fujianglingcs 发表于 2011-10-3 22:14:00

电信光猫zx10 f422破解问题

按照网上的帖子，把电信送的光猫中兴zxa10 f422的配置文件下载下来，也破解出超级密码，用密码进去设置了路由，设置却无法保存！！！后面是用记事本打开的xml文件：<psitree>
<WirelessCfg>
<vars state="enabled" ssIdIndex="0" country="ALL" apMode="ap"bridgeRestrict="disabled"wdsMAC_0=""wdsMAC_1=""wdsMAC_2=""wdsMAC_3=""band="b" channel="0" rate="auto" multicastRate="11.0" bak_Rate="0" basicRate="default" fragThreshold="2346" RTSThreshold="2347" DTIM="1" beacon="100" XPress="off" gMode="auto" gProtection="auto" preamble="long" AfterBurner="off" TxPowerPercent="100" WME="off" WMENoAck="on" WMEApsd="on"RegulatoryMode="off" PreNetRadarDectTime="60" InNetRadarDectTime="60" TpcMitigation="0" AutoChannelTimer="0" globalMaxAssoc="16" NBandwidthCap="2" NCtrlSideband="none" NBand="2" NMCSIdx="-1" NProtection="auto" NMode="auto" NReqd="off" />
<wlMssidVars tableSize="4">
<wlMssidEntry enblSsId="1" ssId="13147095725" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "16"wsc_mode="enabled"wsc_config_state="1"shownForTr069="1"tr69cBeaconNone="0"tr69cBasicAuthBoth="0"authMode="psk2mix" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567891" key64_2="1234567891" key64_3="1234567891" key64_4="1234567891" key64Index="1" key128_1=""key128_2=""key128_3=""key128_4=""key128Index="1" wpaRekey="0" wpakey="bj76mm22"Preauthentication="off" ReauthTimeout="36000" wpa="tkip+aes" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="Guest2" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "128"wsc_mode="enabled"wsc_config_state="1"shownForTr069="0"tr69cBeaconNone="0"tr69cBasicAuthBoth="0"authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567892" key64_2="1234567892" key64_3="1234567892" key64_4="1234567892" key64Index="1" key128_1=""key128_2=""key128_3=""key128_4=""key128Index="1" wpaRekey="0" wpakey="evgfyvpy"Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="Guest3" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "128"wsc_mode="enabled"wsc_config_state="1"shownForTr069="0"tr69cBeaconNone="0"tr69cBasicAuthBoth="0"authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567893" key64_2="1234567893" key64_3="1234567893" key64_4="1234567893" key64Index="1" key128_1=""key128_2=""key128_3=""key128_4=""key128Index="1" wpaRekey="0" wpakey="wpapskpassword"Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="Guest4" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "128"wsc_mode="enabled"wsc_config_state="1"shownForTr069="0"tr69cBeaconNone="0"tr69cBasicAuthBoth="0"authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567894" key64_2="1234567894" key64_3="1234567894" key64_4="1234567894" key64Index="1" key128_1=""key128_2=""key128_3=""key128_4=""key128Index="1" wpaRekey="0" wpakey="wpapskpassword"Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
</wlMssidVars>
</WirelessCfg>
<SystemInfo>
<factorymode deviceType="ZXA10F422" ssidname="ChinaNet-74C9" ssidkdc="bj76mm22" userpassword="iv1o1" identifier="BA44100D0D043D411" startflag="0" versionflag="0" enablemultimac="1" />
<userInfo userId="" userName="" status="0" times="0" limit="10"/>
<MonitorAlarmStatus monitorEnable="0" alarmEnable="0" />
<firewall value="high"/>
<protocol autoScan="disable" upnp="enable" alg="enable"h323="disable" rtsp="enable" l2tp="disable" ipsec="disable"igmpSnp ="enable" igmpMode ="enable" macFilterPolicy="forward" encodePassword="enable" siproxd="disable" modifypassword="disable" macFltEnable="disable" numberOfConn1="0" numberOfConn2="0" sipport1="5060" sipport2="5061" sipport3="5064" learnage="5"loidauthentic="::SZ0007196919075" httpport="80" httpsport="443" natcache="disable" />
