Jio Fiber Modem Router Details (Serial log, ways to achieve Bridge mode etc) #2
Replies: 32 comments 51 replies
|
Is it possible to change the router PPPoE config now? |
|
few guys at here were able to setup bridge mode, I never tried that though |
|
@fawazahmed0 hi. saw your work on jio fiber modem. i want to know if it is possible to update ports or something via cli on the router page. |
|
hi @test2a , I haven't tinkered with this router much, so really cannot tell |
|
@fawazahmed0 ok. after i posted to you, i created a new repo https://github.com/test2a/JioFiberautomation and started work via python selenium. i am first planning to update ipv6 addresses in firewall. if that is done, then i might start with others |
|
ONU (Optical Network Unit) Optical network unit, ONU is divided into active optical network unit and passive optical network unit. Generally, the equipment equipped with network monitoring including optical receiver, uplink optical transmitter and multiple bridge amplifiers is called optical node. The PON uses a single fiber to connect to the OLT, which then connects to the ONU. ONU provides services such as data, IPTV (i.e. interactive network TV), and voice (using IAD, i.e. Integrated Access Device), and truly realizes "triple-play" applications. |
|
Thanks ill check it out.
…On Fri, 7 May, 2021, 11:15 am Fawaz Ahmed, ***@***.***> wrote:
few guys at here <https://broadbandforum.co/t/198869/> were able to setup
bridge mode, I never tried that though
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#2 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AI3MT5RNPKPBNQO3IT45RMDTMN457ANCNFSM4WZYVH5A>
.
|
|
Can we unlock jio router to use with other PPPoE providers
…On Sat, 22 May, 2021, 11:20 am test2a, ***@***.***> wrote:
@fawazahmed0 <https://github.com/fawazahmed0> ok. after i posted to you,
i created a new repo https://github.com/test2a/JioFiberautomation and
started work via python selenium. i am first planning to update ipv6
addresses in firewall. if that is done, then i might start with others
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#2 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AI3MT5SFGPZLDWWIYEJHDTDTO5AZZANCNFSM4WZYVH5A>
.
|
|
Oh i see, Has someone managed to bruteforce it? |
|
nope, I did made a script to bruteforce it, but its very slow like 18 attemps / minute: |
|
oh well, we need to use a password list then. |
|
yeah, you can try modifying the script to support wordlist, but I don't think it will work, because they(isp providers) doesn't use simple dictionary passwords, rather they use random generated passwords |
|
Is there a way we could flash a different firmware file onto it and then make it work ? Like OpenWRT probably |
|
Ohh shit then it's quite hard... If we had the hash of the password we cud
keep it to crack on a cloud rdp.
…On Sun, 23 May, 2021, 12:03 am Fawaz Ahmed, ***@***.***> wrote:
yeah, you can try modifying the script to support wordlist, but I don't
think it will work, because they(isp providers) doesn't use simple
dictionary passwords, rather they use random generated passwords
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#2 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AI3MT5VETRPVW776VJ3N5QLTO72GHANCNFSM4WZYVH5A>
.
|
|
Hi, I was playing with the Jio ONT today and started searching google with keywords from the serial log. "7528DRAMC" led me to this repo. I don't think it is possible to get the root password, it will be some random alphanumeric key as you have mentioned. However, I had another plan. I was thinking to use another 3rd part GPON ONT. I have used TPlink ONT and noticed that it is going to O5 state. I think if we can get the Jio ONT serial number (that is not mentioned anywhere on the ONT/box, I think they have intentionally made it a secret), we can set that serial number on the TPLink ONT, and the authentication will succeed. For that, we need some ISP local partner who has GPON OLT and enough knowledge to somehow get the serial number after connecting Jio ONT to the OLT which he/she controls. |
|
I think serial number is already written on the board, here's the image (I have redacted the numbers, for privacy reasons):
|
|
No, not that one. ONT serial codes are 12 letters long AFAIK. Maybe Jio maintains a separate mapping of the serial number mentioned on our ONT and the actual one used at the OLT |
|
@mrghosh did you find a way to get the SN? |
|
Also if someone needs the name of the major ICs used:
|
|
Recently, jio was blocking/slowing different apps/websites for me(by sniffing dns etc), to overcome that you can use this: |
|
Thanks |
|
binwalk extract of firmware https://github.com/fawazahmed0/Jio-fiber-Modem/releases/download/v1.2/squashfs-root.zip |
|
did you dump the firmware? or got it from an OTA update file. |
|
I don't remember, probably OTA update file |
|
passwd.txt tty console user & password might be: root password hash(takens from /usr/etc/passwd of firmware): |
|
This was shared by Guide to Get JioFiber Router's dbglogs (Tested on JCO4032 with Firmware SRCMTF1_JCO4032_R2.26) by Ankal Pal Install openssl and add to Environment Variables for direct CLI Access
openssl aes-128-cbc -d -kfile "server.key" -in "reliance-dbglog-enc.tgz" -out "reliance-dbglog.tgz"
Use DB Browser (SQLITE) to open the files with .db extensions... The most interesting file is system.db as it contains WiFi Passwords and also the Router Web Configurations and the TR-069 Configurations (but the TR-069 Password is encrypted by some unknown algorithm which Idk.. You can decompile the Shared Object (Compiled C Program) file squashfs-root/pfrm2.0/lib/lua/5.1/passwdSecureLib.so and if you find anything please do share with me at https://t.me/itsyourap |
|
Also The files in squashfs-root/pfrm2.0/var/www contains all the webpages and LUA Scripts used |
|
If you want to decompile passwdSecureLib.so library to get the decrypted values, you don't really need to do that. You can directly use the library from lua interpreter to decrypt the values. Please find an example below I hope this will be helpful |
|
Thanks a Lot for this information! Looking forward to use it wisely. |
|
Well. Looks Like this file is the library that encrypts the password from the
Let's see if I can find anything next. I will surely give an update. |
|
Will be inspecting the Router Startup File at |
|
Enable FTP and disable TR-069 in Jio Router by modifying backup configuration file: Install openssl and add to Environment Variables for direct CLI Access
You can block TR-069 by changing: Change and you can also enable or disable other options in config file.
