Support for Technicolor TG788v v3 (VANT-Z) from Forthnet in Greece

[gecon27]

Happy New Year to all!

Any chances to decrypt the config.bin from a TG788v v3 in order to retrieve the VoIP credentials?
Unfortunately I don't have the binary and ssh is blocked.
Software version is Version Gold (17.1) (looks like Ansuel GUI).
Any ideas are welcome.
Furthermore, does this board support connection via serial cable in order to retrieve somehow the software binaries perhaps?
I am also willing to ship the board to anyone of you that could help.

Header file is as below:
PREAMBLE=THENC
BACKUPVERSION=1.00
BOARDMNEMONIC=VANT-Z
PRODUCTNAME=MediaAccess TG
SERIALNUMBER=CP1835CZBNB
MAC=A4:91:B1:6B:73:A5
BUILDVERSION=17.1.8001-0001007-20180523145805-4f071fd23e90c774b6827546188a38d6c91cff38
CIPHERKEY=GW
SIGNATUREKEY=GW

Thanks,
Giannis

[kevdagoat]

I would not have a clue. Hack Technicolor has never focussed on config extraction. config.bin is a very old Technicolor implemented thing. Sadly it is signed and hard to decrypt

…

Sent from my iPhone

On 6 Jan 2020, at 4:38 am, Ioannis Oikonomou ***@***.***> wrote:  Happy New Year to all! Any chances to decrypt the config.bin from a TG788v v3 in order to retrieve the VoIP credentials? Unfortunately I don't have the binary and ssh is blocked. Software version is Version Gold (17.1) (looks like Ansuel GUI). Any ideas are welcome. Furthermore, does this board support connection via serial cable in order to retrieve somehow the software binaries perhaps? I am also willing to ship the board to anyone of you that could help. Header file is as below: PREAMBLE=THENC BACKUPVERSION=1.00 BOARDMNEMONIC=VANT-Z PRODUCTNAME=MediaAccess TG SERIALNUMBER=CP1835CZBNB MAC=A4:91:B1:6B:73:A5 BUILDVERSION=17.1.8001-0001007-20180523145805-4f071fd23e90c774b6827546188a38d6c91cff38 CIPHERKEY=GW SIGNATUREKEY=GW Thanks, Giannis — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[flywire]

Look at #68 (comment)

[kevdagoat]

That requires modgui to be installed

…

Sent from my iPhone

On 6 Jan 2020, at 7:35 am, flywire ***@***.***> wrote:  Look at #68 (comment) — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe.

[LuKePicci]

@gecon27 usually we start getting root access to such devices. Once you got root, you have all configs readable without decrypting anything. You could also decrypt configs later using keys retrieved via root access, but this is not usually needed because everything is in cleartext inside. In other words, you stop caring about exported config.bin once you have root.

We know nothing about VANT-Z, we need to start investigating the usual things. Start with AutoFlashGUI untick flash firmware, try generic presets, let us know what happens. Maybe you are lucky and this will work at the first shot, who knows.

[flywire]

@varzeano - appreciate the advice you have rooted that model but some of the commands in that old strategy will actually brick the gateway. Please edit your comment changing the reference to https://hack-technicolor.readthedocs.io/ which will give a better result.

@gecon27 Just follow https://hack-technicolor.readthedocs.io/ Type 2 and use the AutoFlashGUI for the variant=DGA4130 TIM AGTEF_1.0.3 model which seems to have the same commands.

[LuKePicci]

use the AutoFlashGUI for the variant=DGA4130 TIM AGTEF_1.0.3

As far as I understood, he said to use Basic DDNS method, so either he selects that variant then changes method, or he selects Generic (Basic DDNS).

I wouls also like to get a confirmation from @varzeano that his router really is a VANT-Z with that same firmware and not just another similar 788 board.