From cafd081373c6b10f85cc196c03ced467682f64bb Mon Sep 17 00:00:00 2001 From: Simone Bortolin Date: Fri, 9 Oct 2026 23:03:54 +0200 Subject: [PATCH] Resolve multiple documentation issues (#277, #296, #302, #197) - Adtran SDX 611 (#277): Add serial credentials info (no password needed) and IP address - Zisa OP151S / TW2362H-CDEL (#296): Add MAC address change command and RSTP bridge mode warning with UART recovery info - Nokia XS-010X-Q (#302): Document that firmware 3FE49337BOCK28 disables serial console after boot - Sercomm FG1000B (#197): Add web UI credentials for 1&1 (1UND1/G6m%Z+SN), Vodafone, and o2 variants. Add simplified telnet exploit for authenticated users, SSH enablement procedure, hidden access control page, and 1&1 firmware version Co-Authored-By: Claude Opus 4.6 --- ont-xgs/ont-nokia-xs-010x-q.md | 4 ++ ont/ont-adtran-sdx-611.md | 4 +- ont/ont-sercomm-fg1000b.md | 76 ++++++++++++++++++++++++++++++++-- ont/ont-zisa-op151s.md | 11 +++++ 4 files changed, 90 insertions(+), 5 deletions(-) diff --git a/ont-xgs/ont-nokia-xs-010x-q.md b/ont-xgs/ont-nokia-xs-010x-q.md index 28f8743c..63904de5 100644 --- a/ont-xgs/ont-nokia-xs-010x-q.md +++ b/ont-xgs/ont-nokia-xs-010x-q.md @@ -49,6 +49,10 @@ The ONT has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be acc Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work. ::: +::: warning Firmware 3FE49337BOCK28 +Newer firmware versions (starting from 3FE49337BOCK28) disable the serial console after the boot process completes. The boot log is still visible via UART, but no interactive shell or prompt is available. Interrupting the boot into U-Boot via Ctrl+C does not appear to work on this firmware. +::: + ## List of software versions - 3FE49337AOCK80 - (R4.4.17.063 CIG 25/06/2021) - 3FE49337BOCK28 diff --git a/ont/ont-adtran-sdx-611.md b/ont/ont-adtran-sdx-611.md index fbffcb8c..74833845 100644 --- a/ont/ont-adtran-sdx-611.md +++ b/ont/ont-adtran-sdx-611.md @@ -16,11 +16,11 @@ parent: Adtran | System | | | Optics | SC/APC (U&T UTG24P05) | | 2.5GbaseT | No | -| IP address | | +| IP address | 192.168.1.1 | | Web Gui | | | SSH | | | Telnet | | -| Serial | ✅ | +| Serial | ✅, no credentials needed | | Serial baud | 115200 | | Serial encoding | 8-N-1 | | Form Factor | ONT | diff --git a/ont/ont-sercomm-fg1000b.md b/ont/ont-sercomm-fg1000b.md index f8591e67..eac62416 100644 --- a/ont/ont-sercomm-fg1000b.md +++ b/ont/ont-sercomm-fg1000b.md @@ -23,9 +23,9 @@ parent: Sercomm | PHY Ethernet | RTL8221B | | Optics | LC/APC | | IP address | 192.168.1.1/24 or 192.168.100.1/24 (depending on the derivate) | -| Web Gui | ✅, login may be needed (depending on the derivate) | -| SSH | No | -| Telnet | No | +| Web Gui | ✅, login may be needed (depending on the derivate, see [Web UI credentials](#web-ui-credentials)) | +| SSH | After enabling (see [Enabling SSH](#enabling-ssh)) | +| Telnet | After enabling (see [Enabling telnet/SSH/serial](#enabling-telnetsshserial)) | | Serial | ✅, only TX | | Serial baud | 115200 | | Serial encoding | 8-N-1 | @@ -53,6 +53,7 @@ The ONT seems to only display output of the ROM CFE and flash CFE, but doesn't s | Firmware version | Firmware date | used by | | ---------------- | ------------- | ----------------------------- | +| 090111.1.0.002 | 31.08.2021 | 1&1 (FG1000B.11) | | 090122.1.0.001 | 03.11.2022 | Vodafone (FG1000B.VF) | | 090133.1.0.003 | 11.09.2023 | o2/Telefonica (FG1000B.O2) | | 090144.1.0.001 | | Deutsche Telekom (FG1000B.11) | @@ -119,6 +120,33 @@ Please back them up before any hacking! Recovery is possible if you hardware res * `smd` - daemon in charge of launching the `/opt/` plugin for each of the ONT's service like: `init, gpon, iptv, temperature, account, http, lan, network, syslog, system`. All is done in code which does not help hacking the device. +# Web UI credentials + +## Deutsche Telekom (FG1000B.11) + +The Deutsche Telekom