The superuser password of ZTE f660 optical cat is successfully obtained and changed to remove four restrictions

ZTE's f660 optical cat changed after the last thunderstorm is still very good and stable, but the super password does not remember it. I found some information and successfully changed the password today, A brief Writing Process for your next Reference:

Step 1: Get the super password (known user nameTelecomadminPasswordNe7ja % 5 mCan be ignored)

1. Telnet 192.168.1.1

2. User name: Root, password: Root (Linux Password is not displayed, as long as you enter the correct password), press ENTER

3. If "#" is displayed, the login is successful. Then enter the command CD/tmp and press Enter.

Enter CP db_backup_cfg.xml/home/httpd and press Enter.

4. Return to the Windows desktop and enter http: // 192.168.1.1/db_backup_cfg.xml in the browser.

Search for telecomadmin, and there is a password under it, that is, the password!

Step 2: Change the super Password

1. Store the extracted files to the root directory of the USB flash drive, and insert the USB flash drive to the optical cat.

Telnet 192.168.1.1 login Username: Root Password: Root

Http://bluemem.googlecode.com/files/F660mima.rar

2. file replacement

Check whether the USB flash drive is recognized. Run the DF command.

If you see/mnt/usb1-1 or/mnt/usb2-1, it means you recognize the USB flash disk.

3. Now, let's Replace the file and replace the file that was just placed on the USB flash drive with the file in the relevant folder. The command is as follows:

CP/mnt/usb1_1/manager_aduser_conf_t.gch/home/httpd/

4. log on to the system using the administrator password obtained in the previous article, and view it on the following page:

If there are two more options, the common account is useradmin, and the management and maintenance account is telecomadmin.

After entering the information, click confirm to submit the modification. Now the password of the telecomadmin account is changed. Log out and log on to the cat with a new password, so that you do not need to remember the tedious Telecom password maintenance.

Last reminder:

The password should be as complex as possible (you must remember it). A simple password will be used by others.

CD/mnt/usb1_1

CP db_user_cfg.xml/userconfig/cfg

Reboot

Here is the configuration for removing the four restrictions. Thank you.Chinadsl. netOfWKAHero!

Thanks to the tests by several friends and confirmed the solution to truly crack the four restrictions, we will announce the following: Welcome to continue the test.

===:
1. xml must be in plain text. If there is no plaintext, only one copy of the configuration can be lost.
2. tr69 remote control must be removed because the restriction will be added again to invalidate the attack. The most concise way is to get rid of the server URL: such as http://devacs.edatahome... That, changed to http: // 127.0.0.1
3. The original maxuser is the control item of the pppoe proxy, which is irrelevant.

=== Method of cracking:
Use ultraedit or editplus to search for the cltlmt character. This may contain 9 IgD characters. the ctlmt 1-9 segment represents different types of online terminals, the last of which is IgD. cltlmt9 indicates all others. Observe the project under each IgD. cltlmt. The enable value indicates whether to enable the limit of this type. The max value is the limit. So you only need to change enable to 0 or Max to 800. Generally, the number under IgD. cltlmt9 is changed. For example:

<TBL name = "cltlmt" rowcount = "9">
<Row No = "8">
<DM name = "viewname" Val = "IgD. cltlmt9"/>
<DM name = "enable" Val = "1"/> ----> change to 0 to remove the restriction.
<DM name = "type" Val = "8"/> ----> type 8, indicating all other Internet terminals
<DM name = "Max" Val = "4"/> ----> is the maximum number.
</Row>
</TBL>

In addition, if no cltlmt field exists in the XML file, the default limit is 4, which must be added. Cltlmt guess the English meaning is client limit, client limit, clear.

