Czy ktokolwiek cokolwiek wyciągnął z CellPipe 7130 z nowym firmware dostarczanego przez Orange?
Mnie jakaś niemiła konsultantka "uszczęśliwiła" nowym softem i nie mogę już wyłuskać konta admina (stara metoda już nie działa), a przez to hasła do iDSL żeby móc zmienić sobie sprzęt.
Jest to tak ułomny sprzęt, że nawet nie pokazuje parametrów linii. Jedyne co można podejrzeć to z jaką prędkością zsynchronizował się modem.
---------
Prosiłbym tych co mają już rozpracowane hasło w starej wersji o wrzucenie wartości cookie z sesji admina. W sesji user mam ciasteczko:
Przy okazji szukania info, zauważyłem, że hasła są 8 znakowe. Zawierają cyfry 0..9 i małe litery a..z. Łącznie 36 znaków. Daje to 36^8.
Niestety, modem nie jest zbyt wydajny.
Na 10000 prób logowania potrzebował średnio 3:25 czyli w ciągu sekundy potrafi "przetrawić" ok. 50 zapytań (porty 22 i 23 też zablokowane :/)
Toteż metoda bruteforce zajęłaby całe wieki
Myślałem też o podłączeniu seriala. O ile na płycie są 4 piny, to niestety nie mam pojęcia które piny są transmisyjne (przez co udało mi się już skopcić jeden przetwornik USB-TTL).
---------
Udało mi się rozkminić piny na płycie.
Patrząc od strony diod:
od lewej:
RX, TX, GND, Vcc(3,3V)
Prędkość należy ustawić na 115200.
Niestety, uruchamia się linux na którym nie da się wpisać nawet hasła usera, które wpisuje się do panelu.
Poniżej log z pełnego rozruchu:
Żadne hasła standardowe które sprawdziłem nie pasują (ok. 20 kombinacji).
W CFE jedyna dostępna komenda do "podglądu" to dm (dump memory).
dm hex_adres wielkość
Nie mam jednak żadnego pojęcia, jaki adres podać, by wyłuskać obszar w którym jest vmlinux i rootfs. Na chybił trafił wpisywałem jakieś wartości, ale zazwyczaj były to obszary RAM.
Inną możliwością jest boot z tftp, aczkolwiek nie mam ... vmlinux i rootfs
Ktokolwiek, cokolwiek?
Mnie jakaś niemiła konsultantka "uszczęśliwiła" nowym softem i nie mogę już wyłuskać konta admina (stara metoda już nie działa), a przez to hasła do iDSL żeby móc zmienić sobie sprzęt.
Jest to tak ułomny sprzęt, że nawet nie pokazuje parametrów linii. Jedyne co można podejrzeć to z jaką prędkością zsynchronizował się modem.
---------
Prosiłbym tych co mają już rozpracowane hasło w starej wersji o wrzucenie wartości cookie z sesji admina. W sesji user mam ciasteczko:
Name=Name
Value=0userPrzy okazji szukania info, zauważyłem, że hasła są 8 znakowe. Zawierają cyfry 0..9 i małe litery a..z. Łącznie 36 znaków. Daje to 36^8.
Niestety, modem nie jest zbyt wydajny.
Na 10000 prób logowania potrzebował średnio 3:25 czyli w ciągu sekundy potrafi "przetrawić" ok. 50 zapytań (porty 22 i 23 też zablokowane :/)
Toteż metoda bruteforce zajęłaby całe wieki
Myślałem też o podłączeniu seriala. O ile na płycie są 4 piny, to niestety nie mam pojęcia które piny są transmisyjne (przez co udało mi się już skopcić jeden przetwornik USB-TTL).
---------
Udało mi się rozkminić piny na płycie.
Patrząc od strony diod:
od lewej:
RX, TX, GND, Vcc(3,3V)
Prędkość należy ustawić na 115200.
Niestety, uruchamia się linux na którym nie da się wpisać nawet hasła usera, które wpisuje się do panelu.
