
cfgid_str_table
cfgid_str_table_sz
cfg_table
CFG_set_event
_CFG_clean
_CFG_commit
CFG_save
_cfg_del
cfg_del_event
cfg_str2list
ether_aton
NULL_Str
CFG_str2val
parseMarco
CFG_set_str_event
CFG_val2str
mapi_ccfg_commit
strtol
mapi_ccfg_set
mapi_ccfg_get
Get_MD5_Str
_CFG_unset
CFG_id2cfgEntry
_CFG_getValue
_CFG_setValue
__floatsidf
__divdf3
mapi_xdsl_cmdctl
adslModeString
dsl_status
dsl_statistics
getAdslTypeString
stat
dhcp_reserved_record
mapi_fw_access_control_blksvc_cfg2struct
mapi_fw_access_control_user_port_cfg2struct
mapi_fw_access_control_blksvc_struct2cfg
mapi_lan_cmdctl
mapi_sw_cmdctl
fseek
ftell
Osix_malloc
Osix_free
localtime
asctime
mapi_wlan_cmdctl
strtok
strlcpy
__extendsfdf2
__muldf3
mapi_nas_cmdctl
CFG_set
__floatsisf
mapi_nat_cmdctl
mapi_sys_cmdctl
mapi_wan_cmdctl
mapi_3g_cmdctl
mapi_wan_get_connected_status
Osix_GetSysUpTime
adsl_util
mapi_fw_update_dmz
mapi_fw_schedule_start_time_cfg2struct
mapi_fw_schedule_end_time_cfg2struct
wl_bwctl_util
mapi_iptables_cmdctl
Osix_send_msg_to_osix_syscmd_service_thread
toBypassWanAction
mapi_vlan_cmdctl
mapi_atm_cmdctl
mapi_wlan_update_lan
wlan_wsconf_util
wlan_util
wlan_bwctl_util
vlan_util
__pack_f
libc.so.0
_ftext
_fdata
_edata
__bss_start
_fbss
_end
'9F
$R)
L$H)
@0!&9
(!&
$BQ,
@ !$
Q$'9
` !$
` !$
{$BR
` !$
$BRx
` !$
(!$
!,D
` !$
8!$BQ
@ !$
&$O
D !&1
&$O
24BTv
gE4B#
$ 4Bp
04BF
y4BC
%4B%b
&^4BZQ
EZ4B
go4B
*4BL
&4B9B
&4Ba"
&4B8
&4BK`
&4B~
&4B'
&4B0
&4B|
&4BVe
&4B"D
&4B#
&4BY
&4B]
&4B~O
&4BC
&4B~
(!&R
F0#$
0!'
@!$H
@ !&
@ !$
`(!$
`0!$c
@(!&1
(!'9
@0!<
`0!$c
$BU
(!$
!r
!r
@ !$
pH!$
$$h
@8!$
*$DU
*$DU
#0B
@ !'
!$
!$
@0!(B
@8!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
0!$
@8!$
@8!$
@(!$
@ !0C
@8!$
8!$
`8!$
(!'
`0!'
!$
` !$d
'9UD
!$S*L
$R*4
$Q*@
'9UD
@ !$B
$B*@
$B*L
$B*4
$P*@
$R*L
$Q*4
$B*L
@ !$
$P*`
$B*`$B
$U*`
#$c*`
ff4Bfg0
`0!$
`8!$
P0!(B
.4BE
#4B
` !$
!'9
.4BE
#4B
@ !'9
@8!$
@8!$
@!$
@ !$
@!$
@ !$
0!$
!&
8!$
8!$
@ !$
8!$
@ !$
0!$
@ !&
!&
` !$
@0!$
0!$
`8!$
!$
!$
!$
!$
8!$
@8!$
@8!$
!0C
!0C
@(!$
@ !$
\$Q0p
&%U
&%U
&%U
&%U
&%U
@(!<
!$C
!&ei0
d&ei0
!0C
!0B
@ !0C
@ !0B
@8!$
!$
@ !0C
@ !0B
@8!$
@8!$
@ !'