Add some useful other modification items:

1. Search for "userif" to extend the protection for webpage logon timeout

<TBL name = "userif" rowcount = "1">
<Row No = "0">
<DM name = "timeout" Val = "5"/> -----> Protection for webpage logon timeout. The default value is 5 minutes. Change it to 30, saving you a short time...
<DM name = "language" Val = "2"/>
</Row>

2. Search for "userinfo" and modify the Webpage Administrator password.

<TBL name = "userinfo" rowcount = "4">
<Row No = "0">
<DM name = "viewname" Val = "IgD. userif. userinfo1"/>
<DM name = "type" Val = "1"/>
<DM name = "enable" Val = "1"/>
<DM name = "username" Val = "telecomadmin"/> ----> change it to your favorite one !!
<DM name = "password" Val = "ne7ja % 5 m"/> -----> change to easy to remember ....
<DM name = "right" Val = "1"/>
</Row>

3. Search for "Telnet" and modify the telnet configuration.

<TBL name = "telnetcfg" rowcount = "1">
<Row No = "0">
<DM name = "ts_enable" Val = "1"/>
<DM name = "wan_enable" Val = "1"/> ----------> change to 0 to prevent Internet access
<DM name = "lan_enable" Val = "0"/>
<DM name = "ts_port" Val = "23"/> ----------> Port
<DM name = "ts_uname" Val = "root"/>
<DM name = "ts_upwd" Val = "root"/> -------> modify the default password to prevent attacks
<DM name = "max_con_num" Val = "2"/> ------ increase the maximum number of connections in Telnet to prevent locking
<DM name = "proctype" Val = "0"/>
</Row>

4. Search ftpserver to enable FTP and discard the USB flash drive, which greatly facilitates configuration file modification:

<TBL name = "ftpservercfg" rowcount = "1">
<Row No = "0">
<DM name = "ftpenable" Val = "0"/> ----> Change 1 to enable the FTP server.
<DM name = "SERVERPORT" Val = "21"/>
<DM name = "wanifenable" Val = "0"/>
<DM name = "ftpanon" Val = "0"/>
<DM name = "wanid0" Val = ""/>
<DM name = "wanid1" Val = ""/>
<DM name = "wanid2" Val = ""/>
<DM name = "wanid3" Val = ""/>
<DM name = "wanid4" Val = ""/>
<DM name = "wanid5" Val = ""/>
<DM name = "wanid6" Val = ""/>
<DM name = "wanid7" Val = ""/>
<DM name = "maxclient" Val = "5"/> ---> increase the maximum number of connections.
<DM name = "maxperip" Val = "5"/> ---> increase the maximum number of Single-IP connections.
<DM name = "maxrate" Val = "250000"/> ---> increase the maximum transmission speed.
</Row>
</TBL>
<TBL name = "ftpuser" rowcount = "8">
<Row No = "0">
<DM name = "viewname" Val = "IgD. ftpuser0"/>
<DM name = "username" Val = "admin"/> ----> modify the default FTP user group and password
<DM name = "password" Val = "admin"/>
<DM name = "location" Val = "/mnt"/> -----> change to/to access the entire file system.
<DM name = "userright" Val = "3"/>
</Row>

Supplementary content ):
5. Search for enablepassthrough and enable pppoe Forwarding (relay) or routing Bridge hybrid mode to implement multiple dialing and overlay bandwidth. Of course, the account itself allows multiple sessions.

<DM name = "enablepassthrough" Val = "0"/> --> Change 1

Supplementary content ):
6. Search for ethportconfproduct, configure parameters for the four network ports, and enable the four ports in Gigabit mode.

<DM name = "portisolateen" Val = "1" type = "option" text = "option"/> --> change 0 to disable port isolation, which helps improve the performance of the vswitch.

Additional content ):
<DM name = "maclimiten" Val = "1"/> --> change to 0 to disable the MAC address limit.

Supplementary content ):
<DM name = "ingresspolicing_cir" Val = "102400"/> --> change to 1024000 to 1g mode.
<DM name = "egresspolicing_cir" Val = "102400"/> --> change to 1024000 to set it to a gigabit Nic.

Supplementary content ):
Note: Some Optical cats only enable the Gigabit mode on Port 1, and both 4-4 are MB.

The superuser password of ZTE f660 optical cat is successfully obtained and changed to remove four restrictions