超简单zxa10 f460中兴光猫破解开路由

yaojie0201

努力提升权限，争取看到技术帖

yaojie0201

今天晚上一定要破啊

a-d-m-i-n

请问能教我破解电信送的上海贝尔无线光猫RG200o－ca吗?谢谢了,762657119@qq.com,求工具

asd1965

谢谢楼主！！！

q283120045

谁帮我看看我的密码 找了半天- <psitree>
- <WirelessCfg>
  <vars state="enabled" ssIdIndex="0" country="ALL" apMode="ap" bridgeRestrict="disabled" wdsMAC_0="" wdsMAC_1="" wdsMAC_2="" wdsMAC_3="" band="b" channel="0" rate="auto" multicastRate="auto" bak_Rate="0" basicRate="default" fragThreshold="2346" RTSThreshold="2347" DTIM="1" beacon="100" XPress="off" gMode="auto" gProtection="auto" preamble="long" AfterBurner="off" TxPowerPercent="100" WME="off" WMENoAck="on" WMEApsd="on" RegulatoryMode="off" PreNetRadarDectTime="60" InNetRadarDectTime="60" TpcMitigation="0" AutoChannelTimer="0" globalMaxAssoc="16" NBandwidthCap="2" NCtrlSideband="none" NBand="2" NMCSIdx="-1" NProtection="auto" NMode="auto" NReqd="off" />
- <wlMssidVars tableSize="4">
  <wlMssidEntry enblSsId="1" ssId="ChinaNet-0F69" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc="16" wsc_mode="enabled" wsc_config_state="1" shownForTr069="1" tr69cBeaconNone="0" tr69cBasicAuthBoth="0" authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567891" key64_2="1234567891" key64_3="1234567891" key64_4="1234567891" key64Index="1" key128_1="" key128_2="" key128_3="" key128_4="" key128Index="1" wpaRekey="0" wpakey="52fbhske" Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication" />
  <wlMssidEntry enblSsId="0" ssId="Guest2" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc="128" wsc_mode="enabled" wsc_config_state="1" shownForTr069="0" tr69cBeaconNone="0" tr69cBasicAuthBoth="0" authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567892" key64_2="1234567892" key64_3="1234567892" key64_4="1234567892" key64Index="1" key128_1="" key128_2="" key128_3="" key128_4="" key128Index="1" wpaRekey="0" wpakey="wpapskpassword" Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication" />
  <wlMssidEntry enblSsId="0" ssId="Guest3" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc="128" wsc_mode="enabled" wsc_config_state="1" shownForTr069="0" tr69cBeaconNone="0" tr69cBasicAuthBoth="0" authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567893" key64_2="1234567893" key64_3="1234567893" key64_4="1234567893" key64Index="1" key128_1="" key128_2="" key128_3="" key128_4="" key128Index="1" wpaRekey="0" wpakey="wpapskpassword" Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication" />
  <wlMssidEntry enblSsId="0" ssId="Guest4" enblSubcrb="1" bcntpSubcrb="1" ssIdSubcrb="1" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc="128" wsc_mode="enabled" wsc_config_state="1" shownForTr069="0" tr69cBeaconNone="0" tr69cBasicAuthBoth="0" authMode="psk" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="64-bit" key64_1="1234567894" key64_2="1234567894" key64_3="1234567894" key64_4="1234567894" key64Index="1" key128_1="" key128_2="" key128_3="" key128_4="" key128Index="1" wpaRekey="0" wpakey="wpapskpassword" Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication" />
  </wlMssidVars>
