Bug'Blog

E8.V2.1.0 ,软件版本: V7.1.0

http://192.168.1.1
WEB超级帐户:telecomadmin
WEB超级密码:nE7jA%5m

<psitree>
<WirelessCfg>
<vars state="enabled" ssIdIndex="0" country="CN" apMode="ap"  bridgeRestrict="disabled"  wdsMAC_0=""  wdsMAC_1=""  wdsMAC_2=""  wdsMAC_3=""  band="b" channel="0" rate="auto" multicastRate="auto" basicRate="default" fragThreshold="2346" RTSThreshold="2347" DTIM="1" beacon="100" XPress="off" gMode="auto" gProtection="auto" preamble="long" AfterBurner="off" TxPowerPercent="100" WME="off" WMENoAck="off" WMEApsd="on"  RegulatoryMode="off" PreNetRadarDectTime="60" InNetRadarDectTime="60" TpcMitigation="0" AutoChannelTimer="0" globalMaxAssoc="16" />
<wlMssidVars tableSize="4">
<wlMssidEntry enblSsId="1" ssId="ChinaNet-zhang" enblSubcrb="0" bcntpSubcrb="0" ssIdSubcrb="0" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "16"  wsc_mode="enabled"  wsc_config_state="1"  shownForTr069="1"  authMode="shared" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="enabled" auth="1" keyBit="64-bit" key64_1="ABCDE" key64_2="" key64_3="" key64_4="" key64Index="1" key128_1=""  key128_2=""  key128_3=""  key128_4=""  key128Index="1" wpaRekey="0" wpakey="pxf57avu"  Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="ChinaNet-SSID2" enblSubcrb="0" bcntpSubcrb="0" ssIdSubcrb="0" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "16"  wsc_mode="enabled"  wsc_config_state="1"  shownForTr069="0"  authMode="open" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="128-bit" key64_1="" key64_2="" key64_3="" key64_4="" key64Index="1" key128_1=""  key128_2=""  key128_3=""  key128_4=""  key128Index="1" wpaRekey="0" wpakey="abcdefgh"  Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="ChinaNet-SSID3" enblSubcrb="0" bcntpSubcrb="0" ssIdSubcrb="0" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "16"  wsc_mode="enabled"  wsc_config_state="1"  shownForTr069="0"  authMode="open" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="128-bit" key64_1="" key64_2="" key64_3="" key64_4="" key64Index="1" key128_1=""  key128_2=""  key128_3=""  key128_4=""  key128Index="1" wpaRekey="0" wpakey="abcdefgh"  Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
<wlMssidEntry enblSsId="0" ssId="ChinaNet-SSID4" enblSubcrb="0" bcntpSubcrb="0" ssIdSubcrb="0" hide="0" apIsolation="off" fltMacMode="disabled" disableWme="off" MaxAssoc = "16"  wsc_mode="enabled"  wsc_config_state="1"  shownForTr069="0"  authMode="open" radiusServerIP="0.0.0.0" radiusServerPort="1812" radiusServerKey="" wep="disabled" auth="0" keyBit="128-bit" key64_1="" key64_2="" key64_3="" key64_4="" key64Index="1" key128_1=""  key128_2=""  key128_3=""  key128_4=""  key128Index="1" wpaRekey="0" wpakey="abcdefgh"  Preauthentication="off" ReauthTimeout="36000" wpa="tkip" tr69cBeaconType="Basic" tr69cBasicEncryptionModes="None" tr69cBasicAuthenticationMode="None" tr69cWPAEncryptionModes="TKIPEncryption" tr69cWPAAuthenticationMode="PSKAuthentication" tr69cIEEE11iEncryptionModes="AESEncryption" tr69cIEEE11iAuthenticationMode="EAPAuthentication"/>
</wlMssidVars>
</WirelessCfg>
<SystemInfo>
<algset H323="enable" Sip="enable" Rtsp="enable" L2tp="enable" Ipsec="enable" URL="disable" FTP="enable" FIREWALL="0" MACFLT="disable" MACFLTTYPE="enable" DDNS="disable" IPFILTER="enable" QOSMODE="0" FtpUserName="support" FtpPassword="admin" FtpPort="21" TelnetUserName="support" TelnetPassword="support" TelnetPort="23" USBRestore="enable" CTAlarm="disable" CTMonitor="disable"/>
