|
|
发表于 2018-11-14 16:40:59
|山西|
显示全部楼层
可以确认GM219-S 硬件版本：HV1.0.00.052 为四川天邑代工的。。。找到了地区配置文件。。。找到了各种服务的默认的密码：, R9 z$ @* D5 e4 Q
% v. x8 h. @0 e- j: B# t. F
<Account>; x$ O0 a& ?' T1 B }+ E
<Entry0 Active="Yes" username="CMCCAdmin" web_passwd="aDm8H%MdA" display_mask="FF FF FF FF FF FF FF FF FF" />. ^7 H5 _ s* | x+ @: t8 ]
<Entry1 Active="Yes" username="user" web_passwd="1234" display_mask="BF 00 0F 08 07 20 03 00 01" />7 ]: k" @0 n$ l. X
<Entry2 Active="Yes" username="user3" web_passwd="1234" display_mask="BF 00 07 08 07 10 03 00 01" />
, y' c' t$ D; g' n5 b) U <TelnetEntry Active="No" telnet_username="admin" telnet_passwd="1234" telnet_port="23" />) }% a- o3 V4 N. a, e8 U0 Q4 g
<FtpEntry Active="No" ftp_username="admin" ftp_passwd="1234" ftp_port="21" />: F* {. Y( i7 {
<HttpEntry Active="Yes" http_right="1" />
6 s& J$ c! z s3 d. o <ConsoleEntry Active="Yes" console_username="admin" console_passwd="1234" />9 s4 {* U( M3 ?+ F" M, l* G/ W
<CTDefParaEntry setDefValueFlag="1" />
( P' i0 v y* A/ T* m</Account>
, F. a! N; O8 d+ O. D" Y" B' O/ m* E- ~' ^7 H8 p Y
尝试固件里/boaroot/cgi-bin/目录下的一些页面。。。发现了一些web下的隐藏页面。。。相同硬件版本的可以去尝试：
2 g7 A8 P! {# {& {3 Y* t3 T% c
. H6 y+ o% U# r I, U& d+ f# `http://192.168.1.1/cqregister.asp Q( S# |8 F i2 B, v
http://192.168.1.1/cqreset.asp' Q) Q i5 }; e; `6 }" E
http://192.168.1.1/cwmpsetting.asp
2 T% x' a8 w7 h. w, n; X9 Phttp://192.168.1.1/getGateWay.cgi+ l6 |6 J4 u$ S$ v
' W3 q3 {5 f0 m! O
#getRomfileInfo就出现个下拉菜单
* d4 O8 r- V2 y ^8 u5 Q+ vhttp://192.168.1.1/getRomfileInfo.cgi
& ]+ V9 O- g% o2 A' R& f4 n5 i3 b- p/ a) M, `5 k8 F
http://192.168.1.1/register.asp$ x+ r o+ x. X. o
http://192.168.1.1/regprocess.asp
+ f8 U) b* `% whttp://192.168.1.1/regprocess.cgi
" A! |2 E# x' ^9 v4 v4 j7 X' c: r0 I# {" @$ ]* A4 G+ t5 _: \2 D5 g
#恢复默认设置的命令不会丢移动下发的配置7 e, z& R1 T1 W" {% m6 a- g
http://192.168.1.1/restorepurefactory.cgi
; h& l/ R) m) P) i) P
, ~; b- f: p Rhttp://192.168.1.1/telnet.asp0 P0 S8 J* A" D* M& H( W, y* a
http://192.168.1.1/test_factory.asp7 q) q2 V' {3 J' C" i; M
http://192.168.1.1/test_info.asp4 n" _( \# D/ |
http://192.168.1.1/test_version.asp
% |2 q, ]# Y: S Z! s# G+ Jhttp://192.168.1.1/upgrade.asp; w; y" h3 d/ t, K" g! C0 b
0 }3 n$ I. V% [/boaroot/cgi-bin/目录下的所有文件。。。其他隐藏页面有兴趣自己去尝试。。。4 L8 t$ e4 O1 L
app-daily.asp% | | A2 _$ a: R) H$ `