  </WirelessCfg>
- <SystemInfo>
  <factorymode deviceType="ZXA10 F460" ssidname="ChinaNet-0F69" ssidkdc="52fbhske" userpassword="5ny90" identifier="2481D00D0D02B13C5" startflag="0" versionflag="0" enablemultimac="1" />
  <MonitorAlarmStatus monitorEnable="0" alarmEnable="0" />
  <userInfo userId="0123456789" userName="01234567890123456789" status="0" times="0" limit="10" />
  <protocol autoScan="disable" upnp="enable" alg="enable" h323="disable" rtsp="enable" l2tp="disable" ipsec="disable" igmpSnp="enable" igmpMode="enable" macFilterPolicy="forward" encodePassword="enable" siproxd="disable" modifypassword="disable" macFltEnable="disable" numberOfConn1="0" numberOfConn2="0" sipport1="5060" sipport2="5061" sipport3="5064" learnage="5" loidauthentic="::" httpport="80" httpsport="443" natcache="disable" />
  <sysLog state="disable" displayLevel="ERR" logLevel="INFO" option="local" serverIP="0.0.0.0" serverPort="514" />
  <sysPassword value="bkU3akElNW0=" />
  <sptPassword value="c3VwcG9ydA==" />
  <usrPassword value="NW55OTA=" />
  <sysUserName value="telecomadmin" />
  <dns dynamic="enable" primary="10.28.100.2" secondary="10.28.100.7" domain="Home" host="Broadcom" />
  <tr69c state="enable" upgradesManaged="0" upgradeAvailable="0" informEnbl="1" informTime="0" informInterval="43200" noneConnReqAuth="0" acsURL="http://devacs.edatahome.com:9090/ACS-server/ACS" acsUser="hgw" acsPwd="hgw" parameterKey="12345" connReqURL="" connReqUser="itms" connReqPwd="itms" urlsubcriber="1" usrsubcriber="1" pwdsubcriber="1" cusrsubcriber="1" cpwdsubcriber="1" kickURL="" provisioningCode="12345" MWSURL="0.0.0.0:" ctMDW="disable" />
  <dhcpclioption vendorIdent="" vendorSpec="" />
  <ctCfg mwBandStatus="1" terminalNumber="4" iptvStatus="disable" stbNumber="0" restrictSTB="disable" restrictComputer="disable" computerNumber="1" restrictCamera="disable" cameraNumber="1" restrictPhone="disable" phoneNumber="1" pppreconnect="enable" />
  </SystemInfo>
- <Traffictl>
  <trafficltglbvar totalBW="100000" />
  </Traffictl>
- <SecCfg>
  <qosMgmtCfg enableQos="enable" EnableQoSmode="enable" defaultDSCPMark="-1" defaultQueue="-1" enForceWeight="0" enDSCPMark="0" en802_1_P="0" Mode="INTERNET,TR069,IPTV,VOIP" Plan="priority" />
- <qosCls tableSize="1">
  <qosClsEntry id="1" instanceId="1" clsName="clsName_1" status="enable" wlpriority="0" clsOrder="1" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="eth1.3" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="2" ctype="" max="" min="" weight="0" />
  </qosCls>
- <qosPrioQueue tableSize="4">
  <qosPrioQueueEntry id="1" instanceId="1" status="enable" priority="1" weight="4" />
  <qosPrioQueueEntry id="2" instanceId="2" status="enable" priority="2" weight="3" />
  <qosPrioQueueEntry id="3" instanceId="3" status="enable" priority="3" weight="2" />
  <qosPrioQueueEntry id="4" instanceId="4" status="enable" priority="4" weight="1" />
  </qosPrioQueue>
  <srvCtrlList ftp="disable" http="lan" icmp="lan" ssh="disable" telnet="lan" tftp="disable" modeipsec="1" />
- <qosApp tableSize="2">
