Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: 1 ... 13 14 [15] 16

Author Topic: Vodafone (Huawei) HHG2500  (Read 14804 times)

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #210 on: April 19, 2017, 05:26:26 PM »

When set as FTTH does the WAN port work on an unprovisioned device?

I do not, currently, have an answer.

The un-provisioned HHG2500 in my possession has never been connected via the xDSL port nor the EWAN port. Remembering that I do not have a service provided over a G.993.2 metallic pathway, what would be an appropriate test to answer your query?

I could, for example, attach a Huawei SmartAX MT882 to the incoming line, with the MT882 configured to perform the G.992.3, ATM, VC-MUX 0/38 <---> Ethernet frames conversion.

As my service is provided by TalkTalk, it is irrelevant as what the service login credentials are set. Although I have a classic telephone_number@talktalk.net plus alphanumeric string allocated as the credentials, I routinely enter burakkucat & Dummy into the login & password fields . . . as the authentication is performed by the circuit ID.

So not knowing what the un-provisioned HHG2500 has set as the login & password should not be a problem. I would expect that if the EWAN port of the HHG2500 is active, then by connecting the LAN port of the MT882 to the EWAN port of the HHG2500 with a standard Ethernet patch cable I should be able to gain Internet access from the LAN ports of the HHG2500.

Does that read as a suitable experiment?  :-\  Or is there something else that I could try which would answer the question that you have posed?
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

sigtexx

  • Just arrived
  • *
  • Posts: 6
Re: Vodafone (Huawei) HHG2500
« Reply #211 on: April 21, 2017, 07:35:14 PM »

I DID IT!

Successfully managed to get Vodafone to cancel my contract with no early termination fees, due to the issue with concurrent upload/download in firmware version 1.60, which isn't to be resolved until November/December. They tried to roll it back to 1.59 in order resolve the issue, but they couldn't do it for some reason.

Told them that it's not adequate hardware, threatened to go to OFCOM about it and of course asked for my PPPoE details (which of course they won't give out).

Hopefully, others can do the same too. Just try uploading a big file somewhere, and watch everyone else on the network experience connection issues :)

Happy days!
Logged

bishbashbosh

  • Member
  • **
  • Posts: 27
Re: Vodafone (Huawei) HHG2500
« Reply #212 on: April 22, 2017, 09:45:40 PM »

Congrats sigtexx, shame they'd rather lose custom than break ranks.

I actually have no problem with the service VF supply but I take great humbridge at the enforced hardware.

I have a request for assistance. I've managed to pull the cramfs from my running and fully provisioned device however I'm unable to extract the filesystem at this point as no matter what I do I can't mount the cramfs image, always comes back with "unsupported filesystem features". If any one can shed some light on a path to take it would assist greatly.

Binwalk pulls the cramfs out of the image as another file 0.cramfs but that is as far as I get. cramfsck and uncramfs have not assisted either.

My first time at cramfs.
Logged

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #213 on: April 23, 2017, 12:03:47 AM »

I've managed to pull the cramfs from my running and fully provisioned device however I'm unable to extract the filesystem at this point as no matter what I do I can't mount the cramfs image, always comes back with "unsupported filesystem features".

My first thought is that your system, upon which you are trying to mount the cramfs image, has userland tools that are either too new or too old for image extracted from the embedded system.

Then I remembered having a similar sort of problem . . . It was a complete bit copy from the NAND flash device and binwalk had identified the starting offset of the file system. Whatever I did was met with failure. Until, in desperation, I used dd to trim off all the bytes preceding the file system. I then had the file system with a lot of "irrelevant baggage tagged on the end". I was able to mount it. So I made a new, empty, file system, loop-mounted it and then copied the contents of the first into the second.
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #214 on: April 23, 2017, 12:27:59 AM »

I have now tried the experiment that I sketched out in Reply #210, above.

I connected a Huawei SmartAX MT882 to the line and allowed it to synchronise with the TalkTalk MSAN. The MT882 was configured to use G.992.3 modulation, ATM, VC-Mux 0/38 and performed the conversion to/from Ethernet frames. A routeable IPv4 address was obtainable at the LAN port of the MT882.

The HHG2500 was connected from its EWAN port to the LAN port of the MT882 via a standard Ethernet patch cable. A computer was connected to one of the LAN ports of the HHG2500 and was instructed to attempt to ping the primary Google DNS server, the 8.8.8.8 IPv4 address.