Poniżej log z pełnego rozruchu:
Spoiler:
CFE version 1.0.37-102.6 for BCM96338 (32bit,SP,BE)
Build Date: 2011...09:26:22 CST (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
max_op_len=63
flash=MX25L3205D size=4MB id=0xc22016 sector=64k
wp1=3c Serial flash device: name MX25L3205D, id 0xc22016, size 4096KB
current nvram version is -1
100 MB Full-Duplex (auto-neg)
CPU type 0x29010: 240MHz
Total memory: 16777216 bytes (16MB)
Boot Address 0xbfc00000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-13) : 96333AW2G
Number of MAC Addresses (1-32) : 11
Base MAC Address : xx:xx:xx:xx:xx
PSI Size (1-64) KBytes : 24
send udp message finished.
Not response, auto boot ...
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from only image (0xbfc10000) ...
Code Address: 0x80010000, Entry Address: 0x8021d000
Decompression OK!
Entry at 0x8021d000
Closing network.
Closing DMA Channels.
Starting program at 0x8021d000
Linux version 2.6.21.5 (root@s54) (gcc version 4.2.3) #1 Fri Jun 27 15:24:42 HKT 2014
max_op_len=63
flash=MX25L3205D size=4MB id=0xc22016 sector=64k
wp1=3c Serial flash device: name MX25L3205D, id 0xc22016, size 4096KB
96333AW2G prom init
CPU revision is: 00029010
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
DMA zone: 31 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 3969 pages, LIFO batch:0
Normal zone: 0 pages used for memmap
Built 1 zonelists. Total pages: 3969
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13404k/16000k available (1736k kernel code, 2596k reserved, 360k data, 84k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80e00000 ... 0x80f00000>
Calibrating delay loop... 234.49 BogoMIPS (lpj=117248)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Total Flash size: 4096K with 64 sectors
File system address: 0xbfc10100
NET: Registered protocol family 8
NET: Registered protocol family 20
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
PPP generic driver version 2.4.2
NET: Registered protocol family 24
bcm963xx_mtd driver v2.0
Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xbfc10100,3158016]
brcmboard: brcm_board_init entry
SES: LED GPIO 0x2005 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
bcmxtmrt: Broadcom BCM6338A2 ATM Network Device v0.1 Jun 27 2014 15:23:02
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 84k freed
init started: BusyBox v1.00 (2014.06.27-07:26+0000) multi-call binary
mount: Mounting devpts on /dev/pts failed: No such file or directory
detached from terminal
Create hotplug monitor process with pid of 59.
BusyBox v1.00 (2014.06.27-07:26+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
netlink socket bind OK.
Loading drivers and kernel modules...
mknod: not found
chmod: /var/fuse: No such file or directory
bcmxtmcfg: module license 'Proprietary' taints kernel.
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
IPv6: add_dev failed for dsl0
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6338A2 Ethernet Network Device v0.3 Jun 27 2014 15:22:24
Config PHY Switch Through MDIO Pseudo PHY Interface
BCM63xx_ENET: 100 MB Full-Duplex (auto-neg)
ethsw: found bcm5325e!
eth0: MAC Address: xx:xx:xx:xx:xx:xx
eth0 Link UP.
SDIOH mode switch from 1 to 2
available commands: sdio sdioh
---SDIO init SUCCEEDED--- blockmode capable
chipid 0x4014312
chip is bcm4312, use 512 bytes blksize
bcmsdh_attach, sdioh_attach successful, bcmsdh->sdioh 0x80ea7ec0
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: wlc_attach: MAC addr from system pool. id:0xyyyy0000
wl0: MAC Address: xx:xx:xx:xx:xx:xx
wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.85.0.cpe4.402.0
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Trying to free already-free IRQ 25
===== Release Version 4.02L.03.wp1 (build timestamp 140627_1525) =====
ssk:error:16.201:oal_copyPsiToBackupPsi:1201:copy psi data to psi backup space fail!
