dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
15837
share rss forum feed

pulsar777

join:2009-12-21

[Unlock] Unlocking Linksys SPA2102 adapter

I want administer some settings of Linksys SPA2102 adapter, so I need to connect to its web interface. When I type adapter IP address, it ask for a password. I tried some defaults, like admin with no password, and no username with "admin" password, or "admin", "admin", this not work. Is there way to find SPA2102 admin password? (and other passwords if there is). The SPA device was provisioned by a service provider, therefore I don't want to erase all the configuration settings.


Stewart

join:2005-07-13
kudos:21

If you enter just the IP address in your browser, you should see the password screen showing "spa user" or similar. The user name is "user" (without the quotes) and the password should have been supplied by (or be readily available from) your provider. It's usually something simple like 1234. However, this "user" access is limited to parameters that the provider has designated as user changeable. Speed dials, IP address, port forwarding, etc. are generally in this category.

If you enter i.p.add.ress/admin/ in your browser, you should see the password screen showing "spa admin" or similar. The user name is "admin" (without the quotes) and the (probably different) password might be available from your provider, if you explain that are having a technical problem that is best fixed by you making some settings changes. This "admin" access, if enabled, allows modification of all device settings. Alternatively, they may simply make the requested changes at their end.

If the provider won't cooperate, you might try some Google searches; possibly the passwords are the same for all their users. Or, try capturing traffic from the device as it boots up -- with luck, the provisioning file is unencrypted.

If none of the above helps, post provider name and the trouble you are having. It's possible that a member will have some useful advice.


pulsar777

join:2009-12-21

I already tried the first two ways, but default user name and password combinations not work. Btw, how to capture traffic from the device as it boots up?


IPfaxer

join:2010-10-24
reply to pulsar777

just don't do it - just call the provider or get a new provider - locked devices suck

otherwise you can reset your ATA and then do what you want


pulsar777

join:2009-12-21

1 edit

unfortunately, the both above options is not suitable in my case.
Have anyone the schematics for the Linksys SPA2102 adapter? The SPA2102 uses SIPURA SIP316FF chip. Maybe someone schematics for that adapter?

Stewart

join:2005-07-13
kudos:21

IMO, it's very unlikely that hacking the hardware will be productive.

If you want help, post as much detail about the problem as possible.

What is wrong (or what would you like to change) with your present setup?

Given that your provider is apparently unwilling to fix it, why do you want to stay with them (long contract, no one else can port your number, etc.)?


pulsar777

join:2009-12-21

well, there are no obvious connectors pins on board.
Is there way to get device configuration file, to decrypt it, modify and reupload again?
I want to get admin password to be able to view settings and change it myself. In general, I'm satisfied with current service provider, except for a phone service, I want to be able to control all settings myself.


toro

join:2006-01-27
Scarborough, ON
kudos:6
reply to pulsar777

Who is the provider ?



VexorgTR

join:2012-08-27
Sheffield Lake, OH
kudos:1
reply to pulsar777

Did you try the "Reset By IVR" method? It worked for all the ones that Clear sent out.


pulsar777

join:2009-12-21

1 edit
reply to toro

local, non-U.S. provider. Reset By IVR method: did you mean reset the device to factory defaults with phone pad by dialing **** and pressing 7xxxx#..? It ask password at the end. Also I don't want to erase all the configuration settings.


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico
reply to pulsar777

Then unless your provider gives you the password there is very little you can do.
You can try to sniff the traffic from the ATA when it boots up, by connecting its WAN interface to your router through to an old hub (not switch), connecting your PC to the same hub and running Wireshark. The ATA will probably use TFTP, HTTP or HTTPS to retrieve its configuration file within the first 1-2 minutes of the boot up. Unless it uses HTTPS, you can actually see the request and the URL for the file and try to download it manually. Then, if you're lucky and the file is not encrypted you can get your passwords from there or you can spoof the provider's servers and "feed" the ATA another file which will reset the passwords. If the file is encrypted you are out of luck, you won't be able to decrypt it without knowing the key which is stored in the ATA.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net


pulsar777

join:2009-12-21

the ATA and PC both are connected to the router, which connected to cable modem. Do I need connect it through the hub before router? Also, I read somewhere that encryption somehow use MAC address of ATA for the key.


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico

said by pulsar777:

the ATA and PC both are connected to the router, which connected to cable modem. Do I need connect it through the hub before router? Also, I read somewhere that encryption somehow use MAC address of ATA for the key.