`8!$
!$
/var/run/httpd.pid
httpd exit() %x
allocate for bypass file list failed %d bytes
%s %d %s
HTTP/1.0
Server: %s
httpd
%a, %d %b %Y %H:%M:%S GMT
Date: %s
Content-Type: %s
Cookie: %s
Connection: close
text/html
We have killed the built-in web server, and launched our own, serving a page which should look like the screenshot attached. Simply browse to: And you should see: Last edited by unlokia; 02-February-2012 at 15:55.
|
" > /ramdisk/www/index.html
#start our http server ;-)
./busybox-mips httpd -h /ramdisk/www|
#16
01-February-2012, 23:32
|
|||
|
|||
|
Videos: The Orange "Bright Box" - tour and hacks.
Orange "Bright Box": a quick overview of the new router, inside *and* out
http://www.youtube.com/watch?v=w6r4VGYO8iY Orange "Bright Box" boot process, captured via USB to serial, using "minicom" (Ubuntu): www.youtube.com/watch?v=yu2GHHCh34I Orange "Bright Box" router: How to change default settings in NVRAM, using "BrightBox" prompt: http://www.youtube.com/watch?v=dgZCM_CFR7I Last edited by unlokia; 02-February-2012 at 14:35.
|
|
#17
03-February-2012, 19:44
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
How does it perform as a router? Seeing as I now own two of these; one for hacking, one for using, I can tell you that it works wonderfully as a router. One thing I had an issue with, was getting my PC to connect to the 'net, once I had put all the details in. The *router* was definitely connected to ADSL, as it had a WAN IP address. The solution was to turn off the router, reboot the PC, then turn ON the router as the PC reboots. You may not have that issue, but I have outlined what to do, just in case. I've tried playing with the "Bandwidth control" feature; VERY nice. Allows you to throttle downstream *and* upstream bandwidth, when using 3 SSID's (using virtual SSIDs). It doesn't seem to work, but I am sure there is something I have overlooked... Screenshot of "Bandwidth control" page: Last edited by unlokia; 03-February-2012 at 19:58.
|
|
#18
04-February-2012, 17:17
|
|||
|
|||
Re: How to serve a web page from "Bright Box"
Okay. I downloaded another version of "busybox" called "busybox-mips" as a temporary hack, so that I have more commands I can run on Bright Box. Here is a better, updated "start_www.sh" script:
Code:
#!/bin/sh
# simple Bright Box server start script - VERY rough.
# check for /ramdisk/www folder existance
if [ -d /ramdisk/www ]; then
echo "################################"
echo "# SERVER ALREADY RUNNING #"
echo "# SO WE WILL NOW REBOOT #"
echo "# AND RESTORE ORIGINAL WEB UI #"
echo "################################"
sleep 5
reboot
exit
else
# kill the built-in http server off
echo " ### KILLING ORANGE WEB UI ### "
killall arc_httpd
sleep 1
echo " ### CHANGING ROUTER IP ADDRESS TO: 192.168.1.234 ### "
ifconfig br0 192.168.1.234
sleep 1
echo " ### NOW STARTING TELNET ### "
telnetd
sleep 1
echo " ### NOW STARTING FTP: username="admin" password="x" ### "
bftpd -d
sleep 1
#make a ramdisk folder for faster running
mkdir /ramdisk/www
#copy an imageof Bright Box :-)
cp ./bbox.jpg /ramdisk/www
#create a temporary, basic html page
echo "
|
|
#19
04-February-2012, 23:14
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
questions:
========= 1/ Does anyone here own this router yet (apart from me)? 2/ Does anyone here want to help hack this router, with me? This thread has had almost 1,500 views, and almost no replies. I am not complaining that people are taking an interest, but I would appreciate some help with my investigations, should you wish to do so. SO many views, and so few replies is a little odd... Thanks
|
|
#20
05-February-2012, 20:23
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Sup unlokia,
I have one of these routers from Orange, I am most interested in getting a third party or OEM. firmware on the beast. I have no serial interfaces I'm afraid so am approaching the hack purely from a software basis and tracking down an OEM. firmware. ( not so easy as Astoria networks is owned by a web of hardware providers it seems.) And I think you have so many views and little input because this router is so new on the market, give it a month or so and everybody will want a piece of any hacks you find OK now for links that may or may not be useful too people wanting to know more about this router. https://sviehb.wordpress.com/2011/09...e01-unpacking/ that's a link regarding Astoria firmwares and the how they work and how they may be protected from being reversed, also has a little on who owns Astoria (TLDR: Taiwanese company called Arcadyan). I will add more as more turns up.
