optus-sagemcom-fast-3864-hacks icon indicating copy to clipboard operation
optus-sagemcom-fast-3864-hacks copied to clipboard

Published 20 hours ago • verified publisher icon mattimustang

some information regarding latest firmware - 10.96_F@ST3864V3OP

Open techmancer opened this issue 5 years ago • 10 comments

admin password: veWdHnhC

admin login via: http://admin:[email protected]/main.html

output of all config settings, including secrets: http://192.168.0.1/dumpmdm.txt

with secrets encoded (base64) and less information: http://192.168.0.1/dumpcfgdynamic.txt

NOTE: output is in HTML

The following also work:

http://192.168.0.1/dumpcfgdynamic.conf http://192.168.0.1/dumpmdm.conf

techmancer avatar Apr 22 '20 11:04 techmancer

Thank you so much! I've been looking for this forever. Also just letting you know the admin key for 8.353.25_F@ST5350_Optus is T0swNjk3SUo= (Thats raw, base64 is VDBzd05qazNTVW89AA==) as that is what I am running. Have you figured out a way to get telnet running? As just uploading the modified files isn't working due to the encryption. (I made sure to decode it into XML, change the name [that probably wouldn't change anything], remove the footer saying the bytes and everything, and changed telnet to TRUE from FALSE. I linked the file I uploaded below, just change it to .conf as I can't upload conf files.)

backupsettings.txt

PyPylia avatar Apr 28 '20 10:04 PyPylia

Hi @LiamBogur. No, I haven't figured out a way for enabling telnet. Am stuck on the same problem, that I cannot upload a modified configuration.

You might want to remove your backupsettings.txt and re-upload one with your own passwords and serial numbers removed (e.g. turn them into ###### or similar).

techmancer avatar Apr 28 '20 11:04 techmancer

Good point, thanks.

PyPylia avatar Apr 28 '20 12:04 PyPylia

Thank you so much! I've been looking for this forever. Also just letting you know the admin key for 8.353.25_F@ST5350_Optus is T0swNjk3SUo= (Thats raw, base64 is VDBzd05qazNTVW89AA==) as that is what I am running.

The admin password get changed to a random password as soon as you connect the modem and it talks to Optus. There are default passwords that you can try and use after you factory reset or when the modem first arrives. If you factory reset you need to leave the WAN/DSL port disconnected to try out the default passwords.

mattimustang avatar May 01 '20 00:05 mattimustang

Oh yeah, forgot about that detail.

PyPylia avatar May 03 '20 12:05 PyPylia

Are old firmware versions posted anywhere? It would be good to be able to downgrade to a version with a known password. My firmware version is 10.87_F@ST3864V3HP_Optus so I haven't been able to decrypt the settings or find a known working password.

gjcdeluxe avatar Aug 12 '20 04:08 gjcdeluxe

Thanks @techmancer, you are a legend and save me forking out for a new modem.

aero-jet avatar Mar 26 '21 06:03 aero-jet

Are old firmware versions posted anywhere? It would be good to be able to downgrade to a version with a known password. My firmware version is 10.87_F@ST3864V3HP_Optus so I haven't been able to decrypt the settings or find a known working password.

@gjcdeluxe did you get a copy? I'd like to downgrade my firmware for the same purpose, thanks

jrb80 avatar May 17 '23 10:05 jrb80

@jrb80 What I did was visit http://192.168.0.1/dumpmdm.txt and login with the credentials located on the bottom of the router. Then search for "AdminPassword" and you should be able to see an entry like

AdminPassword>XXXXXXXX</AdminPassword

where XXXXXXXX is the password.

For me, admin username is "admin", but you can also search for "AdminUsername" to retrieve the exact one (in case it's not "admin").

aero-jet avatar May 17 '23 12:05 aero-jet

@jrb80 i did the same but it doesn't get you the full root/admin privileges. I cant change the DNS settings :(

JoshC1994 avatar Jul 14 '23 13:07 JoshC1994