I then attempted the snmp queries as described at issue #7, unfortunately even with the COAX cable disconnected it seems the snmpd is not running. Logged into the web UI with the default admin credentials and there wasn't any firewall configurations to disable. this time telnet was closed and ssh was filtered. I attempted this now, after the router had powered-up I perform another network scan. On some devices, this enables SNMP access (and possibly allows you to enable Telnet). You might have better luck resetting the device to factory defaults and disconnecting the coax cable. Most firmwares use either DES or AES, so brute-force isn't really an option. Would really like any suggestions about how to overcome this gateway device and gain access to the linux shell.ĭecrypting the file without a firmware binary won't be possible, unless it uses some pseudo-encryption like xor 0x80. Attempted to query using SNMP and guessed the community string with no luck.Only gained directory listing, learnt about the FS structure but that wasn't really helpful. Found Twonky server running on port 9000, exploited using some 1day I found for this version.Tried creating nat rules that will port forward the ports to localhost but it didn't manage to bypass the firewall.I started unscrewing some of the bolts in the router and try to gain serial access to the flash, but I reached a point where I think i need to brake the plastic, which is something I do not want to do (as this router is being used today).Full port scan, there seems like sshd and telnetd are running but are not accessible due to firewall (router returns RST on ports 21,22 specifically.).I'm guessing the firmware modification included encrypting the Gatewaysettings somehow, however I was not able to put my hands on the firmware of the router to dig further into this. The output filename of the backup file is actually 'nf' if that matters.Īttempted to use bcm2cfg and got this output: type : gwsettingsĬhecksum: 0000f5ed196f765742431a7a92a5f91d My router is Sagemcom 3686, a modded version of a local ISP. Now for the business, I am trying to use the tools to parse the Gatewaysettings.bin.

Sagemcom tools telnet