Thompson tg 585v7 root

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Thompson tg 585v7 root

optimumtact

20 posts

Geek

#53609 11-Dec-2009 12:38

out of interest how many people have been able to create and access a root account
i have been able to create a super user via editing the ini backup file and restoring the edited version. I assume this will work for the root user as well.

d3Xt3r

688 posts

Ultimate Geek

Trusted

#283164 16-Dec-2009 17:55

optimumtact: out of interest how many people have been able to create and access a root account
i have been able to create a super user via editing the ini backup file and restoring the edited version. I assume this will work for the root user as well.

+1

Actually I've not been able to even get to SuperUser.. how did you change it? I first created a user from the web interface, then downloaded the user.ini, changed the role to SuperUser and uploaded it, but it just ends up deleting all the user-created accounts, and even goes as far as reverting back to the original IP configs of the device (which I had modified).

Perhaps your 585v7 is unlocked? I got mine from Telecom.

optimumtact

20 posts

Geek

#284466 21-Dec-2009 20:54

I saved the ini from the backup restore section of the router and found the section which contained the user info, I then copied the text that referred to my admin account and pasted it below the original text, then I changed the name and the role to SuperUser, case sensitive and caps and uploaded the newly edited Ini. After this I was able to access the account from both web Gui and Telnet interface but recently I have not been able to access the account recently via the web interface. So I assume something is buggy, I haven't really had the time to delve further, but will probably attempt this with a root account at some point.

Edit: my router is also from telecom

optimumtact

20 posts

Geek

#284497 21-Dec-2009 22:27

Well I got a little bored and had a go at acessing the root account and had success, what I did was created a new user in the sameway as I did with the SuperUser and then used the telnet interface and logged in as this new root user, I then created another root user, this new account was fully accessible from the routers web interface and I then removed the original hack account. I don't really know if it unlocks anything new in terms of the web interface, but it certainly gives you advanced control over the Telnet access and what you can do there. If you want I could put together a descriptive tutorial with pics and post that up for use?

ozzie585

4 posts

Wannabe Geek

#285422 27-Dec-2009 13:38

optimumtact: Well I got a little bored and had a go at acessing the root account and had success, what I did was created a new user in the sameway as I did with the SuperUser and then used the telnet interface and logged in as this new root user, I then created another root user, this new account was fully accessible from the routers web interface and I then removed the original hack account. I don't really know if it unlocks anything new in terms of the web interface, but it certainly gives you advanced control over the Telnet access and what you can do there. If you want I could put together a descriptive tutorial with pics and post that up for use?

Wow! Good one! I am in Oz and bought a 585v7 only to find it locked to xtrabb@something! It had no Wizard access. I could change 'nothing!'
I 'copied' what I thought 'important' user.ini data from my 546v6 and uploaded, no go, no connect to Oz isp. Then I upgraded via upgrade Wizard to v8??. No go many times. Then tried BootP, no go several times then upgraded!
However, original v7.4.2.7 still there BUT thing worked!

I tried creating SuperUser etc from GUI with no luck. Cannot access Wizard. Will try your most excellent method.

Don't want to hijack or go off topic, but:

Are 585 modems 'firmware' locked in NZ? Don't see why. There appears to be a 'back-door' into them via the user.ini that 'appears' to allow techos to enter and change things? If you leave for another isp can you ask/pay for the removal of the lock to gain full user (Wizard) access?

regards

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#285425 27-Dec-2009 13:48

Hi ozzie585, these modems are not sold in NZ, they are only available from Telecom with new accounts, hence they are locked down.

Cyril

ozzie585

4 posts

Wannabe Geek

#285426 27-Dec-2009 13:52

Thanks, Cyril. If your account ends can you move elsewhere to another isp? If so, how do you take a locked down modem? Or, isn't this 'allowed?'

regards

johnhb67

54 posts

Master Geek

#286449 1-Jan-2010 20:23

tried it on the ST5x6v6, refered to default settings, dumped my tweeked user.ini

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

ozzie585

4 posts

Wannabe Geek

#286460 1-Jan-2010 22:41

Did on mine also. You'll have to stjtag it.

http://www.speedtouch.net.nz/forum/post.asp?method=ReplyQuote&REPLY_ID=3789&TOPIC_ID=1248&FORUM_ID=4

regards

optimumtact

20 posts

Geek

#475689 30-May-2011 10:41

Someone sent me a message about how I actually did it so I created a more indepth guide. Sorry for the major necro but I feel that I should because some people are obviously finding this through Google.

The basic steps are pretty simply.

Log into your routers web interface and find the option to save a backup config.
this will let you save a text file called config.ini (I think) to your hard drive.
Once you have that you need to edit it, search the document for the mlpuser section

there will be a line that looks something like this

576 add name=yourusername password=_CYP_523434499343491723f2cd38daec0b1f526f4 role=Administrator hash2=7c82ce25c4b6522e323d4b7909041d32455 defuser=enabled$

copy this line and paste the copy just below this line.

then you need to modify the username, change the role=Administrator to role=root and remove the defuser=enabled section
save this as a different name. (Although I never tried it you could attempt leaving the password= and hash2= fields blank
which might set up the new user with a blank password rather than the same password as yourusername)

Then log back into your router and upload the new config file, wait until it has finished and has restarted.
Now try to log into the routers web interface with the new username and with the password being the same as your current
users one.

This may work, in which case I highly suggest you now use the interface to create a new root user and delete the one you hacked in
however I experienced problems logging into the web interface, if you do then try to login over command line via telnet (or PuTTY)
and type help for a list of commands, there should be one relating to users which will let you create a new user with root privleges.
once again please delete the hacked in root user once you have a legitimate one.

Note that I can't ensure that this method will work and others reported the new config not being accepted, I also can't be responsible
for any damage you do to your router as modifying it's configs like this isn't standard procedure. On that note if you don't understand
what I have said at any point then please don't attempt this as it is a risky procedure.

Best of luck and sorry for the delay in the reply.

res

18 posts

Geek

#478765 7-Jun-2011 22:07

For the ST536v6 (Telecom NZ variant at least) which does seem to detect tampered user.ini files you can create a root account by the scary tactic of deleting all users from the cli interface, which seems to then allow a default root login without user name and password. I've happily been running with a root account for weeks.

By memory it goes like this (proceed at your own risk!):

- telnet login using default admin account.
- issue command "user flush"
- your 536 now has no accounts
- close the telnet session, then reconnect it and
- hit enter for user and again for password and you are in at root

Your 536 is completely unprotected at this stage (root access with no user/PW), so the first thing you should do is create an actual account with root permissions from the CLI prompt. eg.
user add name= password= role=root defuser=enabled deflocadmin=enabled

You should now be able to log on to the web interface with your new ID and backup the current setup.

Note that having a root user doesn't achieve that much, if anything, on the web interface.

Does this work with the tg587v7? Anyone ever tried it? A restore to factory settings should??? get you out of jail if you brick the thing.......but only for the brave or foolish!

res

optimumtact

20 posts

Geek

#478942 8-Jun-2011 13:11

Hmm, I'm tempted to try it but I will have to wait, I'm getting a new router in a few weeks and will be able to use the TG7v7 as a testing box.