Yes, the hub basically replicates all packets to all ports, so your PC can sniff the traffic that is supposed to go to the ATA. With a switch (which is built into today's routers), the traffic only goes to the port of the device that is meant to receive it.
The encryption can be done in different ways, the most common one is to save a unique encryption key in the ATA and all the provisioning files feed to the ATA afterwards will be encrypted with that key.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

pulsar777

join:2009-12-21

If ATA use TFTP to retrieve its configuration file, the TFTP server may be configured to prevent direct download of configuration file, is it correct?


toro

join:2006-01-27
Scarborough, ON
kudos:6

Usually no. However that restriction may be implemented in case of HTTPS (but in that case you can't even see the URL for the config file)


IPfaxer

join:2010-10-24
reply to pulsar777

1. you can reset it
2. no, it will not save your configuration - it will RESET it - not just passwords

don't know why people are looking at diagrams of the circuit board - pretty irrelevant


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico

The ****73738# reset sequence can be blocked by the provider (basically it asks for the admin password), and in case of the OP it is blocked: »Re: [Unlock] Unlocking Linksys SPA2102 adapter
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net


pulsar777

join:2009-12-21

1 edit
reply to IPfaxer

said by IPfaxer:

don't know why people are looking at diagrams of the circuit board - pretty irrelevant

well, if this device has a programming ports that support jtag, it would be possible to dump the chip. However, the CPU has to support JTAG (which the ATA seems doesn't) and there has to be the connectors or test pads to connect to.

toro

join:2006-01-27
Scarborough, ON
kudos:6

There's no JTAG support on the Linksys SPAxxxx and PAP2(T) series of ATAs. Have you tried capturing the traffic with wireshark yet ?


pulsar777

join:2009-12-21

will try..


pulsar777

join:2009-12-21
reply to pulsar777

is it possible to configure the same phone number on another SPA in different network node?


toro

join:2006-01-27
Scarborough, ON
kudos:6

Do you have the SIP credentials, server info, etc ?


hardly
Premium
join:2004-02-10
USA
reply to pulsar777

And does the provider support multiple registrations?


pulsar777

join:2009-12-21
reply to toro

assuming that I will have the SIP credentials.


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico

This thread is full of questions and assumptions but except for taking the ATA apart you haven't tried anything yet.
If the provider doesn't give you the SIP credentials, there's no way to get them from the ATA, even if it's unlocked (you can read everything except for the passwords).
If you get the SIP credentials, you can set them up on another ATA in such a way that you can make outbound calls. For inbound calls the ATA must register with the VoIP provider and 99% of the providers don't support multiple registrations. If both ATAs are online, only the last ATA that has registered will ring on inbound calls.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net


pulsar777

join:2009-12-21

as I can no find hub, I connected PC to ATA ethernet port and cable modem to ATA internet port. I tried sniff packets with Ethereal, unplugged the AC adapter from the ATA, wait 30 sec then connected again. What I can see there is a lot of requests, I can see an IP address assigned to ATA, and "Server Identifier" IP address: is it IP address where config file requested from? The other info I see is Host name= SipuraSPA. But I didn't see config file name and path to this file. Also, I think the config file probably transferred via TFTP, not HTTP. How I can get it?


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico

You can't capture the traffic made by the WAN interface if your computer is connected to the LAN port.
You can often find hubs for a few dollars at thrift stores.
Some users have succeeded capturing the traffic by setting up Internet Connection Sharing on a laptop, connecting the laptop to the router via wireless and connecting the ATA to the LAN port of the router through a crossover cable. Personally I have never needed this setup so I haven't done it.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net


pulsar777

join:2009-12-21

1 edit

Well, finally I got the hub, connected ATA and PC, and captured the network traffic when the ATA is powered on. I can see some info, but I can no find path to server where ATA configuration file loaded during the boot. I am not sure, but config name seems is D3-3c.bin, that this name looks like cable modem config file, strange. I save capture, Ethereal default format. Can anybody help me?


toro

join:2006-01-27
Scarborough, ON
kudos:6
Reviews:
·Rogers Hi-Speed
·Bell Sympatico
reply to pulsar777

Can you start another capture, reboot the adapter and let the wireshark run longer (10-15 min) ? You only let it run for about 90 seconds and the only thing it capured was the DHCP transaction where the ATA got the IP address and then it registered to the VoIP provider.
--
Providers (through asterisk): voip.ms, freephoneline, smartcall.ro. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net


pulsar777

join:2009-12-21

2 edits

I attached another ones. ATA IP address 10.250.63.39
Is the D2.bin, D3-1n.bin, D3-3c.bin configs for cable modem?