  <qosAppEntry id="1" appName="TR069" classQueue="3" />
  <qosAppEntry id="2" appName="VOIP" classQueue="1" />
  </qosApp>
  </SecCfg>
- <RouteCfg>
  <ripGlobal state="disable" ripIfcTableSize="1" />
- <ripIfc tableSize="1">
  <ripIfcEntry id="1" name="br0" state="disable" version="2" operation="active" />
  </ripIfc>
  </RouteCfg>
- <Voice>
  <sipKeyCfg proxyAddr="0.0.0.0" proxyPort="5060" obProxyAddr="0.0.0.0" obProxyPort="5060" regAddr="0.0.0.0" regPort="5060" bakproxyAddr="0.0.0.0" bakproxyPort="5060" bakobProxyAddr="0.0.0.0" bakobProxyPort="5060" bakregAddr="0.0.0.0" bakregPort="5060" extension1="" password1="" extension2="" password2="" extension3="" password3="" extension4="" password4="" domainName="" dispName1="" dispName2="" dispName3="" dispName4="" authName1="" authName2="" authName3="" authName4="" lineEnable="12" />
  <sipCfg voiceifName="br0" holdTone="NO" snowSlide="1" supplementoperationmode="local" dialTime="15" noDigitTime="5" noAnswerTime="60" warnningTime="60" busyTime="40" jitterBuffer="60" jitterBufferMode="0" heartOption="0" heartOptionFromOutside="0" echoRestainEnable="YES" payload="97" sipDscpMark="0" rtpDscpMark="0" sipVlanIdMark="0" rtpVlanIdMark="0" sip8021pMark="0" rtp8021pMark="0" sipEthPrioMark="0" rtpEthPrioMark="0" enblTagMat="Yes" sipLogAddr="0.0.0.0" sipLogPort="0" ifName="br0" localeName="CHN" voiceCodec="none" voicePtime="20" logLevel="5" musicServerAddr="0.0.0.0" musicServerPort="5060" regExpTmr="300" specialDialstrings="" digiMapPrefix="" digiMap="[*#]x[0-9*].#|**xx|*#x[0-9*].#|#*x[0-9*].#|#300##|#500##|[*#]96#xx.|[*#]95#xx.|*99*xx.#xx.|*66*x[0-9*].#x[0-9*].|##|010xxxxxxxx|02xxxxxxxxx|0[3-9]xxxxxxxxx|0311xxxxxxxx|037[179]xxxxxxxx|04[135]1xxxxxxxx|051[0-9]xxxxxxxx|052[37]xxxxxxxx|053[12]xxxxxxxx|057[1345679]xxxxxxxx|059[15]xxxxxxxx|0731xxxxxxxx|075[457]xxxxxxxx|076[09]xxxxxxxx|0898xxxxxxxx|00xxx.|[2-8][1-9]xxxxx|[2-8][1-9]xxxxxx|1[358]xxxxxxxxx|01[358]xxxxxxxxx|11[02479]|12[0268]|11[13568]x.|125xx|12[13479]x.|100[015678]x|100[2349]x.|10[1-9]xx.|14xx.|1[79]xx.|160|168xxxxx|16[1-79]x.|[48]00xxxxxxx|[48]0[1-9]x.|[23567]0xx.|955xx|95[0-46-9]xxx.|9[0-46-9]xxxx." wmiEnable="NO" t38Enable="NO" g711Enable="YES" vadEnable="NO" vbdRedEnable="NO" rfc2198Payload="96" codecList="3,2,101,101,4,101,101,1,3,2,101,101,4,101,101,1," transport="UDP" dtmfRelay="INBAND" egressGain="0" ingressGain="0" sessionExpireTimer="0" minSessionExpireTimer="0" enumLookupEnable="NO" enumDNSZone="e164.arpa" callfwdNumber1="" callfwdNumber2="" callfwdNumber3="" callfwdNumber4="" callfwdBusy="0" callfwdAll="0" callfwdNoAn="0" callwait="0" clidmode="fsk" clidtimeEn="YES" vbdCodec="g711a" digitMapMatchMode="max" sipLocalPort="5058" FaxNegoMode="negotiate" codecNegoMode="remote" externalDialPrefix="" internalDialLength="3" internalDialEnable="NO" sdtEnable="NO" shortTime="2" />
