电信太卑鄙了，连TTL密码也改了
前不久电信自动升级了我的九州PTV8098的固件，当时用的ITV看电视没注意到安的APK应用（当贝桌面）不能升级的问题，今天心血来潮，拔掉网线，连上无线，想当成网络机顶盒用。连上无线后，各种APP要求升级，但都安装失败，相当郁闷，百度了一下，是因为升级固件后，做了手脚而导致不能安装（改后辍为非.apk也不行），于是下载了旧版本的固件，准备恢复。恢复步骤很顺利，但是恢复后，不能注册itms，网友说要打10000号重新下发配置，于是我就打了10000号，按照惯例，电信会修改我的超级密码，我以为还是可以通过telnet的方式登录光猫获取超密，也没太在意。结果折腾一阵，ITV没搞定，telnet到光猫，发现电信居然把我密码给改了！给改了！！给改了！！！（电信在下发配置上，还做了一个事情，把我的四口光猫2和3口都配置成ITV端口了，我是把光猫设置成桥接的，这样我可以3拔，3口本来是分配给internet口的，现在被配置成ITV口，接在这个口的设备上不了网了，顿时心中万头羊驼奔腾... ...）没办法啊，接上TTL线，看能不能登录，结果和telnet一样被改了密码，顿时又问候了一遍电信的八辈祖宗。这样也不是办法啊，楼下的同事都上来问我两遍了（他的路由器接在3口的），实在没法的时候，我只好又拿出一个交换机拓展了两个网口，暂时解决了他上不了网的燃眉之急。稍微平复了一下心情，决得这事和电信没完，心里就想：在电信下发配置的时候，总会有相关参数吧，我接上TTL虽然进不了系统，但是我总能看到吧，要不然，就在重启的时候会对我的光猫进行配置，这我种能看到吧。于是我又接上TTL，打开SecureCRT,再次拔打了10000号要求解决我的ITV问题，就在打电话之间，看到SecureCRT屏幕上一串串命令闪过，心中暗喜，觉得有机会找到密码。于是把屏幕上的内容都复制下来，慢慢研究。特意还重启了一遍光猫，把重启过程中的信息也复制下来了。最终功夫不负有心人，成功找到了密码。
下面附上电信下发配置时的信息，看看大家能不能帮我从中找到关于登录系统的密码。
其中标红加粗的部分是超级密码
FAP TM: 0Kbps -> tokens <0>, bucketSize <0>
eth0 (switch port: 0)Link DOWN.
FAP TM: port <0>, portEnableMask <0x86>, tokens <6187>, bucketSize <24748>
FAP TM: port <0>, portEnableMask <0x86>, tokens <6187>, bucketSize <24748>
br0: port 2(eth0) entering disabled state
ARL table flush done
Success
FAP TM: 99000Kbps -> tokens <6187>, bucketSize <24748>
eth0 (switch port: 0) Link UP 100 mbps full duplex
br0: port 2(eth0) entering forwarding state
ARL table flush done
Success
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
FAP TM: 0Kbps -> tokens <0>, bucketSize <0>
eth0 (switch port: 0)Link DOWN.
br0: port 2(eth0) entering disabled state
ARL table flush done
Success
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
FAP TM: 99000Kbps -> tokens <6187>, bucketSize <24748>
eth0 (switch port: 0) Link UP 100 mbps full duplex
br0: port 2(eth0) entering forwarding state
ARL table flush done
Success
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
the pon power info :
the temp is
the vottage is
the txbiascurren is
the txpower is
the rxpoweris
src =10.0.1.49 dst=10.137.127.22
PRE src =0.0.0.0 dst=0.0.0.0
:====filebuf=nameserver 10.0.1.51
====
:====filebuf=gateway 10.137.112.1
====
:====gwIpAddress=10.137.112.1====
cd.................ip route del 10.0.1.49/32 dev epon0.1
cd.................ip route add 10.0.1.49/32 via 10.137.112.1 dev epon0.1
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=247,nowTms.sec=292,_debugConfigObj->internelInformStart=45====
:====processInterval=247,nowTms.sec=292,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
iptables: No chain/target/match by that name
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
Aug 14 22:59:17 :: Enter.