app-ddns.asp
5 }: l& |4 V) }# v+ Q1 Iapp-igmpset.asp) q( D+ F- ?8 b
app-natset.asp
. Y9 t% P/ H& d6 [! _1 Q c0 Yapp-upnp.asp
6 Y$ c; i c& c: K& B" xapp-VoIP.asp
" ?$ }% C+ W3 m i& Napp-VoIP248.asp
4 U8 S! e4 D+ L0 aapp-VoIP248_Adv.asp
6 Y/ @- Y( T: n1 @. S& I- {app-VoIPUser.asp5 v( l. ?# H( j* q3 ? H
app-VoIP_Adv.asp
' p" u$ ?% o+ z% d/ vapp_ddnslist.cgi
$ J1 l, O; B5 e& r( Q& kavalanch.asp* a2 z0 b: ^1 |0 V. @% A( w: Y! }
byeBye.cgi6 _, S+ B4 e7 ^3 L$ P A7 m7 G! \9 v
adv_vpn.asp$ n; S( l% E2 V$ ~: J
cqregister.asp
; Z- x5 C2 B# g0 P0 ~ B5 }cqreset.asp+ `4 s* K& s, s, Q
adv_upnp.asp, f. p, ?0 M! P" T
cwmpsetting.asp$ f' d5 |) {" L7 U& X8 h! {
diag-quickdiagnose.asp
9 q7 z( C& {5 ]" O8 n; x: T/ nErrMsg.asp
: |: s. l4 u% x i1 agetGateWay.cgi
1 E; e1 I! O6 z. bgetPingResult.cgi( C% W5 u9 f# M9 c6 B
getRomfileInfo.cgi
4 Z' F( v0 P8 D8 ^6 P+ h5 ugetTracentResult.cgi8 B* u6 P: V+ I4 l; M' z
help.asp& w# Q% H( B3 ^) [
help_content.asp, W' t" r2 ^- ^8 p
adv_qos.asp4 U; K% g' ^5 x
adv_dmz.asp
$ F! t8 J( V2 |; W) gindex.asp8 V4 D( u6 u8 Z
index2.asp
- `8 ^, v. z- e& ]$ Oindex3.asp' W! D% H! A3 u# w
InsertSimcardMsg.cgi8 x0 u' Z0 b) B3 i
itms.cgi
: ^" @. N) W) z/ V* |adv_ddns.asp2 `" Z3 o3 x5 }
content.asp, b4 t, [# s4 L$ z
laserforce.cgi* v0 \+ o2 B& X2 Q
lasernormal.cgi
! q; y* G: x. x6 C' t! }logout.cgi* Q3 S \( x, I
mag-account.asp4 l- Q. T( z/ X* q
mag-diagnose.asp+ ]( h2 ]4 p$ P9 r
mag-reset.asp1 s" Z9 R( m6 N/ [, T5 {, g5 Q; A
mag-syslogmanage.asp
6 |/ W6 ]4 f7 Z9 t2 o8 s0 Imaintainreport.cgi
9 b3 g( l% U0 y0 ?net-binding.asp
+ a0 w, J2 y1 B% h( y% ^3 j: r0 Hnet-dhcp.asp% E# b" |, @; @$ ? c# ^
net-landingpage.asp
2 N$ \3 O$ L- Xnet-phoneapp.asp
$ H5 C% d$ v. e; znet-qos.asp
3 D- e) E' i! c5 y+ P, Tnet-route6add.asp
$ Y$ _: B0 j. w" P9 R* Wnet-routeadd.asp
A3 t& e2 h0 O4 n. P @% m, knet-routeset.asp* }+ g7 O& {+ O! q& k
net-time.asp5 c0 N, d7 a2 {9 g. f7 r ^
net-tr069.asp* L+ C0 N# Q \
net-wanset.asp+ H* }4 w1 l: j4 v8 Y7 R$ B
net-wlan.asp; T; [! }: s2 L- [4 K6 M4 }" R+ q. {3 m
net-wlan11ac.asp
- Y, `3 F5 C4 \% C1 {net-wlanshare.asp
6 _! b' B: Q3 S V" Mnormal_access.asp
; P3 X8 C7 u6 Y& Inormal_internet_wan.asp
* }( H! Y; o: j, V' Knormal_manage.asp& l% n1 U8 y9 v- l. o" w
normal_manage_password.asp
7 B9 z1 `" v/ [: @+ r+ N% Z; tnormal_network.asp1 T* ^ S* @. r8 {2 S