<protocol autoScan="enable" upnp="enable" alg="enable" igmpSnp ="disable" igmpMode ="disable" macFilterPolicy="forward" encodePassword="enable" siproxd="enable" enetwan="disable" numberOfConn1="0" numberOfConn2="0"/>
<sysUserName value="admin"/>
<tr69c state="disable" upgradesManaged="0" upgradeAvailable="0" informEnbl="0" informTime="0" informInterval="43200" noneConnReqAuth="0" acsURL="http://baidu:9090/ACS-server/ACS" acsUser="fdsafdsafads" acsPwd="hgw" parameterKey="12345" connReqURL="" connReqUser="itms" connReqPwd="itms" urlsubcriber="0" usrsubcriber="0" pwdsubcriber="0" cusrsubcriber="0" cpwdsubcriber="0" kickURL="" provisioningCode="12345" MWSURL="0.0.0.0:" ctMDW="disable" verifyid="" verifystatus="1" verifylimit="10" verifytimes="0"/>
<ctCfg mwBandStatus="1" terminalNumber="0" iptvStatus="disable" stbNumber="0" restrictSTB= "disable" restrictComputer= "disable" computerNumber="0" restrictCamera="disable" cameraNumber="1" restrictPhone="disable" phoneNumber="1" pppreconnect="enable"/>
<sysLog state="disable" displayLevel="ERR" logLevel="DEBUG" option="local" serverIP="0.0.0.0" serverPort="514"/>
<sysPassword value="******"/>
<ctUserName value="admin"/>
<ctPassword value="******"/>
<sptPassword value="******"/>
<usrUserName value="user"/>
<usrPassword value="******"/>
</SystemInfo>
<PMapCfg>
<pmap tableSize="3">
<pmapEntry id="1" groupName="Default" groupKey="1" groupStatus="1" ifList="eth1.3:6|eth1.2:5|eth1.4:7|eth0:2|wl0:8|wl0.1:9|wl0.2:10|wl0.3:11" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4=""/>
<pmapEntry id="2" groupName="STB" groupKey="2" groupStatus="1" ifList="" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4=""/>
<pmapEntry id="3" groupName="Garbage" groupKey="3" groupStatus="1" ifList="usb0:1" vendorid0="" vendorid1="" vendorid2="" vendorid3="" vendorid4=""/>
</pmap>
<pmapFlt tableSize="10">
<pmapFltEntry id="1" instance="1" status="enable" bridgeRef="3" interfaceRef="usb0"/>
<pmapFltEntry id="2" instance="2" status="enable" bridgeRef="1" interfaceRef="eth0"/>
<pmapFltEntry id="3" instance="3" status="enable" bridgeRef="-1" interfaceRef="eth1"/>
<pmapFltEntry id="4" instance="5" status="enable" bridgeRef="1" interfaceRef="eth1.2"/>
<pmapFltEntry id="5" instance="6" status="enable" bridgeRef="1" interfaceRef="eth1.3"/>
<pmapFltEntry id="6" instance="7" status="enable" bridgeRef="1" interfaceRef="eth1.4"/>
<pmapFltEntry id="7" instance="8" status="enable" bridgeRef="1" interfaceRef="wl0"/>
<pmapFltEntry id="8" instance="9" status="enable" bridgeRef="1" interfaceRef="wl0.1"/>
<pmapFltEntry id="9" instance="10" status="enable" bridgeRef="1" interfaceRef="wl0.2"/>
<pmapFltEntry id="10" instance="11" status="enable" bridgeRef="1" interfaceRef="wl0.3"/>
</pmapFlt>
<pmapIfcCfg pmapIfName="eth1" pmapIfcStatus="enable"/>
</PMapCfg>
<AtmCfg>
<initCfg structureId="2" threadPriority="25" freeCellQSize="10" freePktQSize="200" freePktQBufSize="1600" freePktQBufOffset="32" rxCellQSize="10" rxPktQSize="200" txFifoPriority="64" aal5MaxSduLen="64" aal2MaxSduLen="0"/>
</AtmCfg>
<AtmCfgTd>
<td1 cat="UBR" PCR="0" SCR="0" MBS="0"/>
</AtmCfgTd>
<AtmCfgVcc>
<vccId9999 portId="0" vpi="0" vci="65534" tdId="0" aalType="AAL2" adminStatus="down" encap="unknown" qos="disable" instanceId="1509949449" xctVlan="85"/>
</AtmCfgVcc>
<SecCfg>
<qosMgmtCfg enableQos="enable" defaultDSCPMark="-1" defaultQueue="-1" enForceWeight="0" enDSCPMark="0" en802_1_P="0" Mode="OTHER" Plan="priority"/>
<qosPrioQueue tableSize="4">
<qosPrioQueueEntry id="1" instanceId="1" status="enable" priority="1" weight="0"/>
<qosPrioQueueEntry id="2" instanceId="2" status="enable" priority="2" weight="0"/>