ssk:error:26.245:NfModuleFn:363:insmod nf_conntrack_h323.ko FAILED in insertModule()
ssk:error:26.253:NfModuleFn:363:insmod nf_nat_h323.ko FAILED in insertModule()
ssk:error:26.262:NfModuleFn:363:insmod nf_conntrack_irc.ko FAILED in insertModule()
ssk:error:26.270:NfModuleFn:363:insmod nf_nat_irc.ko FAILED in insertModule()
ssk:error:26.282:NfModuleFn:363:insmod nf_conntrack_proto_gre.ko FAILED in insertModule()
ssk:error:26.283:NfModuleFn:363:insmod nf_conntrack_pptp.ko FAILED in insertModule()
ssk:error:26.296:NfModuleFn:363:insmod nf_nat_proto_gre.ko FAILED in insertModule()
ssk:error:26.297:NfModuleFn:363:insmod nf_nat_pptp.ko FAILED in insertModule()
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
/proc/sys/net/ipv6/conf/br0:0/clear_all_lladdr: cannot create
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
eth0 Link DOWN.
eth0 Link UP.
killall: smbd: no process killed
killall: nmbd: no process killed
insmod: cannot open module `/lib/modules/2.6.21.5/extra/pktflow.ko': No such file or directory
ssk:error:46.602:cmsLck_releaseLockTraced:137:released lock. lock occupied 28805 milliseconds; exceeds max timeHold 5000;
ssk:error:46.602:cmsLck_releaseLockTraced:139:acquiring lock callerFuncName cmsMdm_init; releasing lock callerFuncName cmsMdm_init;
httpd:error:48.092:main:133:httpd starting....
loopmon: main: 752: Start loopback check process~!
loopmon: initialize_port_socket: 476: INFO: create eth0.2 socket fd: 8
loopmon: initialize_port_socket: 476: INFO: create eth0.3 socket fd: 9
loopmon: initialize_port_socket: 476: INFO: create eth0.4 socket fd: 10
loopmon: initialize_port_socket: 476: INFO: create eth0.5 socket fd: 11
httpd:error:50.435:readMessageFromSmd:3510:unrecognized msg 0x10000250
WLmngr Daemon is running
optarg=0 shmId=0
WEBUI Operation WPS Type is NONE
There is no Predefined DevicePin in CFE
WPS Device PIN = 11111111
wlctl -i wl0 phy_watchdog 0
interface wl0.1 does not exist!
interface wl0.2 does not exist!
interface wl0.3 does not exist!
wlctl -i wl0 wds none
wlctl -i wl0 up
wlctl led 2 32 0
wlctl -i wl0 down
wlctl -i wl0 mbss 1
wlctl -i wl0 bss -C 0 down
wlctl -i wl0 bss -C 1 down
wlctl -i wl0 bss -C 2 down
wlctl -i wl0 bss -C 3 down
wlctl -i wl0 ssid -C 0 'B''r''o''a''d''c''o''m''1'
Setting SSID "Broadcom1"
wlctl -i wl0 ssid -C 1 'B''r''o''a''d''c''o''m''2'
Setting SSID "Broadcom2"
wlctl -i wl0 ssid -C 2 'B''r''o''a''d''c''o''m''3'
Setting SSID "Broadcom3"
wlctl -i wl0 ssid -C 3 'B''r''o''a''d''c''o''m''4'
Setting SSID "Broadcom4"
wlctl -i wl0 phy_watchdog 1
wlctl -i wl0 fcache 1
wlctl -i wl0 fcache 1
CellPipe2013
Login:
Build Date: 2011...09:26:22 CST (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.
max_op_len=63
flash=MX25L3205D size=4MB id=0xc22016 sector=64k
wp1=3c Serial flash device: name MX25L3205D, id 0xc22016, size 4096KB
current nvram version is -1
100 MB Full-Duplex (auto-neg)
CPU type 0x29010: 240MHz
Total memory: 16777216 bytes (16MB)
Boot Address 0xbfc00000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-13) : 96333AW2G
Number of MAC Addresses (1-32) : 11
Base MAC Address : xx:xx:xx:xx:xx
PSI Size (1-64) KBytes : 24
send udp message finished.
