|
|
发表于 2018-11-14 16:40:59
|山西|
显示全部楼层
可以确认GM219-S 硬件版本：HV1.0.00.052 为四川天邑代工的。。。找到了地区配置文件。。。找到了各种服务的默认的密码：3 N4 d" A$ N! Q [) E. e* L! |2 l4 g
. O' u: y+ P) G' g<Account> @; b: \+ {) a! M! v) M
<Entry0 Active="Yes" username="CMCCAdmin" web_passwd="aDm8H%MdA" display_mask="FF FF FF FF FF FF FF FF FF" />
5 _8 m# {1 w# p) `( E, }2 w <Entry1 Active="Yes" username="user" web_passwd="1234" display_mask="BF 00 0F 08 07 20 03 00 01" />2 ]) p/ J( D- v% Q# M4 F& j) ^
<Entry2 Active="Yes" username="user3" web_passwd="1234" display_mask="BF 00 07 08 07 10 03 00 01" />4 `9 A, a* C$ t. F
<TelnetEntry Active="No" telnet_username="admin" telnet_passwd="1234" telnet_port="23" />
. B+ V. M( \! h; J/ n0 z; H <FtpEntry Active="No" ftp_username="admin" ftp_passwd="1234" ftp_port="21" />' L+ }9 V9 u1 p
<HttpEntry Active="Yes" http_right="1" />
2 R6 V+ a) T5 s( b. U/ L% T- N <ConsoleEntry Active="Yes" console_username="admin" console_passwd="1234" />8 D5 f" e; m; T7 [4 p
<CTDefParaEntry setDefValueFlag="1" />; ^7 D N, u! L1 q
</Account>
% A" y! V$ b' X1 A B$ g; R0 d6 C
* k; }9 Z/ @& k" m5 b尝试固件里/boaroot/cgi-bin/目录下的一些页面。。。发现了一些web下的隐藏页面。。。相同硬件版本的可以去尝试：
4 h6 b4 x$ \9 q* c" f: [, ^2 Y) }8 |7 X7 K
http://192.168.1.1/cqregister.asp
4 _+ x, Z3 J. @; ^http://192.168.1.1/cqreset.asp. O) B$ `: b1 j5 c& a$ N. y- G
http://192.168.1.1/cwmpsetting.asp
# i9 C9 n3 ^! J+ Hhttp://192.168.1.1/getGateWay.cgi" M2 c- z8 U. a9 s: @( Z
% P. N$ Q! |: f4 _$ t#getRomfileInfo就出现个下拉菜单
4 m& I6 v: h& h4 n, k: Vhttp://192.168.1.1/getRomfileInfo.cgi
* H! ]- O% N4 G3 ]% e5 i; X( N6 q$ i/ a- A+ n3 h
http://192.168.1.1/register.asp$ r3 d3 d) n3 V1 Q9 {% v
http://192.168.1.1/regprocess.asp
- P* D+ L) U* o: x. z7 Shttp://192.168.1.1/regprocess.cgi5 ~2 N' j2 [, a- Q
: |( W7 F9 X; W+ P h+ n5 C#恢复默认设置的命令不会丢移动下发的配置
3 D) m& S6 b! a# N6 n1 \3 hhttp://192.168.1.1/restorepurefactory.cgi
7 J- ^7 g. x& Y+ J
# G5 L" ~, h0 ]) Ahttp://192.168.1.1/telnet.asp* M8 l! ^- j$ z* y
http://192.168.1.1/test_factory.asp! `- d: a% J( Q, a% w- L" g
http://192.168.1.1/test_info.asp
5 }0 ?& S0 z, dhttp://192.168.1.1/test_version.asp$ b1 ^# a% O4 I% Y3 ^5 I" Z- x5 r' {; m" W
http://192.168.1.1/upgrade.asp1 C9 ? [# w b. S" F9 C
0 K4 v3 T$ Z* K/boaroot/cgi-bin/目录下的所有文件。。。其他隐藏页面有兴趣自己去尝试。。。
( W: l j/ i# }0 Sapp-daily.asp
/ l Q: k, a N/ A7 w$ Lapp-ddns.asp7 q6 v: ~, B7 T- D/ P/ b) Y
app-igmpset.asp' u$ b( M8 l! N
app-natset.asp0 x. ?8 i- |# j. g
app-upnp.asp. x; `) k, T- e2 n- o- t) M
app-VoIP.asp4 M) {, \: c M) P E/ |: r
app-VoIP248.asp
+ D9 \: b6 v& I. z3 M, K" Iapp-VoIP248_Adv.asp
