I finally cracked this! Just to clarify, I'm running an u-12 model with the. Using the ping-exploit to loosen firewall rules The first thing to is open the firewall to allow local access to the box. In my I already established, that all the good ports are blocked by IPtables in the Linux.
Recent Posts: Router Unlock Free Unlocking of Tele2 Russia Huawei E5573cs-322 (Firmware 21.327.62.00.391) Free Unlocking of Orange Airbox 2 France Huawei E5573Bs-322 (Firmware 21.315.).
If you'd like to get started using NSB/AppStudio right away, then read the Installation section, and then turn to the Getting Started With NSB/AppStudio chapter. Sample programs are provided with NSB/AppStudio for you to study and use. You can tailor these sample programs to your particular needs. Please read it before installing NSB/AppStudio. There is a file named Readme.htm included with the release which contains late-breaking information about NSB/AppStudio, including updates to the Handbook. Ns basic app studio serial number.
So, the previously published (I'm doing this on my Linux PC):./B593cmd.pl -the-IP- -the-admin-Pwd- 'iptables -I INPUT -i br0 -j ACCEPT' Now all ports are open from the LAN, but there are no changes to the Internet side. We confirm this by running nmap: Nmap scan report for -the-IP- Host is up (0.0082s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https 631/tcp open ipp 8081/tcp open blackice-icecap MAC Address: F8:3D:FF:F8:3D:FF (Huawei Technologies Co.) That is something that I have been able to do earlier, but could not gain anything concrete out of it. Confirm that you know the CLI-password Now that we can run any commands to the box, let's confirm the configuration:./B593cmd.pl -the-IP- -the-admin-Pwd- 'cat /var/curcfg.xml' less The output is a very long XML-file. The good parts are: The output clearly says, that web-GUI and telnet/SSH command line interface have separate user accounts for them. However, the passwords are encrypted.
I have been able to determine, that it is a BASE64-encoded string and the binary format increases in 64-bit blocks. The only conclusion is to assume, that the passwords are encrypted with a, but the encryption key, and possible initialization vector are currently unknown. Luckily I know what f5338SA1kb4= and 2n+mVpCOAaY= stand for. They are the default passwords to the box anyway and the manual says that default admin password is admin and default user password is user. Logical, huh? If you don't know the password for CLI- admin, there is no way that you're getting in.
Trying out the SSH Now, what can we do with the fact, that SSH is now open and we know the password for privileged admin-user? A SSH-login, when using the correct CLI-password will yield: # ssh admin@ -the-IP- admin@ -the-IP-'s password: Write failed: Broken pipe Not cool.
Bhai (2013) - Torrent Downloads. Download Bhai 2013 movie from torrent downloads selecting either torrent or magnet link and watch Bhai full movie on HD downloading 720p torrent link. Bhai Telugu 2013.MP4 TorrentPk Download, Full Movie Download Free HD 720p 1080p Tamilrockers Movies Free Download Toggle navigation TorrentPk.live Latest Hindi Dubbed Telugu Tamil Login Register. Bhai 2013 telugu movie torrent download. Picktorrent: bhai telugu movies 2013 - Free Search and Download Torrents at search engine. Download Music, TV Shows, Movies, Anime, Software and more.
In my exploit-tool -article, I referred to Mr. Ronkainen's work at.
He said to execute a specific command via SSH. My next attempt is to follow his instruction: # ssh admin@ -the-IP- /bin/sh admin@ -the-IP-'s password: ------------------------------- -----Welcome to ATP Cli------ ------------------------------- ATP> WHOOO!! Now the hidden shell-command will work: ------------------------------- -----Welcome to ATP Cli------ ------------------------------- ATP>shell shell BusyBox vv1.9.1 (2012-11-20 16:01:41 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. SSH with non-privileged user / Telnet To test this further, I attempted to login with user user. The non-privileged user does not have the hidden shell-command available and no access will be granted: # ssh user@ -the-IP- /bin/sh user@ -the-IP-'s password: ------------------------------- -----Welcome to ATP Cli------ ------------------------------- ATP>shell shell Command failed. Also trying to access the ATP Cli via telnet does not work: # telnet -the-IP- Trying -the-IP.
Connected to -the-IP. Escape character is '^]'. ------------------------------- -----Welcome to ATP Cli------ ------------------------------- Login: admin Password: Login incorrect. I don't know if the telnet is disconnected completely, or is there yet another set of accounts, but web-GUI nor CLI user credentials won't work there. Future ventures Anyway.
Now that I have the shell-access I have a much better possibility of doing more mischief. I need to explore the config system more as it would be very very nice to have the firewall allow SSH on boot. Now the only way to allow SSH is to use the exploit and leverage the IPtables. Also on public request, I'm going to implement QoS. Stay tuned for more B593 hacking! Well I'm trying this on an b593-u12 disguised as an 'Speedport LTE 2' (Germany - telekom) running firmware V100R001C748SP104 First the device can't be addressed with 192.168.1.1 the device ignores this and redirects you to speedport.ip I tried the perl script but nothing happens maybe it's patched but there is an open ssh port on the device that asks for login data PORT STATE SERVICE VERSION 22/tcp open ssh Dropbear sshd 0.50 (protocol 2.0) 23/tcp filtered telnet 80/tcp open http 631/tcp filtered ipp 8081/tcp filtered blackice-icecap.