Acaba DEFAULT yerine Nokia'da gelen bir default değer mi vardır, yabancı forumda onu mu kastetmiştir de bizimkiler onu "DEFAULT yazmak" şeklinde algılamışlardır? Nokia'nın arayüzünü biraz daha incelemekte fayda var.DEFAULT yazmıştım.
Web arayüzünde yoksa acaba telnet arayüzünde yada SNMP kullanarak değiştirilebiliyor olabilir. Büyük olasılıkla telnet arayüzünde destekliyordur diye düşünüyorum. Mikrotik router'da mesela bu işlem sadece telnet arayüzüyle yapılabiliyor. Huawei ONT'de de öyle olabilir.Huawei ONT mac klonlamaya izin veriyor mu? Arayüzde göremedim de.
Şifre DEFAULT. ONT ID'yi hexten yazıya çevirince de DEFAULT yazıyor. SLID'yi de hexten yazıya çevirince DEFAULT yazıyor.Nokia'nın arayüzünü biraz daha incelemekte fayda var.
Huawei ONT'de de öyle olabilir.
SU_WAP>?
amp add policy-stats pon
amp add policy-stats port
amp add stats gemport
amp clear policy-stats pon
amp clear policy-stats port
amp clear stats gemport
amp debug lswtable all
amp del policy-stats pon
amp del policy-stats port
amp del stats gemport
amp display efc
amp display l2act
amp display l2mac
amp display sfc
amp display userflow
amp show
ampcmd show car all
ampcmd show car index
ampcmd show emac stat
ampcmd show flow all
ampcmd show flow index
ampcmd show log
ampcmd show queue all
ampcmd show queue index
ampcmd trace all
ampcmd trace cli
ampcmd trace dpoe
ampcmd trace drv
ampcmd trace emac
ampcmd trace emap
ampcmd trace eth
ampcmd trace gmac
ampcmd trace gmap
ampcmd trace onu
ampcmd trace optic
ampcmd trace qos
bbsp add policy-stats btv
bbsp clear policy-stats btv all
bbsp del policy-stats btv
Broadband debug
Broadband display
Broadband stat
chipdebug
clear amp pq-stats
clear file
clear lastword
clear pon statistics
clear poncnt dnstatistic
clear poncnt gemport upstatistic
clear poncnt upstatistic
clear port statistics
collect debug info
component delete all
debug dsp down msg
debug dsp msg
debug dsp up msg
debug rtp stack
debug sample mediastar
display access mode
display amp policy-stats pon
display amp policy-stats port
display amp pq-stats
display amp stats gemport
display bbsp stats btv
display bmsxml crc
display boardItem
display debug info dhcp6c
display debug info dhcp6s
display debug info pppoev6
display debug info ra
display deviceInfo
display dsp channel para
display dsp channel running status
display dsp channel status
display dsp chip stat
display dsp codec status
display dsp interrupt stat
display epon ont info
display ethoam ma info
display ethoam md info
display ethoam mep info
display ethoam mep perf
display file
display flashlock status
display flow
display inner version
display jb grid status
display jb para
display lanmac
display lastword
display macaddress
display machineItem
display memory info
display msg-queue
display oaml2shell ethvlan
display onu info
display optic
display optmode
display pon statistics
display poncnt dnstatistic
display poncnt gemport upstatistic
display poncnt upstatistic
display portstatistics
display pppoe_em result
display productmac
display progress load
display rf config
display rtp stack channel stat
display rtp stack chip stat
display rtp stack para
display rtp stack version
display sn
display startup info
display swm bootstate
display swm state
display sysinfo
display timeout
display version
display wanmac
display wifi pa type