<sysLog state="disable" displayLevel="ERR" logLevel="INFO" option="local" serverIP="0.0.0.0" serverPort="514"/>
<sysPassword value="bkU3akElNW0="/>
<sptPassword value="c3VwcG9ydA=="/>
<usrPassword value="aXYxbzE="/>
<sysUserName value="telecomadmin"/>
<dns dynamic="disable" primary="0.0.0.0" secondary="0.0.0.0" domain="Home" host="Broadcom"/>
<tr69c state="enable" upgradesManaged="0" upgradeAvailable="0" informEnbl="1" informTime="0" informInterval="43200" noneConnReqAuth="0" acsURL="http://devacs.edatahome.com:9090/ACS-server/ACS" acsUser="hgw" acsPwd="hgw" parameterKey="12345" connReqURL="" connReqUser="itms" connReqPwd="itms" urlsubcriber="1" usrsubcriber="1" pwdsubcriber="1" cusrsubcriber="1" cpwdsubcriber="1" kickURL="" provisioningCode="12345" MWSURL="0.0.0.0:" ctMDW="disable"/>
<dhcpclioption vendorIdent="" vendorSpec="" />
<defaultGateway enblGwAutoAssign="disable" ifName="" ipAddr="172.154.84.1"/>
</SystemInfo>
<SecCfg>
<qosMgmtCfg enableQos="enable" EnableQoSmode="enable" defaultDSCPMark="-1" defaultQueue="-1" enForceWeight="0" enDSCPMark="0" en802_1_P="0" Mode="INTERNET,TR069,IPTV,VOIP" Plan="priority"/>
<qosCls tableSize="1">
<qosClsEntry id="1" instanceId="1" clsName="clsName_1" status="enable" wlpriority="0" clsOrder= "1" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="eth1.3" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="2" ctype="" max="" min="" weight="0"/>
</qosCls>
<qosPrioQueue tableSize="4">
<qosPrioQueueEntry id="1" instanceId="1" status="enable" priority="1" weight="4"/>
<qosPrioQueueEntry id="2" instanceId="2" status="enable" priority="2" weight="3"/>
<qosPrioQueueEntry id="3" instanceId="3" status="enable" priority="3" weight="2"/>
<qosPrioQueueEntry id="4" instanceId="4" status="enable" priority="4" weight="1"/>
</qosPrioQueue>
<srvCtrlList ftp="lan" http="lan" icmp="lan" ssh="disable" telnet="lan" tftp="lan" modeipsec="1"/>
<qosApp tableSize="2">
<qosAppEntry id="1" appName="TR069" classQueue="3"/>
<qosAppEntry id="2" appName="VOIP" classQueue="1"/>
</qosApp>
</SecCfg>
<RouteCfg>
<ripGlobal state="disable" ripIfcTableSize="1"/>
<ripIfc tableSize="1">
<ripIfcEntry id="1" name="br0" state="disable" version="2" operation="active"/>
</ripIfc>
</RouteCfg>
<Voice>
<sipKeyCfg proxyAddr="172.31.0.13" proxyPort="5060" obProxyAddr="0.0.0.0" obProxyPort="5060" regAddr="172.31.0.13" regPort="5060" bakproxyAddr="0.0.0.0" bakproxyPort="5060" bakobProxyAddr="0.0.0.0" bakobProxyPort="5060" bakregAddr="0.0.0.0" bakregPort="5060" extension1="" password1="SZ0007196919075" extension2="" password2="default" extension3="" password3="" extension4="" password4="" domainName="" dispName1="85283305" dispName2="" dispName3="" dispName4="" authName1="85283305" authName2="" authName3="" authName4="" lineEnable="15"/>