|
|
#21
06-February-2012, 02:45
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
Sup unlokia,
|
|
#22
09-February-2012, 18:40
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Hi guys. Okay, I have found four *hidden* config pages, whilst trawling the firmware
/xc324m12sdlo.htm /yds32u872vld.htm Here are some screenshots, minus my personal data: http://www.flickr.com/photos/2200869...7629246727287/ NOTE: Login *first*, then visit these URLs. If you are logged out and click one, it will just ask you to login, but won't re-direct you to these URLs. Have fun! Last edited by unlokia; 09-February-2012 at 18:49.
|
|
#23
10-February-2012, 18:51
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Hey Unlokia
looks good, I just got one too, I was looking at Astoria's website but not much there - no new firmware etc. Have you found out how to do static routes.... I don't think it supports it??
|
|
#24
10-February-2012, 20:11
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
Hey Unlokia
|
|
#25
13-February-2012, 12:20
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
I also did a port scan on the private side nic, looks like 8085 is open, not sure why though.
|
|
#26
13-February-2012, 14:25
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
I also did a port scan on the private side nic, looks like 8085 is open, not sure why though.
|
|
#27
13-February-2012, 16:31
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Good stuff unlokia! Just registered on this forum to say thank you :-) . Some Qs (hope you don't mind) for you . . .
1. Will you be releasing a firmware package - for users like us (who don't have a USB/serial things) who can just flash it to the router and then get all the SSH goodies opened to them? 2. Can a USB printer be connected out of the box to the router and be configured? 3. Have you looked at DD-WRT site - http://www.dd-wrt.com? They seem to be doing a lot of custom builds. Hopefully we can install Twonky on this and get a DLNA server running!!
|
|
#28
13-February-2012, 20:14
|
||||
|
||||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
port 8085, try grep 8085 /etc/services - they might list it there with a name
http://www.dshield.org/port.html?port=8085&exit=1 - doubt much of use but sometimes they will know
|
|
#29
14-February-2012, 00:54
|
|||
|
|||
Re: [NEW] Orange "Bright Box" router hacking :-)
Hi guys. Okay, I have found four *hidden* config pages, whilst trawling the firmware Hello Was flicking through your screen shots and saw the remote management bit. These may interest you : MST = Made Simple Technology ACS = Auto-Configuration Server TR-069 is the management protocol see wikipedia and Technical Docs. I don't own one and cant help - but good luck edit P.S. Just a warning, From the specs it would seam that it informs the ACS if you attempt to alter the ACS settings. Last edited by Memfis; 14-February-2012 at 01:31. Reason: added warning
|
|
#30
19-February-2012, 16:19
|
|||
|
|||
|
Re: [NEW] Orange "Bright Box" router hacking :-)
Gotta say amazing router. Just signed up with orange home broadband and I gotta say how impressed I am with there internet. I live in a area where broadbands speeds are not very good but with orange and this router my internet works very well.
One thing is that I found with the router is that you cant set up port forwarding on different VLANS and I was wondering if anyone here knows of a work around or possible some hacking to change thet ability to port forward to VLAN2 or VLAN3? My other question with this router hacking. As you can connect a 3G dongle to it could I use a Three network dongle as they have all you can eat data plans and the 3g in my area is very good. Would this be practical in the sense that both the adsl and 3g would be running at the same time for everyone in the household?
|
|
| Tags |
| 419, adsl, beauty, brightbox, broadband, compare, delay, dhcp, dns, feature, files, firmware, flash, hack, hacking, home, key, line, lock, make, mobile, nat, network, orange, port, product, router, settings, sharing, tools, web, wireless |
« Previous Thread | Next Thread »
| Thread Tools | |
 Show Printable Version
 Email this Page
|
|
| Display Modes | |
 Linear Mode
 Switch to Hybrid Mode
 Switch to Threaded Mode
|
|
|
All times are GMT +1. The time now is 03:57.