$ ?5 |6 j! {( G9 g2 M: K! Vapp-VoIPUser.asp C7 k4 G6 k, k$ _; B7 }( Y
app-VoIP_Adv.asp
J" t- S# g# x! happ_ddnslist.cgi
k: i s0 p6 l7 `; \& E& J3 ?% K4 I. ~avalanch.asp& X, v1 X% n; a" e! y- R, X$ Q
byeBye.cgi/ F: Q8 X; n% g/ j% {* ~- C' z" [
adv_vpn.asp& U2 |) V8 ^* i T" S1 i$ g
cqregister.asp
8 u5 d6 [/ w$ j, l- x5 mcqreset.asp
# t6 C* Q7 W4 k" r" H* n0 hadv_upnp.asp0 f" F* b2 v( l& M7 Y
cwmpsetting.asp
7 t v# n! ] T Q/ E: D1 Ddiag-quickdiagnose.asp5 ?1 h$ \' U& _
ErrMsg.asp* J) |" b# t, x; ^3 L" ~( g
getGateWay.cgi2 S1 _6 g) O* K2 \
getPingResult.cgi
+ A2 L, U' G3 e. hgetRomfileInfo.cgi. L; |. d; C4 n0 ^4 W2 i% }
getTracentResult.cgi
+ y! V D+ N! F/ k6 nhelp.asp
* I6 ~7 @4 _- J) u; w% Lhelp_content.asp
# M; u$ _' q) a* dadv_qos.asp
9 l7 a, {/ j( T" yadv_dmz.asp0 ~, q5 X- J6 I3 H% U* v
index.asp
8 K( y; P* ?* G* U7 windex2.asp- d/ W: N8 |$ [0 o( g6 A
index3.asp3 C( z! R6 U' F+ t
InsertSimcardMsg.cgi9 s* U4 h3 C$ {: e
itms.cgi
; t4 l ]1 t* gadv_ddns.asp
) C$ _) K; {" ~2 w" X9 e6 c( N9 Xcontent.asp3 h: @+ n3 Z) X) x/ W
laserforce.cgi
$ P; q1 ]- g# Xlasernormal.cgi
H/ z/ `5 T& U4 {logout.cgi6 k3 c& L; ?+ v1 U7 y7 q# C. I$ ^
mag-account.asp7 `/ a, P* @5 U+ s3 S6 f) l' R
mag-diagnose.asp; q7 i" |/ Q& [+ O; T
mag-reset.asp
% e$ W* \4 l4 h: O( ^# o7 Zmag-syslogmanage.asp7 L3 A+ g; d3 w4 X
maintainreport.cgi
/ S& x" A1 N: V4 I4 j8 I ^9 bnet-binding.asp' Y5 _. C0 x) ~- c/ p, I4 D
net-dhcp.asp7 m! q" w+ O1 I5 k- L( K6 z7 |
net-landingpage.asp
+ j2 `+ `) ^0 z+ f+ K5 a5 S0 R- Anet-phoneapp.asp/ L, |. q. O1 n: @0 S! u" N
net-qos.asp
9 w+ v, o! V# c/ @0 Inet-route6add.asp
/ z7 `9 j+ R. `3 J$ R( n" H2 O# U# ynet-routeadd.asp8 D3 t# {; @6 ?; Z) N1 n6 ?
net-routeset.asp8 F! f/ U% z9 [) M! \
net-time.asp" W. Q ]7 s3 \1 _/ Z$ X1 G8 \: q
net-tr069.asp" s* ^8 C; |' U
net-wanset.asp
0 x8 `( t7 |% h) D, Gnet-wlan.asp5 R r3 n' z% U: |3 h
net-wlan11ac.asp
# U8 ]- F" B2 |5 f& j, nnet-wlanshare.asp: y. ^& P5 M+ B$ X
normal_access.asp, F) x7 ^6 z) n. h
normal_internet_wan.asp3 _0 q5 ^' ~, q+ |
normal_manage.asp4 j( V9 g2 _% Q, A2 I
normal_manage_password.asp
* R3 ] n& M4 O6 q( t8 q# e3 znormal_network.asp
0 d8 m1 o7 j6 {/ D6 A n! }2 ynormal_security.asp
2 \1 Y! u' O4 c. ynormal_sys.asp
) t. i" Y. C5 b- oparentControl.asp5 ^0 l; o" j& s& M
pushviewfinish.asp) H7 N0 p: s8 z/ U. u) n& r
pushviewupgrade.asp
( i3 F0 R* p9 Iqos-clsedit.asp( C5 g4 Q6 ?' h: I: G
qos-comvlan.asp% j2 {+ K' r6 T; Y* F' p
qos-dslimit.asp
2 z6 v+ E) A$ n5 tredirect.cgi3 t1 p- |" v/ @
redirect_cancel.cgi5 l. w1 n% Z, i9 u: I: ?