<sipCfg voiceifName="br0" holdTone="NO" snowSlide="1" supplementoperationmode="local" dialTime="15" noDigitTime="5" noAnswerTime="60" warnningTime="60" busyTime="40" jitterBuffer="60" jitterBufferMode="0" heartOption="0" heartOptionFromOutside="0" echoRestainEnable="YES" payload="97" sipDscpMark="0" rtpDscpMark="0" sipVlanIdMark="0" rtpVlanIdMark="0" sip8021pMark="0" rtp8021pMark="0" sipEthPrioMark="0" rtpEthPrioMark="0" enblTagMat="Yes" sipLogAddr="0.0.0.0" sipLogPort="0" ifName="eth0.1905" localeName="CHN" voiceCodec="none" voicePtime="20" logLevel="5" musicServerAddr="0.0.0.0" musicServerPort="5060" regExpTmr="900" specialDialstrings="" digiMapPrefix="" digiMap="[*#]x.#|**xx|*#x.#|#*x.#|#300##|#500##|[*#]96#xx.|[*#]95#xx.|*99*xx.#xx.|*66*x.#x.|##|010xxxxxxxx|02xxxxxxxxx|0xxxxxxxxx|0311xxxxxxxx|037xxxxxxxx|041xxxxxxxx|051xxxxxxxx|052xxxxxxxx|053xxxxxxxx|057xxxxxxxx|059xxxxxxxx|0731xxxxxxxx|075xxxxxxxx|076xxxxxxxx|0898xxxxxxxx|00xxx.|xxxxx|xxxxxx|1xxxxxxxxx|01xxxxxxxxx|11|12|11x.|125xx|12x.|100x|100x.|10xx.|14xx.|1xx.|160|168xxxxx|16x.|00xxxxxxx|0x.|0xx.|955xx|95xxx.|9xxxx." wmiEnable="NO" t38Enable="NO" g711Enable="YES" vadEnable="NO" vbdRedEnable="NO" rfc2198Payload="96" codecList="3,2,101,101,4,101,101,1,3,2,101,101,4,101,101,1," transport="UDP" dtmfRelay="INBAND" egressGain="0" ingressGain="0" sessionExpireTimer="0" minSessionExpireTimer="0" enumLookupEnable="NO" enumDNSZone="e164.arpa" callfwdNumber1="" callfwdNumber2="" callfwdNumber3="" callfwdNumber4="" callfwdBusy="0" callfwdAll="0" callfwdNoAn="0" callwait="0" clidtimeEn="YES" clidEnable1="YES" clidEnable2="YES" clidmode1="dtmf" clidmode2="dtmf" vbdCodec="g711a" digitMapMatchMode="max" sipLocalPort="5060" FaxNegoMode="negotiate" codecNegoMode="remote" externalDialPrefix="" internalDialLength="3"/>
<h248KeyCfg authKey="0" authMethod="NONE" bareMgcAddr1="192.168.99.99" bareMgcAddr2="0.0.0.0" mgcAddr1Port="2944" mgcAddr2Port="2944" encodingType="TEXT" mgName="MG_GATEWAY" mgPort="2944" termName1="A0" termName2="A1" transportType="UDP" rtpName1="RTP/1001" rtpName2="16" authName="0"/>
<h248Cfg ifName="br0"logLevel="0" prefCodecStr="G711U,G711A,G723,G729," countryStr="CHN" dtmfRelay="INBAND" vadEnable="NO" ingressGain="0" egressGain="0" h248DscpMark="0" h248VlanIdMark="0" timer1="5000" timer2="0" snowSlide="6" digitMapMod="max" digitMapValue="xxxxxxxx|x." digitMapName="dm1" dMapStartTimer="20" dMapLongTimer="10" dMapShortTimer="5" midFormat="Domain" messageFormat="Short" heartBeatTime="60" mgTopVersion="1" phoneNum1="" phoneNum2="" faxTransMod="vbd" faxNegoMod="negotiate" rfc2198PT="97" vbdRed="disable" vbdCodec="g711a" echoCancel="enable" rfc2833PT="96" jitterBuffer="60" jitterBufferMode="0" voicePtime="20,20,30,20,20" disableScheduleHB="YES" enableITOTS="YES"/>
</Voice>
<PMapCfg>
<pmap tableSize="2">
<pmapEntry id="1" groupName="Default" groupKey="1" groupStatus="1" ifList="eth0.123:11|eth0.758:15|eth1.2:4|eth0.4092:16|eth1.3:5|eth1.4:6|eth1.5:7|wl0:3|wl0.1:17|wl0.2:18|wl0.3:19" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4=""/>
<pmapEntry id="2" groupName="STB" groupKey="2" groupStatus="1" ifList="" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4=""/>
</pmap>
<pmapFlt tableSize="12">
<pmapFltEntry id="1" instance="11" status="enable" bridgeRef="1" interfaceRef="eth0.123"/>
<pmapFltEntry id="2" instance="2" status="enable" bridgeRef="-1" interfaceRef="eth1"/>
<pmapFltEntry id="3" instance="3" status="enable" bridgeRef="1" interfaceRef="wl0"/>
<pmapFltEntry id="4" instance="4" status="enable" bridgeRef="1" interfaceRef="eth1.2"/>
<pmapFltEntry id="5" instance="5" status="enable" bridgeRef="1" interfaceRef="eth1.3"/>
<pmapFltEntry id="6" instance="6" status="enable" bridgeRef="1" interfaceRef="eth1.4"/>
<pmapFltEntry id="7" instance="7" status="enable" bridgeRef="1" interfaceRef="eth1.5"/>
<pmapFltEntry id="8" instance="17" status="enable" bridgeRef="1" interfaceRef="wl0.1"/>
