Topic 'Re: Sagemcom F@st 2864 unlock on *nix' in forum 'TekSavvy' - dslreports.com

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 25 Apr 2013 20:58:21 EDT

sibisties posted : It's a known bug, I'm working on a new version to address this issue.

Meanwhile you can try Linux commands as suggested by t3st3r.

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 25 Apr 2013 20:57:16 EDT

RRRR posted : Awesome, that worked, thanks, I missed it! :D

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 25 Apr 2013 20:30:37 EDT

t3st3r posted : You're probably better off asking these questions in the unlock tool thread: »Line Stats & Telnet Unlock Tool for Sagemcom 2864 (V1.01)

There are even instructions and tools for doing the process in Linux here: »Re: Line Stats & Telnet Unlock Tool for Sagemcom 2864 (V1.01)

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 25 Apr 2013 20:18:25 EDT

RRRR posted : Hey, thanks for your efforts! :)
I'm not used to windows much (Linux here) and got the modern.ie image working (IE10/Win7) and unpacked the 1.01 release...

It asks if I'm behind a router (since virtualbox is bridging internally) and, though I can access the modem's web page without any issue from Win7, after I say Yes twice, it seems to be working for a while but than fails...

So... bridging related or firmware version related? :)
firmware version: FAST2864_v6740S

Cheers!

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 25 Apr 2013 19:13:54 EDT

RRRR posted : EDIT: see below
(can't seem to delete a post, oops! ;))

Re: Sagemcom F@st 2864 unlock on *nix

Sat, 20 Apr 2013 18:03:40 EDT

t3st3r posted : The instructions for the downgrade method are here: »Re: [DSL] bridge mode on Sagemcom f@st2864.

There are some clarifications in the following posts so I recommend you look through them if you run into trouble.

Re: Sagemcom F@st 2864 unlock on *nix

Sat, 20 Apr 2013 17:58:18 EDT

docbill posted :

said by t3st3r:

Good news!

It is possible to revert to an older firmware and enable telnet access. The firmware change is temporary and is lost on reboot but the change to the config file is persistent (unless you factory reset).

Basically you use the tftp recovery boot method found here »translate.google.com/translate?h···kQ7gEwAQ

Does anyone have an updated version of this link? The "newer" method is not working for me, as the modem fails to unpack and install. So I thought I would try this older method. But the link provided here no longer works.

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 11 Apr 2013 09:59:33 EDT

lawrenson posted :

said by sibisties:

That's exactly what I did! Tonight I'll release everything, including sources.

--edit: Done! »Line Stats & Telnet Unlock Tool for Sagemcom 2864 (V1.01)

That's a very interesting method, thanks for sharing.

Re: Sagemcom F@st 2864 unlock on *nix

Thu, 11 Apr 2013 09:33:15 EDT

sunday8pm posted : Brilliant we now have two methods to get back in :)

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 20:35:03 EDT

sibisties posted :

said by t3st3r:

If you've managed to insert a new page that pulls stats from the VDSL executable...

That's exactly what I did! Tonight I'll release everything, including sources.

--edit: Done! »Line Stats & Telnet Unlock Tool for Sagemcom 2864 (V1.01)

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 20:25:07 EDT

t3st3r posted :

said by sibisties:

Last summer I sucessfully dumped the firmware from my Sagemcom modem. After deep analysis, I found a flaw in the web interface that could be used to inject executable code. My goal was to use this flaw to enable a page with line stats, and I succeeded.

I released my tool here on the Bell forum but it has been removed minutes later. My work was considered "too suspicious" because I didn't want to include the source code of the injection tool.

Too bad, I guess I'll be the only person with a beautiful line stats page on my Sagemcom. And yes it is still working with the latest firmware version! :D

Could you provide some more details on the page you are viewing the stats on? e.g. the path shown in the address bar (index.cgi?page=~name of page~).

I've dumped the openRG executable and I can't seem to find anything that includes the line stats.

If you've managed to insert a new page that pulls stats from the VDSL executable could you post the code for it? That wouldn't include any system vulnerabilities so it should be safe to post.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:31:47 EDT

BTC Kevin posted : or maybe try doing it using fping in cron settings


5 5 * * *  root   fping -q google.com && /some/script

then inside what ever /some/script is run the curl


curl --user admin:admin -d "action=submit&page=resets&factory_reset=reboot" 192.168.2.1

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:18:00 EDT

BTC Kevin posted : Hmm maybe something like this? haven't tested.