variant does not require login credentials for the web interface on firmware 090144.1.0.001. + +## 1&1 (FG1000B.11) + +| Field | Value | +| -------- | ---------------------------------------------------- | +| Username | `1UND1` | +| Password | `G6m%Z` followed by the last 5 digits of the GPON SN (Modem-ID on the sticker) | + +## Vodafone (FG1000B.VF) + +| Field | Value | +| -------- | ---------------------------------------------------- | +| Username | `vodafone` | +| Password | Printed on the device label | + +## o2/Telefonica (FG1000B.O2) + +| Field | Value | +| -------- | ---------------------------------------------------- | +| Username | Not required (login page only asks for password) | +| Password | Printed on the device label | + # Usage ## Enabling telnet/SSH/serial @@ -154,6 +182,48 @@ fetch('http://192.168.100.1/data/statussupporteventlog_applog_download.json?_=16 .then(console.log) ``` +### Simplified method (for 1&1/Vodafone/o2 variants, after web login) + +After logging into the web interface, the following simplified command can be run in the browser console to enable telnet. The `page_data_send` function handles the `csrf_token` automatically: + +```javascript +page_data_send("/data/statussupporteventlog_applog_download.json", 'applog_select=a;echo "#!/bin/sh" > /tmp/slogin;echo "export PATH=/bin:/sbin:/usr/bin:/usr/sbin" >> /tmp/slogin;echo "/bin/sh" >> /tmp/slogin;/bin/chmod 755 /tmp/slogin;/usr/sbin/telnetd -l /tmp/slogin') +``` + +## Enabling SSH + +On the 1&1, Vodafone, and o2 variants (which have `/opt/lib/libsl_access_control.so`, unlike the DT variant), the SSH server can be enabled persistently: + +```sh +cmld_client set InternetGatewayDevice.X_SC_Management.Server.SSHServer.Enable=1 +cmld_client save +reboot +``` + +After reboot, connect with SSH using the same credentials as the web interface: +```sh +ssh -oHostKeyAlgorithms=+ssh-rsa -oKbdInteractiveAuthentication=no 1UND1@192.168.100.1 +``` +Replace `1UND1` with `vodafone` or `o2` depending on the variant, and adjust the IP address accordingly (o2 uses `192.168.1.1`). + +::: warning Note +By default the SSH server runs a limited `sc_cli` shell. To get a full shell, first enable telnet, then run: +```sh +mount --bind /dev/null /bin/sc_cli +``` +This restores normal SSH behavior with a full shell. This change is not persistent across reboots. +::: + +### Access control page + +The web interface has a hidden `Access Control` page that may allow enabling SSH/Telnet from the UI. It can be accessed directly at: +``` +http://192.168.100.1/settings.html#sub=80 +``` +This page is commented out in the navigation menu but still functional. + +## Boot-persistent telnet + There is a way to make a script call at boot to ensure telnet or other services start at boot if needed. It uses a hack from libsl_system.so where there is a `system(...)` call using a String from config, string must be <=12 char. The system call is supposed to set set hostname of the device for storage sharing. In the example below, a `/data/up` shell script would be created (ensure it has execute rights, such as: `chmod 755`). ``` diff --git a/ont/ont-zisa-op151s.md b/ont/ont-zisa-op151s.md index ea9557ff..9d5385aa 100644 --- a/ont/ont-zisa-op151s.md +++ b/ont/ont-zisa-op151s.md @@ -42,6 +42,17 @@ The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be a Some USB TTL adapters label TX and RX pins the other way around: try to swap them if the connection doesn't work. ::: +## Setting MAC address + +The MAC address can be changed via the `manufactory` menu: +``` +manufactory -> set uni mac addr xx:xx:xx:xx:xx:xx +``` + +::: warning RSTP bridge mode +Enabling RSTP bridge mode with `set rstp bridge enable` may cause loss of telnet access. If this happens, access can be recovered via UART serial console. +::: + ## Firmware is interchangeable with: - [Halny HL-GSFP](/ont-halny-hl-gsfp)