refresh.asp
6 F8 x; D3 z* S+ I. O' ` j# O$ g% Pregister.asp" P& i0 H, I# U- E! c
regprocess.asp
1 [$ j7 d+ j+ ]. u: x1 w1 mregprocess.cgi7 e! \+ i) W1 }* y9 c- q# h
regstatus.asp' e4 C. B8 M5 Q3 }( B# L# Z* {+ f
RemoteUPGMsg.cgi
9 D7 O4 [2 S6 v1 Z" ?" j2 q) ereset.asp0 c6 I% ~8 x4 l% l7 h3 E
resetscreen.asp* O0 q" {- _6 m1 \ T
restorepurefactory.cgi. `3 ?; ?( m+ n
sec-addmacfilter.asp
3 W# c5 E. W; i q. h' Qsec-addportfilter.asp
( v8 k2 B/ F* a8 P" }9 esec-firewall.asp. E# {. R7 w! ~' s) b+ D/ S# a
sec-macfilter.asp
0 i6 q, k7 T2 m- \( A, e8 Osec-portfilter.asp
3 f* l: \& D% D7 }. n! f) ?sec-protocolfilter.asp
, r" o5 k V0 V) Q" N, v, _+ Ssec-urlfilter.asp& Q8 v4 v7 P6 e0 b1 |: P+ W6 a2 Y
sec_macfilterlist.cgi
. W6 c* {. c O5 K$ ^sec_portfilterinlist.cgi* @, e' \8 I' M1 K/ t- o7 x
sec_portfilteroutlist.cgi
7 q! a' J3 E# a2 Esec_urlfilterlist.cgi
4 ~) k7 a# D7 Yselfcheck.asp# }( I% }: ~ n
showhis.cgi1 c& u' I0 ~0 S
showusb.cgi
6 S: ~- Y8 L* z) ~$ usta-acs.asp! R$ d' c+ K3 j8 c6 S
sta-device.asp
) B; }; h; m4 ^7 o6 T# v3 lsta-network.asp( p& c6 O- {1 }4 w# ?
sta-position.asp
$ H6 u) G7 X7 vsta-user.asp
% p/ L& ~ N @. wsta-VoIP.asp S9 I- g& C5 f' Z" V7 Q0 o8 {# `
sta-VoIP248.asp& D" l- d& g4 }/ M, i
state_bandwidth.asp. n- r+ @9 A( x& Z x* S" u/ B
state_device.asp
( o0 r D S( Pstate_gateway.asp
. W+ g" V* D# ~- `" fstate_overview.asp |0 h# W0 s) X; G! W
store.asp
) W2 t6 @! X* F$ _/ N* V3 csyslog.cgi
% |0 r4 V6 S% c5 M% L% ]0 i% N' n7 q! Atelnet.asp/ j7 j0 ^, h9 R* }
test_factory.asp
- M/ L' c9 T5 Y U' P( Ytest_info.asp9 y$ r- Y, q5 T- y# z
test_version.asp
, |! _; |$ X% ^4 I9 e1 {3 xuindex.asp
2 @9 Y' }* a5 T4 ] A8 e# U8 wUpdateMsg.cgi) J7 O- @- T) z4 x a3 m E6 N/ H
upgrade.asp5 \$ b. z! t; A0 @' s
wifi.asp
由于没拿到telnet账户密码。。。也就到此为止了。。。期待有大神出现。。。; X4 L4 p: c1 l& i
; y4 A3 [* Q2 |5 J
8 e0 _4 t" A9 o+ i+ d* R
7 x+ Y- F. \* n
|
|
/1 
44152102000001