  <h248KeyCfg authKey="0" authMethod="0" bareMgcAddr1="192.168.99.99" bareMgcAddr2="0.0.0.0" mgcAddr1Port="2944" mgcAddr2Port="2944" encodingType="ABNF" mgName="iad.zte.com.cn" mgPort="2944" termName1="AG58900" termName2="AG58901" transportType="UDP" rtpTermPrefix="RTP/" rtpTermDightLen="5" rtpTermDightStart="10000" rtpTermDightAlignMode="0" rtpTermCount="16" authName="0" midFormat="1" h248LineEnable1="Disabled" h248LineEnable2="Disabled" />
  <h248Cfg ifName="eth0.45" logLevel="0" prefCodecStr="G711U,G711A,G723,G729," countryStr="CHN" dtmfRelay="INBAND" vadEnable="NO" ingressGain1="0" ingressGain2="0" egressGain1="0" egressGain2="0" h248DscpMark="7" h248RtpDscpMark="7" rtpVlanIdMark="0" rtp8021pMark="0" timer1="5000" timer2="0" snowSlide="60" digitMapMod="max" digitMapValue="xxxxxxxx|x." digitMapName="dm1" isSendAck="0" tcbLongTimer="5000" tcbPendingTimer="3000" tcbRetranTimer="4000" tcbRetranCount="3" dMapStartTimer="20" dMapLongTimer="3" dMapShortTimer="2" messageFormat="Short" heartBeatMode="1" heartBeatTime="90" heartBeatCount="3" mgTopVersion="1" phoneNum1="" phoneNum2="" h248T38Enable="0" h248VBDEnable="1" faxNegoMod="negotiate" rfc2198PT="97" vbdRed="disable" vbdCodec="g711a" echoCancel1="1" echoCancel2="1" rfc2833PT="96" jitterBuffer="60" jitterBufferMode="0" voicePtime="20,20,30,20,20," disableScheduleHB="YES" enableITOTS="YES" />
  </Voice>
- <PMapCfg>
- <pmap tableSize="2">
  <pmapEntry id="1" groupName="Default" groupKey="1" groupStatus="1" ifList="eth0:1|eth1.2:4|eth1.4:6|eth1.5:7|wl0:3|wl0.1:12|wl0.2:13|wl0.3:14" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4="" />
  <pmapEntry id="2" groupName="STB" groupKey="2" groupStatus="1" ifList="eth0.43:11|eth1.3:5" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4="" />
  </pmap>
- <pmapFlt tableSize="11">
  <pmapFltEntry id="1" instance="1" status="enable" bridgeRef="1" interfaceRef="eth0" />
  <pmapFltEntry id="2" instance="2" status="enable" bridgeRef="-1" interfaceRef="eth1" />
  <pmapFltEntry id="3" instance="3" status="enable" bridgeRef="1" interfaceRef="wl0" />
  <pmapFltEntry id="4" instance="4" status="enable" bridgeRef="1" interfaceRef="eth1.2" />
  <pmapFltEntry id="5" instance="5" status="enable" bridgeRef="2" interfaceRef="eth1.3" />
  <pmapFltEntry id="6" instance="6" status="enable" bridgeRef="1" interfaceRef="eth1.4" />
  <pmapFltEntry id="7" instance="7" status="enable" bridgeRef="1" interfaceRef="eth1.5" />
  <pmapFltEntry id="8" instance="12" status="enable" bridgeRef="1" interfaceRef="wl0.1" />
  <pmapFltEntry id="9" instance="13" status="enable" bridgeRef="1" interfaceRef="wl0.2" />
  <pmapFltEntry id="10" instance="14" status="enable" bridgeRef="1" interfaceRef="wl0.3" />
  <pmapFltEntry id="11" instance="11" status="enable" bridgeRef="2" interfaceRef="eth0.43" />
  </pmapFlt>
  <pmapIfcCfg pmapIfName="eth1" pmapIfcStatus="enable" />
  </PMapCfg>
- <Lan>