normal_security.asp3 K% j; s8 s0 o2 `' V
normal_sys.asp E6 E0 l3 k1 C8 y- ^& W
parentControl.asp
; H5 E# w* o( hpushviewfinish.asp/ @: Q3 t2 l% V8 Q9 |4 @8 O
pushviewupgrade.asp
( Q. |* `; @' F' B8 {qos-clsedit.asp
1 [8 p- t' h- ~ yqos-comvlan.asp
; d3 ~/ {0 G5 S7 j. qqos-dslimit.asp2 n2 w! _( x: ^. u4 @) ]
redirect.cgi
* f6 D" Z3 I1 U2 g: c) |" k, ]redirect_cancel.cgi
1 [# H; ], O' _+ l$ Krefresh.asp
& p5 P! Q' o! Tregister.asp# M$ o) y/ \7 d. ^; L6 j6 P
regprocess.asp
6 Q' ? O# v8 q6 o: _ u/ E' oregprocess.cgi+ M/ w( } {9 x% O A5 ~8 l: J
regstatus.asp; x- ~1 f2 A$ U' N; H6 D1 `
RemoteUPGMsg.cgi! R7 O, I# x+ u' f, J
reset.asp
4 n" f* @3 I$ @7 Z$ W- tresetscreen.asp
: c4 u$ b$ I7 R' O3 G1 L6 q* D: a& zrestorepurefactory.cgi* U+ P; |( s: q7 ^: j2 V- ~# p: G
sec-addmacfilter.asp
5 P) k( o' Z9 n; F2 t" O+ Fsec-addportfilter.asp* `" O: A6 ~5 o* ] O2 \0 {
sec-firewall.asp
7 {7 Q7 O& \5 M* {- v4 s, @sec-macfilter.asp
) d' ]0 \8 g' I4 `" gsec-portfilter.asp
3 n. M* h- e" H3 |) {sec-protocolfilter.asp8 |2 X+ ?; A. P. K8 j
sec-urlfilter.asp/ C) Y( q' a* _0 |( h& a& p
sec_macfilterlist.cgi* j& A- K+ e {2 j9 H3 @! N7 {
sec_portfilterinlist.cgi
. b' ?- m# Z8 A6 ?9 Q3 hsec_portfilteroutlist.cgi
2 W' F. p3 a* v- ^* Qsec_urlfilterlist.cgi
; J0 q }. p+ v2 u( {, ^; X- @5 x% eselfcheck.asp
[+ ]. l; q+ `6 Cshowhis.cgi
% T( g; |2 k1 W2 k( K# rshowusb.cgi/ m) }' E+ Q2 d
sta-acs.asp
1 G0 s; J. `5 q" q+ Ssta-device.asp
/ |# l" N" ?/ G& wsta-network.asp0 a3 W8 A* w' V' X
sta-position.asp& M% L9 s, x+ U! K' W# k
sta-user.asp. |* L/ m) T3 X5 P: [9 v( A
sta-VoIP.asp: R! U3 m6 Z% r; \
sta-VoIP248.asp/ ]+ D( ^4 G8 s" o4 ? O
state_bandwidth.asp
3 t0 L3 m, f! S( j2 Xstate_device.asp
3 i' I" j# h+ Z5 ]state_gateway.asp6 n: ? V7 P- o9 ~, K) p9 `3 m7 W
state_overview.asp
" i& ?% S( h" @7 l pstore.asp
. S. q) X% \9 N# zsyslog.cgi
) P& T S" X: ytelnet.asp
3 ], s7 l. _7 s. f* D F. ltest_factory.asp
/ ^, ^! T) A% ~4 e, ]5 Gtest_info.asp$ x3 h# L* Y! ]# ~3 N7 ]# ~
test_version.asp
" a7 u! j1 n4 q- r, g& c$ buindex.asp0 s. X7 H& \+ Q# r0 v5 M
UpdateMsg.cgi
0 Z" ?8 g$ i& L& G: Bupgrade.asp* _: z9 L1 E ^6 g, Y' I |
wifi.asp
$ ~, K! e* U! ?1 P由于没拿到telnet账户密码。。。也就到此为止了。。。期待有大神出现。。。
0 z* Q4 L0 b: J
& u% a0 u. t; b4 L
) o3 [3 M- y. \5 r: V: O% e, b
0 E0 W8 T3 X3 y$ K S" H0 w |
|
/1 
44152102000001