You should now have FTP enabled, TR-069 disabled/blocked. Note: FTP username will be admin & password will be your admin password. Thanks to @itsyourap for this guide. |
|
WARNING: Disabling TR-069 will also disable JioCall and JioSTB |
|
The Server.key file doesn't seem to work. Maybe it has been updated in the last 2 years. Getting this error. Can someone help with this *** WARNING : deprecated key derivation used. |
|
I have found quite a lot about the JioFiber ONT Gateway and uploaded all my findings to my repository : https://github.com/itsyourap/JioFiber-Home-Gateway Please check. |
|
Updated My GitHub repository regarding how to get root access via Telnet (without even using Serial). Please check! |
|
Great! |
|
Very Helpful! Thanks. |
|
@fawazahmed0 did you explore flashing firmware thru serial? |
|
nope |
|
Hi @fawazahmed0, On serial/ttl adapter, how much volt is required for vcc? 5v or 3v or board power adaptor? https://www.aliexpress.com/item/1005004605363950.html is this likely to work for wson8 |
I used 3.3v and seemed to work fine. Also I have a better reader than CH341 but the problem is I need to desolder the wson IC and I'm not sure if that will cause any problems in the future when I disconnect the connection. I also don't have a hot air rework station to pull it off. |
check some help from TV/Mobile technician shop with downloading/emmc skills. Doing same for uart soldering 🔢 |
|
is there a way to know the voip settings of jio fiber if yes please let me know |
|
Thanks for the detailed update, any change with jio guys or their router for bridge mode? or this is the only way out till date.Any thirdparty router which supports jio. What is the password? only way is to do dictionary/Brute attack in serial console ? |
|
|
|
Hi, can you check or send me the help command list weather I have any method to re-enable it from bootloader. On the other hand ssh can log into vty but require second password for shell, which I don't know. |
|
I stumbled upon this searching for some of the unique file names in my router here in Thailand. It seems they use a very similar setup, except all the user/pass are plain text. Maybe some of them are the same for your Modems? My guess is at least the console one is the same. Try these: <FtpEntry Active="No" ftp_username="admin" ftp_passwd="skyworth" ftp_port="21" />
<ConsoleEntry Active="Yes" console_username="admin" console_passwd="$!%^kyw0rth" />
<TR64Entry/>
<Entry0 Active="Yes" username="superadmin" web_passwd="72af*9F-_-Ck!c@" display_mask="FF FF FF FF FF BF FF FF FF" pwd_control="1" Logged="0" LoginIp="192.168.1.36" Logoff="1" />
<TelnetEntry Active="No" telnet_username="admin" telnet_passwd="$O(Li0_o)$!%^" telnet_port="22666" />
<FtpEntry Active="No" ftp_username="admin" ftp_passwd="skyworth" ftp_port="21" /> |
|
I have a device with Same CPU en7528, were you able to get the bootloader password? |
|
Try these: |
|
any reason why you specifically said these passwords? |
|
Guys, what's the current and working way to achieve the bridged mode on JCOW414? (Firmware R2.57) |
|
Is there anyway to flash openwrt to it?? |
|
😢 |
|
@Vardhan-IMMIDI Theoretically, you can! But you need to find your own way to do so. There are no pre built openwrt images specific for the routers. Also, even if you manage to do so, you will face a lot of issues since J uses their code for authentication, network etc etc which may not work with openwrt |
|
There are people that are trying to bring support for this chipset family. Some links for the same
If you are comfortable trying things out, you can check those out and try to adapt things for your router. |
|
Did anyone managed to use any of the JF Ont's to work on EPON OLT? or even for GPON? |
|
The reliance.reliance login which prevents us from accessing the full root powers, username: root , password was someone able to crack it? |
|
I don't understand your question. What do you mean by "cracking" the web admin panel? |
|
|
|
LoL! I guess you are new here. It's already cracked years ago
|
|
So its different for each router? And the process seems soo time taking too, I looked at it and it's really confusing. |
|
I have a JCO4032 ONT model... I have tried a hell lot of things and havent been able to enable ftp/smb or get root access |