#!/bin/bash

function check_online
{
    netcat -z -w 5 8.8.8.8 53 && echo 1 || echo 0
}

# Initial check to see if we're online
IS_ONLINE=check_online
# How many times we should check if we're online - prevents infinite looping
MAX_CHECKS=5
# Initial starting value for checks
CHECKS=0

# Loop while we're not online.
while [ $IS_ONLINE -eq 0 ];do
    # We're offline. Sleep for a bit, then check again

    sleep 10;
    IS_ONLINE=check_online

    CHECKS=$[ $CHECKS + 1 ]
    if [ $CHECKS -gt $MAX_CHECKS ]; then
        break
    fi
done

if [ $IS_ONLINE -eq 0 ]; then
    # We never were able to get online. Kill script.
    exit 1
fi

# Now we enter our normal code here. The above was just for online checking

curl --user admin:admin -d "action=submit&page=resets&factory_reset=reboot" 192.168.2.1

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:11:22 EDT

mjfrazer posted :

said by QuantumPimp:

Have you seen this thread?

»[Internet] Howto: Sagemcom F@ST 2864 remotely reboot via Curl

That's what I want! Thanks.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:09:58 EDT

mjfrazer posted :

said by BTC Kevin:

i'm guessing the tool you want is a Cron Job for a linux server that is running a bittorrent client.

And the cron would heartbeat a ping to a internet server and when down causes a
CURL code to do a POST|GET action into the sagemcom's GUI to trigger a reboot for you?

That's right. I just need the URL of the reboot CGI.

I would probably cache some google IP addresses and reboot the modem when I can ping them but not wget from them.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:09:37 EDT

QuantumPimp posted :

said by BTC Kevin:

Have you seen this thread?

»[Internet] Howto: Sagemcom F@ST 2864 remotely reboot via Curl

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:07:41 EDT

mjfrazer posted :

said by BTC Kevin:

what is the global max connections you are using?

and are you running DL and UL at 100%?

I use transmission as my BT client. I closed down my client counts and it seems to keep things running for at least an hour now. I never had any problems with my Thompson ST516 running 16/1 for a year and 2/.6 for years and years before that. (Bad ADSL1 line/profile got fixed up moving to ADSL2). My line stats are solid and I don't see my DSL drop. When my modem hangs, I can always ping 8.8.8.8 and the teksavvy DNS server addresses through it.

Global max peers = 24 (formerly 120)
Max Connections for new xfers = 12 (formerly 60)

D/U limits = 2500/1000 and 500/500 (speed limit)
Speed limit is on from 8am to 2am.

I rarely torrent, so it is not a big deal for me. I imagine other users must hit this a lot more than I do.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 14:02:43 EDT

BTC Kevin posted : i'm guessing the tool you want is a Cron Job for a linux server that is running a bittorrent client.

And the cron would heartbeat a ping to a internet server and when down causes a
CURL code to do a POST|GET action into the sagemcom's GUI to trigger a reboot for you?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 13:59:53 EDT

BTC Kevin posted : what is the global max connections you are using?

and are you running DL and UL at 100%?

:edit: if values are to high can cause crashes.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 13:56:36 EDT

mjfrazer posted :

said by BTC Kevin:

what exactly are you wanting to do? reload the firmware? change the config file? or reconnect the PPPoE?

Sorry, I should have said reboot the modem rather than reset.

This seems to be the only way to get the modem out of its NAT hung state where it can ping through to IP addresses, but cannot make TCP connections. I'm just assuming that is because the NAT processing as hung up. For me, I seem to hit this about hourly when torrents are active.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 13:51:09 EDT

BTC Kevin posted :

said by mjfrazer:

Has anyone crafted a wget/curl command line to reset these modems when running the latest firmware? I have not tried to wade through the javascript to see which eventually gets called.

This would allow a cron job to check the modem and reset it when http connections stop working.

what exactly are you wanting to do? reload the firmware? change the config file? or reconnect the PPPoE?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 13:29:28 EDT

mjfrazer posted : Has anyone crafted a wget/curl command line to reset these modems when running the latest firmware? I have not tried to wade through the javascript to see which eventually gets called.

This would allow a cron job to check the modem and reset it when http connections stop working.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 12:55:27 EDT

QuantumPimp posted :

said by sunday8pm:

The 2864 has got the external IP, the router has a 192.168.2.x IP. Because the 2864 has DHCP NAT etc disabled, has only the router connected to it and has this router in the DMZ then I guess it's the best of both worlds? I'm not an expert so I realise I might be missing something but I have been using this setup for ever and never had any NAT problems

Ya, I think you're under the impression that NAT is disabled on the 2864. You have disabled DHCP but NAT is still being done. Has to be. There is no way 192.168.2.X addresses can escape your local network and go through the PPOE tunnel and return.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 12:44:12 EDT

BTC Kevin posted : think that is actually just a single conf option

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 12:43:13 EDT

HiVolt posted : Hope you guys find a way to disable the freakin TR69...
--

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:53:47 EDT

BTC Kevin posted :

said by t3st3r:

It looks like the telnet value in the config file is left unchanged once it has been set. As long as you don't wipe you config file by doing a factory reset it shouldn't change.