display zsp version
get ip conntrack
get iptables filter
get iptables mangle
get iptables nat
get iptables raw
get mac agingtime
get ont oamfrequency
get opm switch
get optic debug info
get optic par info
get optic txmode
get poncnt upgemport
get port config
get port isolate
get port vlan
get rogue status
get testself
get vlan auth
ifconfig
igmp clear statistics
igmp get debug switch
igmp get flow info
igmp get global cfg
igmp get multilmac
igmp get port multicast config
igmp get statistics
igmp set debug switch
ip -6 neigh
ip -6 route
ip -6 rule
ip neigh
ip route
ip rule
load pack
logout
mid get
mid off
mid set
netstat -na
oamcmd clear log
oamcmd debug
oamcmd error log
oamcmd pdt show log
oamcmd show flow
oamcmd show log
omcicmd alarm show
omcicmd clear log
omcicmd debug
omcicmd error log
omcicmd mib show
omcicmd pdt show log
omcicmd pm show
omcicmd show flow
omcicmd show log
omcicmd show qos
omcicmd show tcont table
ping
quit
reset
restore manufactory
rps
set ethportmirror
set flashlock
set opticdata
set port isolate
set timeout
set userpasswd
setconsole
shell
su
traceroute
vspa display service log
wap list
wap ps
wap top
SU_WAP>shell
WAP(Dopra Linux) #
Bbspcmd get_iptables_nat.sh
Broadband get_iptables_raw.sh
CloseEquipAccess.sh getbmscrc.sh
Customize getcustominfo.sh
Equip.sh getcustomize.sh
EquipMode.sh getipconntrack.sh
GetChipDes getlanmac
GetFeature grep
GetSpec gunzip
LdspCmd.sh gzip
LdspCmdA.sh halt
OntMaintain.sh hexdump
Reloadlog hostname
aescrypt2 hw_ldsp_cfg
amp hw_restore_manufactory.sh
ampcmd ifconfig
ampcmdShowCarAll.sh ifconfig.sh
ampcmdShowCarIndex.sh igmp
ampcmdShowEmacStat.sh init
ampcmdShowFlowAll.sh init_topo_info.sh
ampcmdShowFlowIndex.sh insmod
ampcmdShowLog.sh ip6_neigh.sh
ampcmdShowQueAll.sh ip6_route.sh
ampcmdShowQueIndex.sh ip6_rule.sh
ampcmdTraceAll.sh ip_neigh.sh
ampcmdTraceCli.sh ip_route.sh
ampcmdTraceDpoe.sh ip_rule.sh
ampcmdTraceDrv.sh kill
ampcmdTraceEmac.sh kmsgread
ampcmdTraceEmap.sh ldspcli
ampcmdTraceEth.sh ls
ampcmdTraceGmac.sh lsmod
ampcmdTraceGmap.sh maintain
ampcmdTraceOnu.sh md
ampcmdTraceOptic.sh mid
ampcmdTraceQos.sh mkdir
arp mknod
ash mount
bbsp mu
bbspcmd_debug.sh mv
bin/ mw
boardtype.sh netstat_na.sh
busybox oam
cat oamcmd
cfgtool oamcmdPdtShowLog.sh
chipdebug omci
chmod omcicmd
cleanmem.sh omcicmdPdtShowLog.sh
clearfiles.sh open_print_log.sh
clid pidof
clog ping
clw ping.sh
collect.sh poweroff
collect_exe pppd
console.sh procmonitor
cp ps
cpu reboot
cpu_debug.sh restorehwmode.sh
customize.sh rm
customize_simple.sh rmdir
cut rmem
dbg.sh rmmod
debug_ctp.sh route
debug_ffwd.sh sed
debug_fw_pktinfo_num.sh sh
debug_vbr_fw.sh showfiles.sh
debug_vport.sh sleep
dhcpc sndhlp
display_acl_chain_all.sh ssmp
display_ctp.sh start
display_ffwd.sh sync
display_fw.sh sysctl
display_l2ffwd_table.sh tar
display_mac_all.sh telnet
display_napt_all.sh tftp
display_oaml2shell_ethvlan.sh top
display_route.sh tr
display_tunnel.sh traceroute.sh
display_vbridge.sh umount
display_vport.sh upnpd_start.sh
display_wan_layer_all.sh vbridge_statistic.sh
dlw vport_statistic_clear.sh
dmesg wap.ssp.addflag
dnsdomainname wap.ssp.clog
dnsmasq_cfg.sh wap.ssp.dlog
echo wap.ssp.ps
exit.sh wap.top
expr web
free xargs
get_iptables_filter.sh zcat
get_iptables_mangle.sh
WAP(Dopra Linux) # busybox
BusyBox v1.18.4 (2015-03-31 23:14:51 CST) multi-call binary.