Aug 14 22:59:17 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:17 :: Exit.
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=249,nowTms.sec=294,_debugConfigObj->internelInformStart=45====
:====processInterval=249,nowTms.sec=294,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========doGetParameterNames sucess
: ===========doGetParameterNames sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=250,nowTms.sec=295,_debugConfigObj->internelInformStart=45====
:====processInterval=250,nowTms.sec=295,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========doGetParameterNames sucess
: ===========doGetParameterNames sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=252,nowTms.sec=297,_debugConfigObj->internelInformStart=45====
:====processInterval=252,nowTms.sec=297,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========doGetParameterValues sucess
: ===========doGetParameterValues sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=253,nowTms.sec=298,_debugConfigObj->internelInformStart=45====
:====processInterval=253,nowTms.sec=298,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ============servicelist,Provisioningbuf=INTERNET,INTERNET,INTERNET,INTERNET,ITV,ITV,INTERNET,INTERNET,
:==== debugCfg->mtupppoedefault=1460,debugCfg->mtuotherdefault=1460,mtuValue=1460
:====newObj->interfaceMtu=1460====
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
FAP TM: 0Kbps -> tokens <0>, bucketSize <0>
eth0 (switch port: 0)Link DOWN.
FAP TM: port <0>, portEnableMask <0x86>, tokens <6187>, bucketSize <24748>
FAP TM: port <0>, portEnableMask <0x86>, tokens <6187>, bucketSize <24748>
br0: port 2(eth0) entering disabled state
ARL table flush done
Success
Aug 14 22:59:25 :: Enter.
Aug 14 22:59:25 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:25 :: Exit.
FAP TM: 99000Kbps -> tokens <6187>, bucketSize <24748>
eth0 (switch port: 0) Link UP 100 mbps full duplex
FAP TM: port <0>, portEnableMask <0x87>, tokens <6187>, bucketSize <24748>
FAP TM: port <0>, portEnableMask <0x87>, tokens <6187>, bucketSize <24748>
br0: port 2(eth0) entering forwarding state
ARL table flush done
Success
:====processInterval=257,nowTms.sec=302,_debugConfigObj->internelInformStart=45====
:====processInterval=257,nowTms.sec=302,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ============servicelist,Provisioningbuf=INTERNET,INTERNET,INTERNET,INTERNET,ITV,ITV,INTERNET,INTERNET,
:==== debugCfg->mtupppoedefault=1460,debugCfg->mtuotherdefault=1460,mtuValue=1460
:====newObj->interfaceMtu=1460====
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
Aug 14 22:59:27 :: Enter.
Aug 14 22:59:27 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:27 :: Exit.
:====processInterval=258,nowTms.sec=303,_debugConfigObj->internelInformStart=45====
:====processInterval=258,nowTms.sec=303,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
Aug 14 22:59:28 :: Enter.
Aug 14 22:59:28 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:28 :: Exit.
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=261,nowTms.sec=306,_debugConfigObj->internelInformStart=45====
:====processInterval=261,nowTms.sec=306,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
Aug 14 22:59:31 :: Enter.
Aug 14 22:59:31 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:31 :: Exit.
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
src =10.0.1.49 dst=10.137.127.22
PRE src =10.0.1.49 dst=10.137.127.22
:====processInterval=263,nowTms.sec=308,_debugConfigObj->internelInformStart=45====
:====processInterval=263,nowTms.sec=308,_debugConfigObj->internelInformStart=45====
:====acsIfName=epon0.1,name=devacs.edatahome.com====
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ======informed event,informEventStr] = 6 CONNECTION REQUEST
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========xmlDATA tag= data=
: ===========doSetParameterValues sucess
: ===========doSetParameterValues sucess
Aug 14 22:59:33 :: Enter.
