Login

Rickz · 22-11-2014, 08:03 AM

(21-11-2014, 10:42 AM)maximus64 Wrote: WIN GOT SSH + TELNET Shell on NOSH FW

Code:
+-----------------------------------------------------------------------+ | Portions of this product contain open source software and are subject | | to terms of the applicable license as specified in the release notes. | +-----------------------------------------------------------------------+ * * *** *** *** *** *** *** ***** ***** ***** ***** ***** ***** ******* ******* ******* ******* ******* ******* ********* ********* ********* ********* **** *** *** **** *** *** *** *** * *** ** ** ** ** ** ** ** ** * * Motorola Corporation +----------------------------------------------------------------------------+ | | _/_/ _/_/_/_/ _/_/ | | _/ _/ _/ _/ _/ Broadband | | _/ _/ _/ _/ | | _/_/ _/_/_/ _/ Foundation | | _/ _/ _/ _/ | | _/ _/ _/ _/ _/ Classes | | _/_/_/ _/ _/_/ | | | | Copyright (c) 1999 - 2012 Broadcom Corporation | | | | Revision: 5.5.6mp5 | | | | Features: SBG6580 Console TelnetConsole SshConsole Nonvol Fat HeapManager | | Features: SNMP Networking USB2.0 IPv6 (script Mot_SBG6580) Switch53125 +----------------------------------------------------------------------------+ | | Standard Embedded Target Support for BFC | | | | Copyright (c) 2003-2012 Broadcom Corporation | | | | Revision: 3.0.1 | | | | Features: PID=0xa0f7 BID=0x0 Bootloader-Rev=2.3.0beta5 | | Features: Bootloader-Compression-Support=0x11 MANUFACT_BITS=0xa | | Features: Bcm80211=Build Dec 19 2012 20:49:24 | | Features: App Ver 5.110.27.2006.556.45.5 | | Features: Wl Ver 5.100.138.2006.556.45.5 | | Features: IopLib-Rev=556.12.0 +----------------------------------------------------------------------------+ | | eCos BFC Application Layer | | | | Copyright (c) 1999 - 2012 Broadcom Corporation | | | | Revision: 3.0.2 | | | | Features: eCos Console Cmds, (no Idle Loop Profiler) +----------------------------------------------------------------------------+ | | _/_/ _/ _/ | | _/ _/ _/_/ _/_/ DOCSIS Cable Modem | | _/ _/ _/ _/ | | _/ _/ _/ | | _/ _/ _/ | | _/ _/ _/ _/ | | _/_/ _/ _/ | | | | Copyright (c) 1999 - 2012 Broadcom Corporation | | | | Revision: 5.5.6mp5 | | | | Features: AckCel(tm) DOCSIS 1.0/1.1/2.0/3.0 Propane(tm) CM SNMP w/Factory | | Features: MIB Support CM Vendor Extension eDOCSIS SLED D3.0 Drop | | Features: Classifiers FAP NA Production L2VPN +----------------------------------------------------------------------------+ | | Motorola Data-Only CM Vendor Extension | | | | Revision: 3.0.0a | | | | Features: DHCP Server HTTP Server +----------------------------------------------------------------------------+ | | _/_/_/ | | _/_/ _/ _/ eRouter Dual Stack | | _/ _/ _/ _/ | | _/_/_/_/ _/_/_/ | | _/ _/ _/ | | _/ _/ _/ | | _/_/_/ _/ _/ | | | | Copyright (c) 1999 - 2012 Broadcom Corporation | | | | Revision: 5.5.6mp5 | | | | Features: eRouter SNMP Customer Extension NATP DS-Lite +----------------------------------------------------------------------------+ | | Broadcom eRouter Customer Extension | | | | Copyright (c) 1999 - 2012 Broadcom Corporation | | | | Revision: 3.0.2 | | | | Features: () +----------------------------------------------------------------------------+ | | Build Date: Jan 23 2013 | | Build Time: 13:01:32 (-0800) | | Built By: vobadm02 | | Image Name: ecram_sto.bin | | Image Path: /vobs/sb/sb_ecos/rbb_cm_src/CmDocsisSystem/ecos/Mot_SBG6580_ipv6 +----------------------------------------------------------------------------+ CM> help ! ? REM call cd dir find_command help history instances ls man pwd sleep syntax system_time usage ---- con_high cpuLoad cpuUtilization exit mbufShow memShow mutex_debug ping read_memory reset routeShow run_app shell socket_debug stackShow taskDelete taskInfo taskPrioritySet taskResume taskShow taskSuspend taskSuspendAll taskTrace usfsShow version write_memory zone ---- [80211_hal] [Console] [HeapManager] [HostDqm] [cablemedea] [cm_hal] [docsis_ctl] [dtp] [eRouter] [embedded_target] [enet_hal] [event_log] [fam] [flash] [forwarder] [ftpLite] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop] [usb_hal] CM>