Copyright (C) 1998-2009 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.
Usage: busybox [function] [arguments]...
or: busybox --list[-full]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
[, [[, arp, ash, cat, chmod, cp, cut, dmesg, dnsdomainname, echo,
egrep, expr, free, grep, gunzip, gzip, halt, hexdump, hostname,
ifconfig, init, insmod, kill, ls, lsmod, lzcat, lzma, mkdir, mknod,
mount, mv, pidof, ping, poweroff, ps, reboot, rm, rmdir, rmmod, route,
sed, sh, sleep, sync, sysctl, tar, telnet, test, tftp, top, tr, umount,
unlzma, xargs, zcat
Acaba Nokia OLT'de Huawei OLT'den farklı olarak MAC adresi mi sabitleniyor? Başka bir Nokia ONT cihazı ile bağlanırsan ne olur acaba onu merak ediyorum ama başka bir Nokia ONT cihazı bulmak da zor olur sanırım. Yapılan sabitlemenin neye bağlı olduğunu öğrenmemiz gerekiyor.Şifre DEFAULT. ONT ID'yi hexten yazıya çevirince de DEFAULT yazıyor. SLID'yi de hexten yazıya çevirince DEFAULT yazıyor.
Nokia ONT'de telnet ile kayda değer hiçbir şey yok. Bir tek SLID göstermeye veya değişirmeye izin veriyor. Yani arayüz daha fazla bilgi veriyor.
Eki Görüntüle 1226257
Nokia ONT'de PON şifresini rastgele değiştirmeme rağmen hala sorunsuz IP alıp internete bağlanabiliyorum. Şifre önemsiz gibi.Kod:SU_WAP>? amp add policy-stats pon amp add policy-stats port amp add stats gemport amp clear policy-stats pon amp clear policy-stats port amp clear stats gemport amp debug lswtable all amp del policy-stats pon amp del policy-stats port amp del stats gemport amp display efc amp display l2act amp display l2mac amp display sfc amp display userflow amp show ampcmd show car all ampcmd show car index ampcmd show emac stat ampcmd show flow all ampcmd show flow index ampcmd show log ampcmd show queue all ampcmd show queue index ampcmd trace all ampcmd trace cli ampcmd trace dpoe ampcmd trace drv ampcmd trace emac ampcmd trace emap ampcmd trace eth ampcmd trace gmac ampcmd trace gmap ampcmd trace onu ampcmd trace optic ampcmd trace qos bbsp add policy-stats btv bbsp clear policy-stats btv all bbsp del policy-stats btv Broadband debug Broadband display Broadband stat chipdebug clear amp pq-stats clear file clear lastword clear pon statistics clear poncnt dnstatistic clear poncnt gemport upstatistic clear poncnt upstatistic clear port statistics collect debug info component delete all debug dsp down msg debug dsp msg debug dsp up msg debug rtp stack debug sample mediastar display access mode display amp policy-stats pon display amp policy-stats port display amp pq-stats display amp stats gemport display bbsp stats btv display bmsxml crc display boardItem display debug info dhcp6c display debug info dhcp6s display debug info pppoev6 display debug info ra display deviceInfo display dsp channel para display dsp channel running status display dsp channel status display dsp chip stat display dsp codec status display dsp interrupt stat display epon ont info display ethoam ma info display ethoam md info display ethoam mep info display ethoam mep perf display file display flashlock status display flow display inner version display jb grid status display jb para display lanmac display lastword display macaddress display machineItem display memory info display msg-queue display oaml2shell ethvlan display onu info display optic display optmode display pon statistics display poncnt dnstatistic display poncnt gemport upstatistic display poncnt upstatistic display portstatistics display pppoe_em result display productmac display progress load display rf config display rtp stack channel stat display rtp stack chip stat display rtp stack para display rtp stack version display sn display startup info display swm bootstate display swm state display sysinfo display timeout display version display wanmac display wifi pa type display zsp version get ip conntrack get iptables filter get iptables mangle get iptables nat get iptables raw get mac agingtime get ont oamfrequency get opm switch get optic debug info get optic par info get optic txmode get poncnt upgemport get port config get port isolate get port vlan get rogue