  <entry1 address="192.168.1.1" mask="255.255.255.0" dhcpServer="enable" portalenable="disable" confDhcpSrv="enable" leasedTime="24" startAddr="192.168.1.2" endAddr="192.168.1.100" subnetMask="255.255.255.0" dhcpwebredirect="" useAllocatedWAN="0" associatedConnection="" reservedAddresses="" CameraDhcpSrv="1" Cameraoptlist="1" Cameraopt="Camera" CamerastartAddr="192.168.1.110" CameraendAddr="192.168.1.150" Camerawebredirect="" STBDhcpSrv="1" STBdhcpoptlist="1" STBopt="STB" STBstartAddr="192.168.1.160" STBendAddr="192.168.1.200" STBwebredirect="" BTPhoneDhcpSrv="0" BTPhonedhcpoptlist="1" BTPhoneopt="BPhone" BTPhonestartAddr="0.0.0.0" BTPhoneendAddr="0.0.0.0" BTPhonewebredirect="" SIPPhoneDhcpSrv="1" SIPPhonedhcpoptlist="1" SIPPhoneopt="Phone" SIPPhonestartAddr="0.0.0.0" SIPPhoneendAddr="0.0.0.0" SIPPhonewebredirect="" passthroughLease="0" passthroughMACAddress="" allowedMACAddresses="" instanceId="1509949442" enable_GET_WAN_DNS="1" />
  </Lan>
- <vlanCfg>
  <vlan1 id="1" status="enable" vlanMuxId="46" vlanSubcriber="enable" wanList1="1" wanList2="0" wanList3="0" wanList4="0" mode="2" />
  <vlan2 id="2" status="enable" vlanMuxId="-1" vlanSubcriber="enable" wanList1="2" wanList2="0" wanList3="0" wanList4="0" mode="2" />
  <vlan3 id="3" status="enable" vlanMuxId="43" vlanSubcriber="enable" wanList1="3" wanList2="0" wanList3="0" wanList4="0" mode="2" />
  <vlan4 id="4" status="enable" vlanMuxId="45" vlanSubcriber="enable" wanList1="4" wanList2="0" wanList3="0" wanList4="0" mode="2" />
  </vlanCfg>
- <ipsrv_1>
  <dhcpc_conId1 state="enable" wanAddress="0.0.0.0" wanMask="0.0.0.0" />
  </ipsrv_1>
- <wanCfg>
  <entry1 vlanMuxId="46" attachToVlan="1" d8021="7" reInitWanInfoFlag="0" multiVlan="-1" conId="1" name="1_TR069_R_VID_46" protocol="IPoW" firewall="enable" nat="disable" fullcone="disable" igmp="disable" qos="disable" svcmode="TR069" vlanId="-1" service="enable" instanceId="1509949443" lanIntfList="" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466" />
  <entry2 vlanMuxId="-1" attachToVlan="2" d8021="-1" reInitWanInfoFlag="0" multiVlan="-1" conId="2" name="2_INTERNET_B" protocol="BRIDGE" firewall="disable" nat="disable" fullcone="disable" igmp="enable" qos="disable" svcmode="INTERNET" vlanId="-1" service="enable" instanceId="1509949444" lanIntfList="eth1.2|eth1.4|eth1.5|wl0|" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466" />
  <entry3 vlanMuxId="43" attachToVlan="3" d8021="5" reInitWanInfoFlag="0" multiVlan="-1" conId="3" name="3_Other_B_VID_43" protocol="BRIDGE" firewall="disable" nat="disable" fullcone="disable" igmp="enable" qos="disable" svcmode="Other" vlanId="-1" service="enable" instanceId="1509949445" lanIntfList="eth1.3|" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466" />
  <entry4 vlanMuxId="45" attachToVlan="4" d8021="6" reInitWanInfoFlag="0" multiVlan="-1" conId="4" name="4_VOIP_R_VID_45" protocol="IPoW" firewall="enable" nat="disable" fullcone="disable" igmp="disable" qos="disable" svcmode="VOIP" vlanId="-1" service="enable" instanceId="1509949446" lanIntfList="" dns1="0.0.0.0" dns2="0.0.0.0" wanGateway="0.0.0.0" maxMtuSize="1466" />
  </wanCfg>
- <ipsrv_4>
  <dhcpc_conId4 state="enable" wanAddress="0.0.0.0" wanMask="0.0.0.0" />
  </ipsrv_4>
  </psitree>

补充内容 (2012-10-13 10:10):
终于找到了这段代码就是密码啊<sysPassword value="bkU3akElNW0=" />

小dawn

没有权限看破解，努力升级

学技术

楼主能不能帮帮解决下已破解后的，断线问题？

lxshtc

此贴必火,‘留’芳百世.

flyingleo

这个很重要，学习中