<pmapFltEntry id="9" instance="18" status="enable" bridgeRef="1" interfaceRef="wl0.2"/>
<pmapFltEntry id="10" instance="19" status="enable" bridgeRef="1" interfaceRef="wl0.3"/>
<pmapFltEntry id="11" instance="15" status="enable" bridgeRef="1" interfaceRef="eth0.758"/>
<pmapFltEntry id="12" instance="16" status="enable" bridgeRef="1" interfaceRef="eth0.4092"/>
</pmapFlt>
<pmapIfcCfg pmapIfName="eth1" pmapIfcStatus="enable"/>
</PMapCfg>
<Lan>
<entry1 address="192.168.1.1" mask="255.255.255.0" dhcpServer="disable" portalenable="disable" confDhcpSrv="enable" leasedTime="24" startAddr="192.168.1.2" endAddr="192.168.1.100" subnetMask="255.255.255.0" dhcpwebredirect="" useAllocatedWAN="0" associatedConnection="" reservedAddresses="" CameraDhcpSrv="1" Cameraoptlist="1" Cameraopt="Camera" CamerastartAddr="192.168.1.110" CameraendAddr="192.168.1.150" Camerawebredirect="" STBDhcpSrv="1" STBdhcpoptlist="1" STBopt="STB" STBstartAddr="192.168.1.160" STBendAddr="192.168.1.200" STBwebredirect="" BTPhoneDhcpSrv="0" BTPhonedhcpoptlist="1" BTPhoneopt="BPhone" BTPhonestartAddr="0.0.0.0" BTPhoneendAddr="0.0.0.0" BTPhonewebredirect="" SIPPhoneDhcpSrv="1" SIPPhonedhcpoptlist="1" SIPPhoneopt="Phone" SIPPhonestartAddr="0.0.0.0" SIPPhoneendAddr="0.0.0.0" SIPPhonewebredirect="" passthroughLease="0" passthroughMACAddress="" allowedMACAddresses="" instanceId="1509949442" enable_GET_WAN_DNS="0"/>
</Lan>
<vlanCfg>
<vlan1 id="1" status="enable" vlanMuxId="758" vlanSubcriber="enable" wanList1="1" wanList2="0" wanList3="0" wanList4="0" mode="2" />
<vlan2 id="2" status="enable" vlanMuxId="4092" vlanSubcriber="enable" wanList1="2" wanList2="0" wanList3="0" wanList4="0" mode="2" />
<vlan3 id="3" status="enable" vlanMuxId="1905" vlanSubcriber="enable" wanList1="3" wanList2="0" wanList3="0" wanList4="0" mode="2" />
</vlanCfg>
<wanCfg>
<entry1vlanMuxId="758" attachToVlan="1" d8021="0"reInitWanInfoFlag="0" multiVlan="-1" conId="1" name="1_INTERNET_B_VID_758" protocol="BRIDGE" firewall="disable" nat="disable" fullcone="disable" igmp="enable" qos="disable" svcmode="INTERNET" vlanId="-1" service="enable" instanceId="1509949443" lanIntfList="eth1.2|wl0|" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466"/>
<entry2vlanMuxId="4092" attachToVlan="2" d8021="0"reInitWanInfoFlag="0" multiVlan="-1" conId="2" name="2_INTERNET_B_VID_4092" protocol="BRIDGE" firewall="disable" nat="disable" fullcone="disable" igmp="enable" qos="disable" svcmode="INTERNET" vlanId="-1" service="enable" instanceId="1509949444" lanIntfList="eth1.3|eth1.4|eth1.5|" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466"/>
<entry3vlanMuxId="1905" attachToVlan="3" d8021="7"reInitWanInfoFlag="0" multiVlan="-1" conId="3" name="3_VOIP_R_VID_1905" protocol="IPoW" firewall="enable" nat="disable" fullcone="disable" igmp="disable" qos="disable" svcmode="VOIP" vlanId="-1" service="enable" instanceId="1509949445" lanIntfList="" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="172.154.84.1" maxMtuSize="1466"/>
</wanCfg>
<ipsrv_3>
<dhcpc_conId3 state="disable" wanAddress="172.154.86.147" wanMask="255.255.252.0" />
</ipsrv_3>
</psitree>

fzy163go 发表于 2011-10-4 23:09:56

请问如何得到超级密码？在哪段呢？我看了破解f460的教程，找不到password value。。。请指教，谢谢！！

fujianglingcs 发表于 2011-10-5 12:32:52

fzy163go 发表于 2011-10-4 23:09 static/image/common/back.gif
请问如何得到超级密码？在哪段呢？我看了破解f460的教程，找不到password value。。。请指教，谢谢！！

没用的，有密码也设置不了路由，无法保存配置
页: [1]
查看完整版本: 电信光猫zx10 f422破解问题