status get testself get vlan auth ifconfig igmp clear statistics igmp get debug switch igmp get flow info igmp get global cfg igmp get multilmac igmp get port multicast config igmp get statistics igmp set debug switch ip -6 neigh ip -6 route ip -6 rule ip neigh ip route ip rule load pack logout mid get mid off mid set netstat -na oamcmd clear log oamcmd debug oamcmd error log oamcmd pdt show log oamcmd show flow oamcmd show log omcicmd alarm show omcicmd clear log omcicmd debug omcicmd error log omcicmd mib show omcicmd pdt show log omcicmd pm show omcicmd show flow omcicmd show log omcicmd show qos omcicmd show tcont table ping quit reset restore manufactory rps set ethportmirror set flashlock set opticdata set port isolate set timeout set userpasswd setconsole shell su traceroute vspa display service log wap list wap ps wap top SU_WAP>shell WAP(Dopra Linux) # Bbspcmd get_iptables_nat.sh Broadband get_iptables_raw.sh CloseEquipAccess.sh getbmscrc.sh Customize getcustominfo.sh Equip.sh getcustomize.sh EquipMode.sh getipconntrack.sh GetChipDes getlanmac GetFeature grep GetSpec gunzip LdspCmd.sh gzip LdspCmdA.sh halt OntMaintain.sh hexdump Reloadlog hostname aescrypt2 hw_ldsp_cfg amp hw_restore_manufactory.sh ampcmd ifconfig ampcmdShowCarAll.sh ifconfig.sh ampcmdShowCarIndex.sh igmp ampcmdShowEmacStat.sh init ampcmdShowFlowAll.sh init_topo_info.sh ampcmdShowFlowIndex.sh insmod ampcmdShowLog.sh ip6_neigh.sh ampcmdShowQueAll.sh ip6_route.sh ampcmdShowQueIndex.sh ip6_rule.sh ampcmdTraceAll.sh ip_neigh.sh ampcmdTraceCli.sh ip_route.sh ampcmdTraceDpoe.sh ip_rule.sh ampcmdTraceDrv.sh kill ampcmdTraceEmac.sh kmsgread ampcmdTraceEmap.sh ldspcli ampcmdTraceEth.sh ls ampcmdTraceGmac.sh lsmod ampcmdTraceGmap.sh maintain ampcmdTraceOnu.sh md ampcmdTraceOptic.sh mid ampcmdTraceQos.sh mkdir arp mknod ash mount bbsp mu bbspcmd_debug.sh mv bin/ mw boardtype.sh netstat_na.sh busybox oam cat oamcmd cfgtool oamcmdPdtShowLog.sh chipdebug omci chmod omcicmd cleanmem.sh omcicmdPdtShowLog.sh clearfiles.sh open_print_log.sh clid pidof clog ping clw ping.sh collect.sh poweroff collect_exe pppd console.sh procmonitor cp ps cpu reboot cpu_debug.sh restorehwmode.sh customize.sh rm customize_simple.sh rmdir cut rmem dbg.sh rmmod debug_ctp.sh route debug_ffwd.sh sed debug_fw_pktinfo_num.sh sh debug_vbr_fw.sh showfiles.sh debug_vport.sh sleep dhcpc sndhlp display_acl_chain_all.sh ssmp display_ctp.sh start display_ffwd.sh sync display_fw.sh sysctl display_l2ffwd_table.sh tar display_mac_all.sh telnet display_napt_all.sh tftp display_oaml2shell_ethvlan.sh top display_route.sh tr display_tunnel.sh traceroute.sh display_vbridge.sh umount display_vport.sh upnpd_start.sh display_wan_layer_all.sh vbridge_statistic.sh dlw vport_statistic_clear.sh dmesg wap.ssp.addflag dnsdomainname wap.ssp.clog dnsmasq_cfg.sh wap.ssp.dlog echo wap.ssp.ps exit.sh wap.top expr web free xargs get_iptables_filter.sh zcat get_iptables_mangle.sh WAP(Dopra Linux) # busybox BusyBox v1.18.4 (2015-03-31 23:14:51 CST) multi-call binary. Copyright (C) 1998-2009 Erik Andersen, Rob Landley, Denys Vlasenko and others. Licensed under GPLv2. See source distribution for full notice. Usage: busybox [function] [arguments]... or: busybox --list[-full] or: function [arguments]... BusyBox is a multi-call binary that combines many common Unix utilities into a single executable. Most people will create a link to busybox for each function they wish to use and BusyBox will act like whatever it was invoked as. Currently defined functions: [, [[, arp, ash, cat, chmod, cp, cut, dmesg, dnsdomainname, echo, egrep, expr, free, grep, gunzip, gzip, halt, hexdump, hostname, ifconfig, init, insmod, kill, ls, lsmod, lzcat, lzma, mkdir, mknod, mount, mv, pidof, ping, poweroff, ps, reboot, rm, rmdir, rmmod, route, sed, sh, sleep, sync, sysctl, tar, telnet, test, tftp, top, tr, umount, unlzma, xargs, zcat
Nasıl bir kilit mekanizması yapmışlar çok merak ediyorum gerçekten. Yapılabilecek herşeyi yapmış olduk gibi geliyor. Türk Telekom'da çalışan bi arkadaş olsa sorardık.@sunshine Nokia ONT ile SN değiştirilmiyor.