With all the devices so placed that all could be present in my gaze, the HHG2500 was powered-up. A short time later the relevant LED on the MT882 lit, showing that a live device was connected to its LAN interface. The ping continued to fail. Then the MT882's LED went out.

I think that ties in with something csiwek mentioned, very early on in this thread and what 3b mentioned, a handful of posts ago.
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

bishbashbosh

  • Member
  • **
  • Posts: 27
Re: Vodafone (Huawei) HHG2500
« Reply #215 on: April 23, 2017, 03:50:21 PM »

Thanks for the pointer b*cat, you pointed me off in the right direction. Turns out you can list the contents of the cramfs using 7z  but not extract. I then discovered this source for uncramfs which worked a treat.

http://va.ler.io/dl/lzma-uncramfs.tar.gz

So I've extracted the cramfs which gives lots of files and lists which I'll spend some time going through but not hit the jackpot yet.

Hopefully just a matter of time.
Oh, does anyone want the pem of the Jungo installed on the box?

Jungo_CTO_RCS2_Root_CA.pem
Logged

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #216 on: April 23, 2017, 06:43:28 PM »

Thanks for the pointer b*cat, you pointed me off in the right direction. Turns out you can list the contents of the cramfs using 7z  but not extract. I then discovered this source for uncramfs which worked a treat.

http://va.ler.io/dl/lzma-uncramfs.tar.gz

So I've extracted the cramfs which gives lots of files and lists which I'll spend some time going through but not hit the jackpot yet.

Hopefully just a matter of time.

Excellent news.  :)

Quote
Oh, does anyone want the pem of the Jungo installed on the box?

Jungo_CTO_RCS2_Root_CA.pem

I'm not sure what I would do with it! Perhaps you should also be the curator of all the goodies discovered in these investigations.  ;)
« Last Edit: April 23, 2017, 09:54:24 PM by burakkucat »
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

bishbashbosh

  • Member
  • **
  • Posts: 27
Re: Vodafone (Huawei) HHG2500
« Reply #217 on: April 23, 2017, 09:43:55 PM »

Turns out you can retrieve the running system mounted drives by pulling /dev/mtdblock0 to 6 so I'm trying that now. If someone who has a good understanding wants to try then it's worth a go.

Remember you need to run your browser through something like burp suite and initiate a packet capture. http://192.168.1.1:nnnnn/dev/mtdblock0    where nnnnn is the dynamic port opened for the packet capture. block2 seems to be the interesting one from a quick scan using "strings"

Oh, and I suggest to power off the router by pulling the plug for about 3 mins before you pull block2 and to limit the wget to 200kbs to not kill the device.

The race is on I hope.
« Last Edit: April 23, 2017, 09:51:20 PM by bishbashbosh »
Logged

miken

  • Just arrived
  • *
  • Posts: 18
Re: Vodafone (Huawei) HHG2500
« Reply #218 on: April 23, 2017, 09:58:12 PM »

Oh, does anyone want the pem of the Jungo installed on the box?

Jungo_CTO_RCS2_Root_CA.pem

Wonder if it matches the one from the previous dumped image. (there are a few in the rgloader and a config file)

Code: [Select]
Common Name: Jungo CA
Country: US
Valid From: July 13, 2015
Valid To: July 13, 2035
Serial Number: 11903608383265602966 (0xa5321cc1ade87d96)

When I was looking for that (knew I'd seen it somewhere) I noticed there is reference to tftp "tftp://192.168.1.10/openrg.img" which may be useful in the future, probably dangerous though.

Any chance you could share what you dump, even if in private?

I did previously find what I can only presume is the default config to load, be interesting to see if the current config is anywhere. Passwords were encrypted but maybe we can find what decodes them.

Btw the dump will contain a couple of device serial numbers.

edit: also does update.jungo.com resolve when using a vodafone connection?
« Last Edit: April 23, 2017, 10:04:14 PM by miken »
Logged

bishbashbosh

  • Member
  • **
  • Posts: 27
Re: Vodafone (Huawei) HHG2500
« Reply #219 on: April 24, 2017, 09:04:18 PM »

Hi miken, I think I've discovered the certs you found in mtdblock3, there were several and there does not appear to be any configuration information in that block, just the original shipped firmware and the updated version. Interestingly is suffixed "no-telnet" implying there is a version with telnet somewhere.