|
|
|
Currently, we don't have any other way |
This might work but how can I get the actual encryption keys? because all their access has been blocked |
|
is there any way to get root access on |
|
any updates? Firmware Version |
|
Hello everyone, Has anyone installed OpenWrt on JioRouter? Would you please mind sharing the steps that need to be followed? |
|
Guys I just tried out openwrt on the Jc4032 and have wifi and ethernet also working, its possible to install openwrt on this thing!! even I have only tried to ramboot till now, after poking around with the dts files, firmware files, I was able to get most things working. I will flashing the router with openwrt, discuss the results and release the files later! |
|
news of the day for me, Fantastic |
|
Cool! Will be waiting for the walkthrough. |
|
Sorry Guys, Was travelling for the past week, good news is I was able to flash openwrt with success and even use luci! |
|
here guys try out the firmware if you can, do tell me the results/ anything you notice! |
|
lan works on 1gbps ? |
|
Can anyone having JC04032 with root access dump all the mtd partitions here! I might have erased mine while working on some things (even though I had a backup, which I somehow deleted) Thanks! |
and others
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
In the Name of God, Forgiving & Merciful
Images:
UI
Inside Pics:
Details:
Processor:
Econet en751221 (MediaTek)(MIPS)
**IP:**192.168.29.1
Serial Pinout:
Serial Speed 115200
Serial/root User Password:
user: root
pass: (Someone Has to get it)
root password hash(takens from /usr/etc/passwd of firmware):
root:$1$Bs7AbXc3$5ES9/qevksgaht3meFpak1:0:0:root:/:/bin/sh
Someone Have to get the root password by either:
Performing dictionary/Brute attack in serial console to get the password (I made a script to do that:
https://github.com/fawazahmed0/Jio-fiber-Modem/blob/main/serial%20password%20cracker.js
But it's not fast, around 18-20 password tries/minute , also I have to add little more code to perform dict attack
Also there is one more repo that could crack password, but I haven't tried it, https://github.com/ananace/serial_crack
)
or
Get JIO fiber router firmware, mount it to get the password or hash
Serial log:
Benefits of Root/Serial Access:
Many benefits, including bridging mode support etc, which will start working when you login as root user (I got to know from some chinese forum about it, use chrome translate to view the links , https://wzq.io/2018/12/11/%e5%8c%97%e4%ba%ac%e8%81%94%e9%80%9a%e5%85%89%e7%8c%abG-140W-UD%e8%b6%85%e7%ba%a7%e7%ae%a1%e7%90%86%e5%91%98%e7%a0%b4%e8%a7%a3%e5%8f%8a%e6%94%b9%e6%a1%a5%e6%8e%a5/
https://www.right.com.cn/forum/thread-374907-1-1.html
https://89lg.cn/16.html
), disabling Remote access by ISP(TR-069) etc
Router similar to:
Similar to TP-Link VR1200v/SyRotech SY-GPON-1110-WDONT
Bell G-140W-UD (newer version)
Unicom G-140W-UD
Person who got WAN IP with bridge mode(but no internet)(Thanks to u/Countlesshrs@reddit for sharing this, I haven't tried looking future into this, but will look into it, when I get some free time):
https://broadbandforum.co/t/198869/page-16#post-1500544
Bypass Jio DNS sniffing:
The below app will make your internet run faster and also all the websites will open without any issue.
Here's the link: https://1.1.1.1/
Firmware for JCOW414:
https://github.com/fawazahmed0/Jio-fiber-Modem/tree/main/Firmware
binwalk extract:
https://github.com/fawazahmed0/Jio-fiber-Modem/releases/download/v1.2/32.bit.MIPS.Little.Endian.binary
https://github.com/fawazahmed0/Jio-fiber-Modem/releases/download/v1.2/squashfs-root.zip
ref: https://embeddedbits.org/reverse-engineering-router-firmware-with-binwalk/
TTY username: admin
tty pass: 1234
(I haven't tested)
Other information:
see the files
https://github.com/fawazahmed0/Jio-fiber-Modem
BSNL/Generic GEPON modem teardown fawazahmed0/Generic-GEPON-Modem#2
Posted about this discussion:
https://www.reddit.com/r/india/comments/l8az4t/jio_fiber_modem_router_details_serial_log_ways_to/
https://techenclave.com/threads/jio-fiber-modem-router-teardown-details-serial-log-ways-to-achieve-bridge-mode-etc.196527/
https://broadbandforum.co/t/207698/
All reactions