Aug 14 22:59:33 :: CMS Message: CMS_MSG_CONFIG_WRITTEN
Aug 14 22:59:33 :: Exit.
Load_sym_table
IPT Packet Droped -> IN=br0 OUT= MAC=01:00:5e:00:00:01:4c:ac:0a:bc:fb:ec:08:00 SRC=192.168.2.14 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=29270 PROTO=2 MARK=0x48000000
===detect line id=0===ONHOOK event===
lhapiErrorPrint,301: (ts: 12s 691ms):hapiIOctl: Command Failed 0x607 handle 0x51op1: 0x3c , op2: 0x806e, return code 0x3
hdspSendCmdData,335: (ts: 12s 705ms):hapiIOctl ERROR 0x3
GetConnectionRtpStats,3820: (ts: 12s 713ms):ERROR getting RTP stats for vhd 81, status 3
Aug 14 23:00e:12 [deburror during endptRtpStatistics (status 11)
g]:: Enter.
Aug 14 23:00:12 :: =======RTCPSTAT====Lineerror during endptRtpStatistics (status 11)
Num:0====begin=======
Aug 14 23:00:12 :: rtcpstat->dwLocalOctetSent 1198240
Aug 14 23:00:12 :: rtcpstat->dwLocalPacketSent 7489
Aug 14 23:00:12 :: rtcpstat->dwLocalOctetRecvd 1198880
Aug 14 23:00:12 :: rtcpstat->dwLocalPacketRecvd 7493
Aug 14 23:00:12 :: rtcpstat->dwLocalPacketLost 8
Aug 14 23:00:12 :: rtcpstat->dwLocalJitter 0
Aug 14 23:00:12 :: rtcpstat->dwLocalLatency 0
Aug 14 23:00:12 :: =======RTCPSTAT====Line Num:0====begin=======
Aug 14 23:00:12 :: localPktSent 7489
Aug 14 23:00:12 :: localOctetSent1198240
Aug 14 23:00:12 :: localPktRecvd 7493
Aug 14 23:00:12 :: localOctetRecvd 1198880
Aug 14 23:00:12 :: localPktLost 8
Aug 14 23:00:12 :: remotePktSent 0
Aug 14 23:00:12 :: remoteOctetSent 0
Aug 14 23:00:12 :: remotePktLost 0
Aug 14 23:00:12 :: localPktSent 7489
Aug 14 23:00:12 :: localOctetSent1198240
Aug 14 23:00:12 :: localPktRecvd 7493
Aug 14 23:00:12 :: localOctetRecvd 1198880
Aug 14 23:00:12 :: =======RTCPCNXSTATS====Line Num:0====begin=======
Aug 14 23:00:12 :: localPktLost 8
Aug 14 23:00:12 :: localJitter 0
Aug 14 23:00:12 :: localLatency 0
Aug 14 23:00:12 :: localOverruns 0
Aug 14 23:00:12 :: localUnderruns 0
Aug 14 23:00:12 :: =======RTCPCNXSTATS====Line Num:0===end========
Aug 14 23:00:12 :: remotePktSent 0
Aug 14 23:00:12 :: remoteOctetSent 0
Aug 14 23:00:12 :: remotePktLost 0
Aug 14 23:00:12 :: remoteJitter 0
Aug 14 23:00:12 :: avgLocalJitter0
Aug 14 23:00:12 :: avgRemoteJitter 0
Aug 14 23:00:12 :: avgLocalLatency 0
Aug 14 23:00:12 :: ----------------------------
: VOIP: Line - call status: IDLE.
Aug 14 23:00:12 :: Line - call status: IDLE.
Aug 14 23:00:12 :: Enter.
Aug 14 23:00:12 :: Enter.
Aug 14 23:00:12 :: turn index = 0 status= 1
Aug 14 23:00:12 :: Exit.
Aug 14 23:00:12 :: Exit.
Aug 14 23:00:12 :: Exit.
Aug 14 23:00:12 :: Enter.
: VOIP: Line - call status: IDLE.
