mokurin000's blog - Modem

HN8145XR 光猫折腾记录

2025-02-26T00:00:00+00:00

本人有幸用上了河南移动网络接入，我们井盖省的网络封闭程度一直是内地省份中数一数二。</p>

相关软件会放在 fuck-wuawei-modem</a></p>

来源：分享HN8145XR开telnet及补全shell个人心得</a></p>
Telnet用户：root</p>
Telnet密码：`adminHW</code>、Hw8@cMcc</code> 等</p> </blockquote>`
`启动 ONT_telnet_enable.exe</code></li> 网线连接光猫和电脑/笔记本</li> 打开使能工具，选择对应有线网卡，展开设备列表</li> 断开光猫电源</li> 选择“V5使能”，点击启动</li>`恢复光猫电源，等待出现“Failed”字样，不用管；待到光猫 LED 灯全部熄灭，点击停止。不要退出使能工具</li> </ol> 此处可以检查 Telnet 是否已经可以连接。</p> </blockquote> 选择“升级”，版本包选择 shell9.bin</code></li> 点击开始，再次重启光猫电源</li> 等待光猫 LED 再次全部熄灭（除下行光），出现 “Failed” 后点击停止，退出使能工具。</li> </ol> </span></a> 基于 Telnet 获取超管密码</h2> 参考：通过telnet取得华为HN8145XR超级密码</a></p> </blockquote> telnet</span> 192.168.1.1</span></span> </span> # -> root</span></span> # -> (telnet密码)</span></span> </span> su</span></span> shell</span></span> </span> cd</span> /mnt/jffs2/</span></span> </span> cp</span> hw_ctree.xml myconf.xml.gz</span></span> aescrypt2</span> 1</span> myconf.xml.gz tmp</span> # 此处 tmp 被忽略了</span></span> </span> zcat</span> myconf.xml.gz</span> \</span></span> |</span> grep</span> 'UserName="CMCCAdmin"'</span> \</span></span> |</span> cut</span> -d " " -f</span> 5</span> \</span></span> |</span> cut</span> -d = -f</span> 2</span></span></code></pre> 可以得到如下结果：</p> Password="$2...............$"</span></span></code></pre> 使用 WW_Dollar2.exe</code>，点击计算，可以解密 $2</code> 密文。</p> 得到的密码可能需要拼接上 CMCCAdmin</code> / CMCCAdmin#</code>，如果是中国移动版。</p> 作者这里得到了一串 sha256sum（-_-|||），还好最终是电话要到了密码。</p> 考虑到河南移动的做法是 CMCCAdmin + 八位随机字符</code>，以目前时代的个人算力基本不可能爆破。</p> </span></a> 从 Hash 后的宽带密码/超级密码计算原密码</h2> 来源：PurePeace 的获取移动光猫（如HS8545M5等设备）PPPoE密码明文</a>，略有修改</p> Rust 写了一份</a>，可以用来试试看更长的密码</p> 另外，移动似乎倾向于设置为手机号后六位。</p> 更建议的方式：通过手机营业厅重置密码，获取新的 PPPoE 拨号密码。</p> 移动可以发送 CZKDMM</code> 到 10086。</p> </blockquote> from</span> sys</span> import</span> argv</span></span> import</span> hashlib</span></span> </span> </span> def</span> sha256</span>(</span>todo</span>:</span> str</span>):</span></span> return</span> hashlib</span>.</span>sha256</span>(</span>str</span>(</span>todo</span>).</span>encode</span>()).</span>hexdigest</span>()</span></span> </span> </span> def</span> md5</span>(</span>todo</span>:</span> str</span>):</span></span> return</span> hashlib</span>.</span>md5</span>(</span>str</span>(</span>todo</span>).</span>encode</span>()).</span>hexdigest</span>()</span></span> </span> </span> def</span> find_target</span>(</span>secret</span>:</span> str</span>):</span></span> # 生成六位密码</span></span> for</span> value</span> in</span> range</span>(</span>1000000</span>):</span></span> value</span> =</span> f</span>"</span>{</span>value</span>:06</span>}</span>"</span></span> s</span> =</span> sha256</span>(</span>md5</span>(</span>value</span>))</span></span> if</span> s</span> ==</span> secret</span>:</span></span> return</span> value</span></span> return</span> None</span></span> </span> </span> if</span> name</span> ==</span> "main"</span>:</span></span> try</span>:</span></span> secret</span> =</span> argv</span>.</span>pop</span>(</span>1</span>)</span></span> except</span> IndexError</span>:</span></span> print</span>(</span>"Usage:"</span>)</span></span> print</span>(</span>f</span>"</span> {</span>argv</span>[</span>0</span>]</span>}</span> <sha256hashsecret>"</span>)</span></span> exit</span>(</span>1</span>)</span></span> </span> target</span> =</span> find_target</span>(</span>secret</span>)</span></span> print</span>(</span>target</span> if</span> target</span> is not</span> None</span> else</span> ""</span>)</span></span></code></pre></span></a> 恢复华为公版界面</h2> 参考：折腾HN8145XR（恢复华为界面等）</a></p> </blockquote> 需要先备份好：</p> 宽带帐号</li> 宽带密码</li> ONT 认证密码</li> </ul> 如果只修改界面，不直接执行 restore_xxx.sh，可能可以保留下来 ONT 认证密码。</p> 作者的 ONT 注册方式是 Password。</p> </blockquote> 启动 WW_Dollar2.exe</code></li> 在你的电脑启动 ncat</li> </ol> 如果没有 ncat，可以：</p> scoop</span> install nmap</span></span></code></pre></blockquote> ncat</span> -l -p</span> 9999</span> ></span> hw_boardinfo</span></span></code></pre> 在光猫中，使用 busybox nc 把 hw_boardinfo 传过来</li> </ol> 此处 192.168.1.4</code> 为电脑的局域网 IP</p> </blockquote> busybox</span> nc</span> 192.168.1.4 9999</span> <</span> /mnt/jffs2/hw_boardinfo</span></span></code></pre> 备份一份 hw_boardinfo</code></li> 打开 hw_boardinfo</code>，修改：</li> </ol> obj.id = "0x0000001a"; obj.value = "COMMON";</span></span> obj.id = "0x0000001b"; obj.value = "COMMON";</span></span> obj.id = "0x00000031"; obj.value = "NOCHOOSE";</span></span></code></pre> 把修改后的 hw_boardinfo 传回，并覆盖：</li> </ol> /mnt/jffs2/hw_boardinfo</span></span> /mnt/jffs2/hw_boardinfo.bak</span></span></code></pre>