Excelent!! and how did you do it ?

maximus64 · 22-11-2014, 04:00 PM

(22-11-2014, 08:03 AM)Rickz Wrote: Excelent!! and how did you do it ?

I dumped the FW from my modem then LZMA extract it. Load it in IDA and just look for code that block remote telnet. Patch it out. Compress it back up. Recalculate CRC then DONE Smile

Rickz · (This post was last modified: 24-11-2014, 05:59 PM by Rickz.)

(22-11-2014, 04:00 PM)maximus64 Wrote:
(22-11-2014, 08:03 AM)Rickz Wrote: Excelent!! and how did you do it ?

I dumped the FW from my modem then LZMA extract it. Load it in IDA and just look for code that block remote telnet. Patch it out. Compress it back up. Recalculate CRC then DONE

there most be a snmp key to activate it remotely. a R/W key for this, Anyway, can you tell us which firmware exactly has your SBG6580 ?

btw will be nice if you write some notes with graphics like some kind of tutorial Smile

nevermind if you're lazy for that task :-D , but if you used jtagNT for this will be nice if you share how you stablished the connection..

My Best Regards

KCO · 04-01-2015, 05:17 AM

(22-11-2014, 04:00 PM)maximus64 Wrote:
(22-11-2014, 08:03 AM)Rickz Wrote: Excelent!! and how did you do it ?

I dumped the FW from my modem then LZMA extract it. Load it in IDA and just look for code that block remote telnet. Patch it out. Compress it back up. Recalculate CRC then DONE

nice, you can send me this dump modded with telnet please?

Rickz · 08-01-2015, 04:21 AM

(04-01-2015, 05:17 AM)KCO Wrote:
(22-11-2014, 04:00 PM)maximus64 Wrote:
(22-11-2014, 08:03 AM)Rickz Wrote: Excelent!! and how did you do it ?

I dumped the FW from my modem then LZMA extract it. Load it in IDA and just look for code that block remote telnet. Patch it out. Compress it back up. Recalculate CRC then DONE

nice, you can send me this dump modded with telnet please?

Would like to have it as well...please share! Smile

Rickz · 04-04-2015, 06:31 PM

(22-11-2014, 04:00 PM)maximus64 Wrote:
(22-11-2014, 08:03 AM)Rickz Wrote: Excelent!! and how did you do it ?

I dumped the FW from my modem then LZMA extract it. Load it in IDA and just look for code that block remote telnet. Patch it out. Compress it back up. Recalculate CRC then DONE

Please share!

infinity08 · 23-04-2015, 08:57 PM

hey guys what do i need to make my 6580 to work ..
like forcewae or haxo...i have read something abouy shell..
can someone xplain...what should start with ..thansk
i know i could read it with NT...thats it..
thanks

zone2oo0 · 24-10-2015, 05:37 PM

just signed on to say this "you dumb bitch of a son"

sb5101e · (This post was last modified: 22-12-2019, 01:11 PM by sb5101e.)

Image0.bin (Size: 7.88 MB / Downloads: 77) 你需要什么吗

gt2000 · 18-06-2020, 08:47 PM

(22-12-2019, 01:02 PM)sb5101e Wrote: 你需要什么吗

SBG6580 Firmware? what's version?

Login
Username:
Password:	Lost Password?
	Remember me