Not response, auto boot ...
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
Booting from only image (0xbfc10000) ...
Code Address: 0x80010000, Entry Address: 0x8021d000
Decompression OK!
Entry at 0x8021d000
Closing network.
Closing DMA Channels.
Starting program at 0x8021d000
Linux version 2.6.21.5 (root@s54) (gcc version 4.2.3) #1 Fri Jun 27 15:24:42 HKT 2014
max_op_len=63
flash=MX25L3205D size=4MB id=0xc22016 sector=64k
wp1=3c Serial flash device: name MX25L3205D, id 0xc22016, size 4096KB
96333AW2G prom init
CPU revision is: 00029010
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
DMA zone: 31 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 3969 pages, LIFO batch:0
Normal zone: 0 pages used for memmap
Built 1 zonelists. Total pages: 3969
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13404k/16000k available (1736k kernel code, 2596k reserved, 360k data, 84k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80e00000 ... 0x80f00000>
Calibrating delay loop... 234.49 BogoMIPS (lpj=117248)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Total Flash size: 4096K with 64 sectors
File system address: 0xbfc10100
NET: Registered protocol family 8
NET: Registered protocol family 20
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered (default)
PPP generic driver version 2.4.2
NET: Registered protocol family 24
bcm963xx_mtd driver v2.0
Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xbfc10100,3158016]
brcmboard: brcm_board_init entry
SES: LED GPIO 0x2005 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
bcmxtmrt: Broadcom BCM6338A2 ATM Network Device v0.1 Jun 27 2014 15:23:02
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 84k freed
init started: BusyBox v1.00 (2014.06.27-07:26+0000) multi-call binary
mount: Mounting devpts on /dev/pts failed: No such file or directory
detached from terminal
Create hotplug monitor process with pid of 59.
BusyBox v1.00 (2014.06.27-07:26+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
netlink socket bind OK.
Loading drivers and kernel modules...
mknod: not found
chmod: /var/fuse: No such file or directory
bcmxtmcfg: module license 'Proprietary' taints kernel.
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
IPv6: add_dev failed for dsl0
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6338A2 Ethernet Network Device v0.3 Jun 27 2014 15:22:24
Config PHY Switch Through MDIO Pseudo PHY Interface
BCM63xx_ENET: 100 MB Full-Duplex (auto-neg)
ethsw: found bcm5325e!
eth0: MAC Address: xx:xx:xx:xx:xx:xx
eth0 Link UP.
SDIOH mode switch from 1 to 2
available commands: sdio sdioh
---SDIO init SUCCEEDED--- blockmode capable
chipid 0x4014312
chip is bcm4312, use 512 bytes blksize
bcmsdh_attach, sdioh_attach successful, bcmsdh->sdioh 0x80ea7ec0
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: wlc_attach: MAC addr from system pool. id:0xyyyy0000
wl0: MAC Address: xx:xx:xx:xx:xx:xx
wl0: Broadcom BCM4318 802.11 Wireless Controller 5.10.85.0.cpe4.402.0
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Trying to free already-free IRQ 25
===== Release Version 4.02L.03.wp1 (build timestamp 140627_1525) =====
ssk:error:16.201:oal_copyPsiToBackupPsi:1201:copy psi data to psi backup space fail!
