decyrption nolonger appears to work.

[Bonkalot]

I've tried this method on my Optus Sagemcom 3864AC, and all I get is a garbage/encrypted file at the end. Happy to provide the config backup and decrypted files if it will help.

Board ID:	F@ST3864AC
Symmetric CPU Threads:	2
HardWare Version:	253688887
Serial Number:	N7170953B002975
Mac Address:	f4:6b:ef:6a:ef:44
Build Timestamp:	180312_1608
Software Version:	8.379_F@ST3864AC_Optus
Bootloader (CFE) Version:	8.358
DSL PHY and Driver Version:	A2pv6F039x6.d26r
Wireless Driver Version:	6.37.14.4803.cpe4.14L04.0-kdb
Voice Service Version:	Voice
Uptime:	12D 15H 50M 20S
ConfigId:	F3864AC_Optus_5.conf

Hopefully this project is still something you are interested in :) I'm guessing the encryption method or the key has been changed.

[mattimustang]

Hi,

The firmware version has been updated to 8.379_F@ST3864AC_Optus so you are probably right and they have updated the key.

You need access to the CLI to get the key out of the httpd binary. Do you have telnet enabled?

In writing my script I found the list of possible candidate keys using these commands once I got the httpd binary extracted off the modem and onto my other linux system.

Conveniently the modem provides the netcat utility so if you can get CLI access you can use it to obtain the httpd binary.

To do this I ran this command on my other linux system:

nc -l -p 4444 > httpd

Then on the modem I ran:

cat /bin/httpd | nc <other linux ip> 4444
^C

Then on my other linux system I was able to get a shortlist of possible keys using these commands:

strings httpd > httpd.txt
grep -x '.\{33,33\}' httpd.txt > keys.txt

The possible keys will be in keys.txt.

If you have the ability to do this it would help otherwise when I get time I can try and get my spare modem to pickup to firmware upgrade and see if I can still get the httpd binary off it.

[mattimustang]

You need to extract the IV as well from httpd using:

grep -x '.\{17,17\}' httpd.txt > iv.txt

[mattimustang]

I've added a factory default config to the configs directory from my F@ST3864AC modem that is running firmware 8.358_F@ST3864AC_Optus. The password set to the default 8PTu5W@C and telnet is enabled.

Try:

1. unplugging you modem's WAN/DSL port
2. factory defaulting the config by sticking a paper clip in the RESET hole for 5 seconds
3. browsing to the modem after it reboots
4. uploading my config with telnet enabled.
5. telnet to 192.168.0.1 and login as admin with the password above.
6. type sh to get a regular shell.

From there the previous instructions to get a copy of httpd should work. You can zip and attach the httpd file to this ticket and I will have a look at it.

[hbsimon]

Hi,
I just received my Sagem modem and I want to enable telnet, but it won't upload the decrypted text file, the error message is invalid key. I am too tried just tried upload the unmodified decrypted text file and it too failed, attached file has my modem information.

[mattimustang]

@hbsimon I don't have a modem with firmware version 10.33 so I can't update my script. You could try these steps #12 (comment) to enable telnet and get a shell on the modem. Then obtain a copy of httpd from the modem using these steps #12 (comment) and send it to me for analysis along with a copy of your encrypted modem config.

With those files I should be able to obtain the new key and update my script.

[hbsimon]

thanks, I will try this weekend before I activate my NB

[hbsimon]

Hi,
I tried to upload your configuration, but it came back with an e FATAL ERROR DURING IMAGE UPLOADING, Invalid Session Key, try again.
It is not critical for me to get telnet going at there moment. I only wanted it to get the WAN address
for updating my free domain server with ddclient.

Thanks

[baronGoose01]

Hi Matt, years ago I used your guide to get into my sagemcom router, which worked perfectly and gave me the control of it that I required. Long story short, after a few moves and changes of optus service, I have another of these I'd like to get into, namely for re-setting up my dns/pihole setup, as well as vpn etc.

Once again I followed the guide, but much like hbsimon above, it seems the encryption has changed as decrypt-conf just spits out more junk in notepad.

Here is what i'm working with:

Board ID:	F@ST3864V2
Symmetric CPU Threads:	2
HardWare Version:	253561846
Serial Number:	N7171422J003042
Mac Address:	f4:6b:ef:b8:21:58
Build Timestamp:	180623_1623
Software Version:	8.353.21_F@ST5350_Optus
Bootloader (CFE) Version:	8.353.1
DSL PHY and Driver Version:	A2pv6F039x6.d26r
Wireless Driver Version:	6.37.14.4803.cpe4.14L04.0-kdb
Voice Service Version:	Voice
Uptime:	0D 19H 19M 47S
ConfigId:	F5350_Optus_11.conf

This is for a fttn connection. I can access the full settings by doing a factory reset and using one of the default passwords (while not connected to the net), but this is of little help as when I reconnect it it resets and wipes out my changes.

Is there any way you might be able to help me get into this? I'd prefer to not have to go buy another router right now but realise its something I should probably do in the future anyway. If it helps I actually have 3 or 4 of these routers floating around now including the one I previously got into - not sure if I could use one of them (one was a fttp connection, the other an adsl2) of if they'd just reset to the latest firmware anyway.

Cheers, and much appreciation for your help/efforts so far with this guide.

[mattimustang]

hi @baronGoose01,

Can you try uploading the sample config with telnet enabled that i have here https://github.com/mattimustang/optus-sagemcom-fast-3864-hacks/tree/master/configs
?
Getting hold of the httpd binary would be handy to debug this once you have telnet enabled. Use the instructions above to get it.

For what it is worth i'm still using my old white optus modem I had on ADSL2 for my FTTN connection even though they sent me a replacement when I got NBN. It is working fine.

[cmfarias]

Hi Matt! Thanks for sharing with us thoose findings.

I got a followed docsis 3 cablemodem:

Standard Specification Compliant | DOCSIS 3.0
Hardware Version | V2.0
Software Version | CVA-SIP_3.443.0-T1
Model Name | FAST3686
Linux S/W Version | 2.6.30-1.7.1mp3-svn16117
Cable Modem MAC Address | xx:ee:xx:ee:xx:00
Cable Modem Serial Number | DM4001476980262
CM certificate | CmCertificateInstalled

I got admin web access, but I can't decrypt their backup config. As like You told us early, key changes.

I'm wondering how can I get access to CLI. I have used a NTP hack, but this version does not has a NTP admin page.

Same hacks could be done via Diagnostics, but does not work anymore. Seems a recent fix there!

I mean thoose hacks I used was to inyect some code to launch dropbear o ncat by example.

How I can get CLI then? Here I stuck, and like that I will not able to play with netcat as You mention.

Thanks in advance!

cmf.

[mattimustang]

sorry @cmfarias, I don't that have model of modem to test with and can only recommend the techniques I've documented here.

[Oxyandy]

I too can no longer decrypt, what really annoys me was my modem received an update.
After that, everything was at default.. even SSID & PASS, I had SO many settings just wiped out.
Would disabling TR-069 really have prevented this ?

Board ID: F@ST3864V2
Software Version: 8.353.21_F@ST5350_Optus

[mattimustang]

@Oxyandy yes disabling TR-069 would prevent any updates from Optus.