Huawei ONT ile mac adresi değiştirmeyi başardım ama sonuç hala aynı.
sed -i "s/değişecek_mac/yeni_mac/" /mnt/jffs2/hw_boardinfo && reboot
Bir kaç ayar daha kurcalarken yanlışlıkla shell yetkisini kapattım. Linux komut satırına erişemiyorum artık :/
Bu ayarı 0 yapınca shell yetkisi gitti:
feature.name="HW_SSMP_FEATURE_CLI_CHINA_MODE" feature.enable="1"
Bu videodaki "Xpon 8310.bin" dosyasını flashlayarak geri shell yetkisi aldım.
Nasıl bir kilit mekanizması yapmışlar çok merak ediyorum gerçekten. Yapılabilecek her şeyi yapmış olduk gibi geliyor. Türk Telekom'da çalışan bir arkadaş olsa sorardık.
Sonucu gerçekten çok merak ediyorum. Bu sorun çözülürse gerçekten birçok kişi ONT cihazı konusunda çok daha özgür olacak.Büyük ihtimal OLT, vendor ID'yi HWTC olarak gördüğü için bağlanmayı reddediyor.
Cihazı brickledim. USB ttl ve eeprom flash cihazları gelsin vendor ID'yi de değiştirmeyi denerim.
#!/bin/bash
sed -i "s/HWTC/ALCL/" lib/libeoam_amp.so
sed -i "s/HWTC/ALCL/" lib/oam_module/liboam_smp.so
sed -i "s/HWTC/ALCL/" bin/ssmp
sed -i "s/HWTC/ALCL/" bin/omci
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8310v1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010Fv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8510Cv2.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010Cv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010Hv2.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8310Mv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8010av1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8310v1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010av1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010Cv2.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010v1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8010Hv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8010Cv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8010v1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8010Fv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8510Cv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8010Hv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/HG8310Mv1.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8310Mv2.cfg
sed -i "s/HWTC/ALCL/" etc/wap/dm.cfg/5116HG8310v2.cfg
sed -i "s/HW-BOB-0002/G-010G-Q /" lib/modules/sdk/sd5171_epon_par.bin
sed -i "s/HW-BOB-0002/G-010G-Q /" lib/modules/sdk/sd5171_gpon_par.bin
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8010HV1_SD5116S/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8310V1_SD5116S/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8010HV1/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8010UV1/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8012HV1/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0002/G-010G-Q/" etc/ont/hardware/HG8010FV1/hw_ldsp_cfg.xml
sed -i "s/HW-BOB-0003/G-010G-Q /" lib/modules/wap/hw_module_optic.ko
sed -i "s/HUAWEI/NOKIA /" lib/modules/wap/hw_module_optic.ko
sed -i "s/HUAWEI/NOKIA /" lib/modules/sdk/sd5171_epon_par.bin
sed -i "s/HUAWEI/NOKIA /" lib/modules/sdk/sd5171_gpon_par.bin
sed -i "s/HWGW/ALCL/" lib/modules/sdk/sd5171_epon_par.bin
sed -i "s/HWGW/ALCL/" lib/modules/sdk/sd5171_gpon_par.bin