ssk:error:26.245:NfModuleFn:363:insmod nf_conntrack_h323.ko FAILED in insertModule()
ssk:error:26.253:NfModuleFn:363:insmod nf_nat_h323.ko FAILED in insertModule()
ssk:error:26.262:NfModuleFn:363:insmod nf_conntrack_irc.ko FAILED in insertModule()
ssk:error:26.270:NfModuleFn:363:insmod nf_nat_irc.ko FAILED in insertModule()
ssk:error:26.282:NfModuleFn:363:insmod nf_conntrack_proto_gre.ko FAILED in insertModule()
ssk:error:26.283:NfModuleFn:363:insmod nf_conntrack_pptp.ko FAILED in insertModule()
ssk:error:26.296:NfModuleFn:363:insmod nf_nat_proto_gre.ko FAILED in insertModule()
ssk:error:26.297:NfModuleFn:363:insmod nf_nat_pptp.ko FAILED in insertModule()
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
Warning: weird character in interface `br0:0' (No aliases, :, ! or *).
/proc/sys/net/ipv6/conf/br0:0/clear_all_lladdr: cannot create
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
Sorry, rule does not exist.
eth0 Link DOWN.
eth0 Link UP.
killall: smbd: no process killed
killall: nmbd: no process killed
insmod: cannot open module `/lib/modules/2.6.21.5/extra/pktflow.ko': No such file or directory
ssk:error:46.602:cmsLck_releaseLockTraced:137:released lock. lock occupied 28805 milliseconds; exceeds max timeHold 5000;
ssk:error:46.602:cmsLck_releaseLockTraced:139:acquiring lock callerFuncName cmsMdm_init; releasing lock callerFuncName cmsMdm_init;
httpd:error:48.092:main:133:httpd starting....
loopmon: main: 752: Start loopback check process~!
loopmon: initialize_port_socket: 476: INFO: create eth0.2 socket fd: 8
loopmon: initialize_port_socket: 476: INFO: create eth0.3 socket fd: 9
loopmon: initialize_port_socket: 476: INFO: create eth0.4 socket fd: 10
loopmon: initialize_port_socket: 476: INFO: create eth0.5 socket fd: 11
httpd:error:50.435:readMessageFromSmd:3510:unrecognized msg 0x10000250
WLmngr Daemon is running
optarg=0 shmId=0
WEBUI Operation WPS Type is NONE
There is no Predefined DevicePin in CFE
WPS Device PIN = 11111111
wlctl -i wl0 phy_watchdog 0
interface wl0.1 does not exist!
interface wl0.2 does not exist!
interface wl0.3 does not exist!
wlctl -i wl0 wds none
wlctl -i wl0 up
wlctl led 2 32 0
wlctl -i wl0 down
wlctl -i wl0 mbss 1
wlctl -i wl0 bss -C 0 down
wlctl -i wl0 bss -C 1 down
wlctl -i wl0 bss -C 2 down
wlctl -i wl0 bss -C 3 down
wlctl -i wl0 ssid -C 0 'B''r''o''a''d''c''o''m''1'
Setting SSID "Broadcom1"
wlctl -i wl0 ssid -C 1 'B''r''o''a''d''c''o''m''2'
Setting SSID "Broadcom2"
wlctl -i wl0 ssid -C 2 'B''r''o''a''d''c''o''m''3'
Setting SSID "Broadcom3"
wlctl -i wl0 ssid -C 3 'B''r''o''a''d''c''o''m''4'
Setting SSID "Broadcom4"
wlctl -i wl0 phy_watchdog 1
wlctl -i wl0 fcache 1
wlctl -i wl0 fcache 1
CellPipe2013
Login:
Żadne hasła standardowe które sprawdziłem nie pasują (ok. 20 kombinacji).
W CFE jedyna dostępna komenda do "podglądu" to dm (dump memory).
dm hex_adres wielkość
Nie mam jednak żadnego pojęcia, jaki adres podać, by wyłuskać obszar w którym jest vmlinux i rootfs. Na chybił trafił wpisywałem jakieś wartości, ale zazwyczaj były to obszary RAM.
Inną możliwością jest boot z tftp, aczkolwiek nie mam ... vmlinux i rootfs
Ktokolwiek, cokolwiek?