<qosPrioQueueEntry id="3" instanceId="3" status="enable" priority="3" weight="0"/>
<qosPrioQueueEntry id="4" instanceId="4" status="enable" priority="4" weight="0"/>
</qosPrioQueue>
<qosCls tableSize="4">
<qosClsEntry id="1" instanceId="1" clsName="Class_1" status="disable" wlpriority="0" clsOrder= "1" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="9" ctype="" max="" min="" weight="0" instanceOfClass="1", instanceOfType="1"/>
<qosClsEntry id="2" instanceId="2" clsName="Class_2" status="disable" wlpriority="0" clsOrder= "2" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="9" ctype="" max="" min="" weight="0" instanceOfClass="2", instanceOfType="2"/>
<qosClsEntry id="3" instanceId="3" clsName="Class_3" status="disable" wlpriority="0" clsOrder= "3" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="9" ctype="" max="" min="" weight="0" instanceOfClass="3", instanceOfType="3"/>
<qosClsEntry id="4" instanceId="4" clsName="Class_4" status="disable" wlpriority="0" clsOrder= "4" type="3" wanVlan8021p="-1" vlan8021p="-1" lanIfcName="" protocol="" ipoptionlist="0" srcAddr="" srcMask="" srcPort="" dstAddr="" dstMask="" dstPort="" srcMacAddr="" srcMacMask="" dstMacAddr="" dstMacMask="" dscpMark="-1" dscpCheck="-1" queueInstId="9" ctype="" max="" min="" weight="0" instanceOfClass="4", instanceOfType="4"/>
</qosCls>
<qosApp tableSize="2">
<qosAppEntry id="1" appName="1" classQueue="1"/>
<qosAppEntry id="2" appName="2" classQueue="2"/>
</qosApp>
<srvCtrlList ftp="disable" http="lan" icmp="lan" ssh="disable" telnet="enable" tftp="disable"/>
</SecCfg>
<Lan>
<entry9999 address="1.1.1.1" mask="255.255.255.0" dhcpServer="disable" portalenable="disable" confDhcpSrv="disable" leasedTime="0" startAddr="0.0.0.0" endAddr="0.0.0.0" subnetMask="0.0.0.0" dhcpwebredirect="" STBDhcpSrv="1" STBdhcpoptlist="1" STBopt="STB" STBstartAddr="0.0.0.0" STBendAddr="0.0.0.0" STBwebredirect="" BTPhoneDhcpSrv="0" BTPhonedhcpoptlist="1" BTPhoneopt="BPhone" BTPhonestartAddr="0.0.0.0" BTPhoneendAddr="0.0.0.0" BTPhonewebredirect="" SIPPhoneDhcpSrv="1" SIPPhonedhcpoptlist="1" SIPPhoneopt="Phone" SIPPhonestartAddr="0.0.0.0" SIPPhoneendAddr="0.0.0.0" SIPPhonewebredirect="" instanceId="1509949453"/>
<entry1 address="192.168.1.1" mask="255.255.255.0" dhcpServer="enable" portalenable="disable" confDhcpSrv="enable" leasedTime="24" startAddr="192.168.1.2" endAddr="192.168.1.249" subnetMask="255.255.255.0" dhcpwebredirect="" STBDhcpSrv="1" STBdhcpoptlist="1" STBopt="STB" STBstartAddr="0.0.0.0" STBendAddr="0.0.0.0" STBwebredirect="" BTPhoneDhcpSrv="0" BTPhonedhcpoptlist="1" BTPhoneopt="BPhone" BTPhonestartAddr="0.0.0.0" BTPhoneendAddr="0.0.0.0" BTPhonewebredirect="" SIPPhoneDhcpSrv="1" SIPPhonedhcpoptlist="1" SIPPhoneopt="Phone" SIPPhonestartAddr="0.0.0.0" SIPPhoneendAddr="0.0.0.0" SIPPhonewebredirect="" instanceId="1509949442"/>
</Lan>
<RouteCfg>
<ripGlobal state="disable" ripIfcTableSize="1"/>
<ripIfc tableSize="1">
<ripIfcEntry id="1" name="br0" state="disable" version="2" operation="active"/>
</ripIfc>
</RouteCfg>
</psitree>

其中

<sysPassword value="******"/>
<ctUserName value="admin"/>
<ctPassword value="******"/>
<sptPassword value="******"/>
<usrUserName value="user"/>
<usrPassword value="******"/>

******为用户自定义密码,密码请编码后填入,建议采用相同的密码

http://tool.114la.com/base64.html

然后将整个配置文件再进行编码一次 拷到U盘以下位置(为了保证配置的读取请拷备4分副本于以下目录)

U:\ctce8.cfg
U:\ctce8_DB120-B1.cfg
U:\e8_Config_Backup\ctce8.cfg
U:\e8_Config_Backup\ctce8.cfg

将U盘插入路由器的USB1口 重启路由后尝试登入

有TTL线的可以登陆终端后输入dumpcfg确认配置文件是否生效
默认密码为admin admin

如果能以新的用户登陆则表示破解成功