This is the last few lines from the cert Jungo_CTO_RCS2_Root_CA.pem so from that you should be able to see if it matches the one you found. Just before I go to the trouble of extracting this mtd image as I am struggling to open these things properly.

I also found that if I try and retrieve block 4 or 5 then the router just reboots. Still looking for other ways to pull those as I smell a rat. One of those must be the running config to cause a reboot. I'll keep digging.

As for the DNS. I use an internal DNS ( and yes I double router with a Billion behind the VF offering ) so "dig @90.255.255.90 update.jungo.com gives me the same as if I point to the router or my internal or google DNS. So behind Cloudflare security protection services.

$ dig @90.255.255.90 update.jungo.com

; <<>> DiG 9.11.0-P3 <<>> @90.255.255.90 update.jungo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40838
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 8192
;; QUESTION SECTION:
;update.jungo.com.              IN      A

;; AUTHORITY SECTION:
jungo.com.              3600    IN      SOA     rocky.ns.cloudflare.com. dns.cloudflare.com. 2024172115 10000 2400 604800 3600

;; Query time: 57 msec
;; SERVER: 90.255.255.90#53(90.255.255.90)
;; WHEN: Mon Apr 24 20:59:58 BST 2017
;; MSG SIZE  rcvd: 105


iYr3cPkxp5bT8c8CxB275xIeWqmdmT94Ypuu5+Ldzg5OEIHH3BNpGsLwaa6BTp/3
YyI2gbUf/loA2u6c3uwJej6Gb3lTQ+WKPe9GjZo7kWBnJ2GgGLrjau1KyqGTJMM3
q8GJ/ktr1Yt7Ieh7SdDMjEaXPKpph5z1L0Tw8MS0F8FxCg==
-----END CERTIFICATE-----
Logged

bishbashbosh

  • Member
  • **
  • Posts: 27
Re: Vodafone (Huawei) HHG2500
« Reply #220 on: April 25, 2017, 09:41:38 PM »

And we have a winner. I'm slightly disapointed it's taken me this long to join all the dots but we're there.

Before I broadcast the process to all (and that will include VF as I'm sure they read this thread) I'd like to test on another router or two to make sure it's not a fluke. Those of you who do not have their PPP creds and that are still using the VF router on VF service, if one or two would like to contact me via private I'll share the process, just as long as you are prepared to share the yes/no result publicly.

I'm fairly sure VF will patch once they know how it's been achieved so I'd like to make sure we have a working process before exposing.

To the mods/admins, are you happy for me to share the process on here?

3b sans VF router as of today.

edit: should have said, I only have access to this forum from home, life just gets in the way.
« Last Edit: April 25, 2017, 10:19:41 PM by bishbashbosh »
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 38262
  • Penguins CAN fly
    • DSLstats
Re: Vodafone (Huawei) HHG2500
« Reply #221 on: April 25, 2017, 10:37:31 PM »

Quote
To the mods/admins, are you happy for me to share the process on here?

Yes indeed.
Logged
  Eric

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #222 on: April 25, 2017, 10:54:00 PM »

To the mods/admins, are you happy for me to share the process on here?

And a "Yes indeed" from me, too.
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

highpriest

  • Reg Member
  • ***
  • Posts: 119
Re: Vodafone (Huawei) HHG2500
« Reply #223 on: April 26, 2017, 07:46:21 PM »

And we have a winner. I'm slightly disapointed it's taken me this long to join all the dots but we're there.

:yay:
Logged
VMG8324-B10A Bridge | EdgeRouter PoE | UniFi AP AC Lite

burakkucat

  • Global Moderator
  • Senior Kitizen
  • *
  • Posts: 18793
  • Over the Rainbow
    • The ELRepo Project
Re: Vodafone (Huawei) HHG2500
« Reply #224 on: April 26, 2017, 08:23:28 PM »

We now await those with a Vodafone service, using the HHG2500, to make contact with 3b via PMs and to try the technique, as independent verification, before the details are made public.

I am unable to test the technique, for although I own a HHG2500, it is un-provisioned and I do not have a VF supplied broadband service. Likewise N*Star is unable to assist, for although he still owns a provisioned HHG2500, he no longer has a VF supplied broadband service.
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.
Pages: 1 ... 13 14 [15] 16