Aug 14 23:00:12 :: Line - call status: IDLE.
Aug 14 23:00:13 :: Enter.
Aug 14 23:00:13 :: Exit.
Aug 14 23:00:13 :: Exit.
Password: : devType = NONE_NONE_NONE
:LanDevMac = LAN2+NONE_NONE_NONE:00:23:B8:43:0A:DC-
: devType = NONE_NONE_NONE
:LanDevMac = LAN2+NONE_NONE_NONE:00:23:B8:43:0A:DC-LAN4+NONE_NONE_NONE:00:90:4C:C0:04:54-
: devType = NONE_NONE_NONE
:LanDevMac = LAN2+NONE_NONE_NONE:00:23:B8:43:0A:DC-LAN4+NONE_NONE_NONE:00:90:4C:C0:04:54-LAN1+NONE_NONE_NONE:8C:BE:BE:20:62:B2-
: LanDevMac = LAN2+NONE_NONE_NONE:00:23:B8:43:0A:DC-LAN4+NONE_NONE_NONE:00:90:4C:C0:04:54-LAN1+NONE_NONE_NONE:8C:BE:BE:20:62:B2
:============strcq=18|95|00|0|00|0|54.8|20160814225604|20160814230104|LAN1:Internet:2.409-LAN2:iTV:0.711-LAN4:Internet:17592186044415.984|LAN1:Internet:1.490-LAN2:iTV:0.047-LAN4:Internet:17592186044415.835||LAN1+NONE_NONE_NONE:8C:BE:BE:20:62:B2-LAN2+NONE_NONE_NONE:00:23:B8:43:0A:DC-LAN4+NONE_NONE_NONE:00:90:4C:C0:04:54|-19.6|1.8====ostrdacq=18|95|00|0|00|0|54.8|20160814225604|20160814230104|LAN1:Internet:2.409-LAN2:iTV:0.711-LAN4:Internet:17592186044415.984|L
:=====route add -host 10.0.1.58 gw 10.137.112.1 dev epon0.1 2>/dev/null===============
:mypid=3314 glbUploadType=a
:IPT Packet Droped -> IN=epon0.1 OUT= lMsg_init:127:]cMAC=ommFd=3 connectec4:d to smd
:sent LAUNCH90:ED message to smca:d
:main comm44:and loop: cmd_ge79:t=0 cmd_put=2 re5e:motefile=CD793227b:09310_201608142208:5604_000300V43.c00:sv
45:e0:00:20:00:00:40:00:3a:11:ab:14:0a:00:01:3a SRC=10.0.1.58 DST=10.137.127.22 LEN=32 TOS=0x00 PREC=0xE0 TTL=58 ID=0 DF PROTO=UDP SPT=34652 DPT=41709 LEN=12 MARK=0x18000000
Login incorrect. Try again.
Login: tftp: timeout
tftp: last timeout
iptables: Bad rule (does a matching rule exist in that chain?)
Tftpfailed: tftp server OR file name not found.
iptables: Bad rule (does a matching rule exist in that chain?)
Password: Aug 14 23:01:42 :: Enter.
Aug 14 23:01:42 :: Register Client: RC1
Aug 14 23:01:42 :: Enter.
Aug 14 23:01:42 :: Line - register status: REGISTERED.
Aug 14 23:01:42 :: Exit.
Aug 14 23:01:42 :: Exit.
IPT Packet Droped -> IN=br0 OUT= MAC=01:00:5e:00:00:01:4c:ac:0a:bc:fb:ec:08:00 SRC=192.168.2.14 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=41790 PROTO=2 MARK=0x48000000
今天接着搞，把TTL线插上，看他下发的密码是多少，还有电视没搞好。 楼主你一定是个机器人
这么大一串天文你也能找出自己的密码
还是毫不相关的 电信居然没有加密 6fULw7PY 这个是密码吧！ 是成都的吗？ 这种倒霉的事情从来都和我无关的.
回帖赚猫粮！！ 回复赚猫粮 高手高手高高手
页:
[1]
2