It looks like it would be trivial for Bell to push a config update that switches it back, but they haven't. I'd guess that they won't touch the router config in most cases as it could break networking for anyone that had customized the settings through the web interface.

Just out of curiosity, where did you find the firmware urls?

Just a note, t3st3r. I was reading back in thread. and to let you know.

Bell did push a config file to my router, so no one count that happening out of the picture. That is how I lost my telnet. I was telnet modded and latest firmware patched for ages. then Bell bumped my config file to defaults.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:38:11 EDT

BTC Kevin posted : downgrade complete!

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:34:03 EDT

t3st3r posted : That image will also work with the TFTP firmware trick I posted earlier.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:32:19 EDT

BTC Kevin posted :

said by lawrenson:

https://dl.dropbox.com/u/6483447/Bell/FAST2864_v66398.img.secure

You can flash it from the command line (flash load command) if you currently have telnet access, if not then you're on your own.

Lawrenson whats the CLI command to load that to flash memory pertinently? flash load -u -s 6
?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:31:45 EDT

t3st3r posted : There are options to completely disable the SPI/firewall on PPPoE though the command shell (the openRG one, not busybox). There are also about 6 sets of somewhat duplicated VLAN and bridging functions there. Keep in mind that disabling the firewall without going into a complete bridge mode would open up the wan side remote admin to everyone.

I'm trying to get my hands on another unit so that I can play around with this stuff without killing my internet access/having to factory reset my main Sagemcom.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:09:49 EDT

BTC Kevin posted :

said by sunday8pm:

I have set the 2864 to be 192.168.2.1
On the WAN port, the modem has the IP 192.168.2.10, gateway 192.168.2.1 and is set to static (no PPPoE)
On the 2864 192.168.2.10 is in the DMZ
I have an iptables rule in the router that allows me to access the 2864 from my LAN even though my LAN is 192.168.1.x

Everything on my network is handled by the router (QoS, DHCP, Firewall, DNS, DNSmasq etc), except the PPPoE that is done directly on the 2864.

The point is... that is the BAD/wrong way to do it. We are trying to not do the double NAT DMZ method. That said that is the "work around" method I suggested earlier.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:09:07 EDT

sunday8pm posted : The 2864 has got the external IP, the router has a 192.168.2.x IP. Because the 2864 has DHCP NAT etc disabled, has only the router connected to it and has this router in the DMZ then I guess it's the best of both worlds? I'm not an expert so I realise I might be missing something but I have been using this setup for ever and never had any NAT problems

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:06:16 EDT

jmck posted : and how is your router getting the PPPoE IP?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:04:30 EDT

sunday8pm posted : I have set the 2864 to be 192.168.2.1
On the WAN port, the modem has the IP 192.168.2.10, gateway 192.168.2.1 and is set to static (no PPPoE)
On the 2864 192.168.2.10 is in the DMZ
I have an iptables rule in the router that allows me to access the 2864 from my LAN even though my LAN is 192.168.1.x

Everything on my network is handled by the router (QoS, DHCP, Firewall, DNS, DNSmasq etc), except the PPPoE that is done directly on the 2864.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 11:01:33 EDT

lawrenson posted : »dl.dropbox.com/u/6483447/Bell/FA···g.secure

You can flash it from the command line (flash load command) if you currently have telnet access, if not then you're on your own.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 10:26:41 EDT

warren posted : Would someone mind IM'ing me a link of a vulnerable version of firmware, I wouldn't mind playing around with this...

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 10:22:08 EDT

jmck posted : what address is your router receiving if you've disabled DHCP/NAT on the modem? i don't see how the modem can establish a PPPoE connection and then hand off that IP somehow to another device.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 10:16:48 EDT

sunday8pm posted : If you disable NAT on the 2864 and put the router in the DMZ on the 2864, how is that double NATing?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 10:02:29 EDT

BTC Kevin posted : because it's double nat'ing. and is you host pppoe pass thru's the 2864 drops to max 36mbps. this is what we are trying to fix. we need a inferface bridge mode to pass the pppoe instead for routers.

:edit: basicly we are trying to fix/bypass Bell's fudge-sickle of a messed up PPPoE pass thru.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 09:59:12 EDT

sunday8pm posted : Maybe I am missing your point, but why don't you let the sagemcom handle the PPPoE session, disable NAT and DHCP and connect it to the WAN port of your router? Put the router's IP on the DMZ in the sagemcom's config and then you have your router treat the WAN port as an always on, static IP connection.
This way you can still use your own router for all things QoS etc and get full speed. That's what I am doing with a Tomato router and it works great.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 09:19:46 EDT

BTC Kevin posted : I was poking around more today and it looks like the modem does not even allow passing packets from the eth0 to the ds0, eth1, eth2 wan interfaces directly.

In fact all WAN bound traffic on eth0 LAN is all handled by the NAT+QOS and it will only ever pass packets to the active assigned pppoe dev.

This so makes me want a generic openRG firmware build for these modems.

:edit:
been trying to re-engineer the ifconfig and nat settings. but apparently Bell forces a PPPoE active, and fail credentials reverts it to the default sc ID to get Bells "walled garden". if you bye-pass the pppoe it causes a kernel panic. and need to re flash. And if a PPPoE is present WHICH it always is, it NAT's to the pppoe.

GRR, going to still have to play more with this and see if I can manually get a bridge going. I can't even do TCPIP directly to the WAN port of the modem. I was able to get a custom additional PPPoE added to the WAN port though... so baby steps I guess.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 08:56:07 EDT

HiVolt posted : I'd be interested to hear if anyone can find a tweak to remove the 35mbps limit in pppoe passthru mode...
--

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 07:45:32 EDT

infamouskid posted : so in English?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 03:36:38 EDT

BTC Kevin posted : tested and telnet is now active on my unit. still trying to force a firmware downgrade so this wont happen again. But for now working good, and can get line stats again. Maybe I will consider start using this machine once again.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 00:17:05 EDT

QuantumPimp posted :

said by sunday8pm:

Congrats! It's not clear how to get the flash to glitch though unless something was lost in translation?

Oh, does the following not work?

Ok, but in flash glitchs are risky. Another way I found out later it was the way that the LAN_RESCUE 2764 GV has:

Unplug the modem from;
Hold the reset button;
Turn on the power and hold the reset for a few seconds.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 00:15:48 EDT

t3st3r posted : It's a bit below that. If you're reading the translated page search for "Ok, but in flash glitchs are risky."

The reset and tftp instructions are below that.

There is quite a bit lost in translation but my Portuguese is terrible, so I have to make do with Google.

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 00:12:53 EDT

sunday8pm posted : Congrats! It's not clear how to get the flash to glitch though unless something was lost in translation?

Re: Sagemcom F@st 2864 unlock on *nix

Wed, 10 Apr 2013 00:04:42 EDT

QuantumPimp posted :

said by t3st3r:

Good news!
Basically you use the tftp recovery boot method found here »translate.google.com/translate?h···kQ7gEwAQ

The modem will search on the LAN ports for a DHCP/TFTP boot server, as long as you're running one you can push firmware to it.

Wow. That was fast and really entertaining. The references you posted allowed me to get my geek on :-) Thanks for sharing.

I never realized how popular and widespread Sagemcom products are to have such an active hacking community.

Re: Sagemcom F@st 2864 unlock on *nix

Tue, 09 Apr 2013 23:02:56 EDT

t3st3r posted : Good news!

It is possible to revert to an older firmware and enable telnet access. The firmware change is temporary and is lost on reboot but the change to the config file is persistent (unless you factory reset).

Basically you use the tftp recovery boot method found here »translate.google.com/translate?h···kQ7gEwAQ

The modem will search on the LAN ports for a DHCP/TFTP boot server, as long as you're running one you can push firmware to it.

You'll need to have an older version of the firmware that still has the config exploit in it. I was sent a link for v66396 by another user here (I'll post it with their permission).

Once the firmware has been uploaded you can run the "telnet.exe" config tool or use the method posted in the OP to enable telnet access.

After that you can continue using the modem with the older firmware or reboot it to return to the latest firmware with your telnet access still enabled.

Now for the bad news. You still can't enable any "hidden" pages in the web config. They aren't there, Bell has pulled them completely. Likewise the "runlevel" setting that was found on the Sagemcom 2764 that allowed for true bridge mode isn't in there either.

However it may be possible to modify the routing config to enable a bridge only mode now that we can access the base firmware.

Re: Sagemcom F@st 2864 unlock on *nix

Tue, 09 Apr 2013 20:59:21 EDT

t3st3r posted : Ah, that makes sense, /dev/mtdblock1 is where it keeps everything once booted. You could probably use binwalker to extract the file system from that dump and view the contents as individual files, it's basically a RAM disk.

I can't see any of that as it isn't in the firmware image itself. It looks like the update info is pulled down from the Bell management server once the system is booted. The only URL I've found in the firmware is for the management server itself.