Changing the default password on the router is pointless when:
1) There are undocumented accounts on the router.
2) You don’t have the password needed to log into the account to change the password!
Here is a table of the three usernames and passwords that allow logging into the web interface. The “vodafone” username is the basic account, “superuser” allows full access and “admin” is somewhere between the other two.
| Username | Password |
|---|---|
| vodafone | vodafone |
| admin | admin1234 |
| superuser | HG-658c_VF_ie* |
Telnet can be enabled quite easily by setting “TelnetEnable” to “1” in the
configutation file. This also sets up firewall rules to permit access
to port 23.
“!!Huawei” and “@HuaweiHgw” are the default username and password.
ATP>sh BusyBox vv1.9.1 (2014-02-08 20:26:13 CST) built-in shell (ash) Enter 'help' for a list of built-in commands.
Here is the output from a few commands that I ran.
# cat /proc/cpuinfo system type : 63268hg622b processor : 0 cpu model : Broadcom4350 V8.0 BogoMIPS : 399.36 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 280 processor : 1 cpu model : Broadcom4350 V8.0 BogoMIPS : 402.43 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 280
# cat /proc/meminfo MemTotal: 123196 kB MemFree: 70120 kB Buffers: 0 kB Cached: 15128 kB SwapCached: 0 kB Active: 6756 kB Inactive: 13012 kB Active(anon): 4644 kB Inactive(anon): 0 kB Active(file): 2112 kB Inactive(file): 13012 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 4672 kB Mapped: 3516 kB Slab: 24612 kB SReclaimable: 492 kB SUnreclaim: 24120 kB PageTables: 384 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 61596 kB Committed_AS: 7892 kB VmallocTotal: 1032148 kB VmallocUsed: 7884 kB VmallocChunk: 1005596 kB
Running processes…
# ps PID Uid VSZ Stat Command 1 0 412 S init 2 0 SW< [kthreadd] 3 0 SW< [migration/0] 4 0 SW [sirq-high/0] 5 0 SW [sirq-timer/0] 6 0 SW [sirq-net-tx/0] 7 0 SW [sirq-net-rx/0] 8 0 SW [sirq-block/0] 9 0 SW [sirq-tasklet/0] 10 0 SW [sirq-sched/0] 11 0 SW [sirq-hrtimer/0] 12 0 SW [sirq-rcu/0] 13 0 SW< [migration/1] 14 0 SW [sirq-high/1] 15 0 SW [sirq-timer/1] 16 0 SW [sirq-net-tx/1] 17 0 SW [sirq-net-rx/1] 18 0 SW [sirq-block/1] 19 0 SW [sirq-tasklet/1] 20 0 SW [sirq-sched/1] 21 0 SW [sirq-hrtimer/1] 22 0 SW [sirq-rcu/1] 23 0 SW< [events/0] 24 0 SW< [events/1] 25 0 SW< [khelper] 28 0 SW< [async/mgr] 29 0 SW< [board] 99 0 SW< [kblockd/0] 100 0 SW< [kblockd/1] 109 0 SW< [khubd] 126 0 SW< [bpm] 142 0 SW [pdflush] 143 0 SW [pdflush] 144 0 SWN [kswapd0] 146 0 SW< [crypto/0] 147 0 SW< [crypto/1] 219 0 SW< [mtdblockd] 255 0 SW [dsl0] 257 0 SW< [linkwatch] 265 0 452 S -/bin/sh 375 0 SWN [jffs2_gcd_mtd2] 403 0 408 S atserver 413 0 SW [kpAliveWatchdog] 432 0 SW [bcmsw] 433 0 SW [bcmsw_timer] 458 0 920 S mic 460 0 320 S klog 462 0 560 S log 464 0 1928 S cms 692 0 376 S ipcheck 694 0 680 S dhcps 979 0 340 S /bin/lld2d br0 1006 0 284 S /bin/eapd 1009 0 548 S /bin/nas 1013 0 332 S /bin/acsd 1024 0 776 S /bin/wps_monitor 1055 0 456 S /bin/radvd -C /var/radvd/radvd.conf br0 1082 0 312 S ipp -f /etc/printers.ini 1084 0 412 S dns 1102 0 520 S pppc -I ppp258 1527 0 396 S sntp 1532 0 328 S usbmount 1563 0 2796 S < voiper start 1565 0 2796 S < voiper start 1566 0 2796 S < voiper start 1567 0 2796 S < voiper start 1568 0 2796 S < voiper start 1569 0 2796 S < voiper start 1581 0 2796 S < voiper start 1586 0 2796 S < voiper start 1587 0 2796 S < voiper start 1588 0 2796 S < voiper start 1589 0 2796 S < voiper start 1590 0 2796 S < voiper start 1591 0 2796 S < voiper start 1592 0 2796 S < voiper start 1593 0 2796 S < voiper start 1594 0 2796 S < voiper start 1595 0 2796 S < voiper start 1596 0 2796 S < voiper start 1597 0 2796 S < voiper start 1598 0 2796 S < voiper start 1599 0 2796 S < voiper start 1600 0 2796 S < voiper start 1601 0 2796 S < voiper start 1602 0 2796 S < voiper start 1603 0 2796 S < voiper start 1607 0 2796 S < voiper start 1707 0 588 R telnet_cli -l 1 1838 0 464 R sh -si 1839 0 416 R ps
Lots of opens ports…
# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:37443 0.0.0.0:* LISTEN tcp 0 0 192.168.1.1:1990 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8011 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:www 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ftp 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:telnet 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:https 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:5916 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:37215 0.0.0.0:* LISTEN tcp 0 0 :::www :::* LISTEN tcp 0 0 :::ftp :::* LISTEN tcp 0 0 :::631 :::* LISTEN tcp 0 0 :::https :::* LISTEN udp 0 0 0.0.0.0:syslog 0.0.0.0:* udp 0 0 0.0.0.0:37000 0.0.0.0:* udp 0 0 127.0.0.1:38032 0.0.0.0:* udp 0 0 0.0.0.0:42000 0.0.0.0:* udp 0 0 127.0.0.1:42032 0.0.0.0:* udp 0 0 127.0.0.1:40500 0.0.0.0:* udp 0 0 0.0.0.0:domain 0.0.0.0:* udp 0 0 127.0.0.1:domain 0.0.0.0:* udp 0 0 0.0.0.0:39995 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 127.0.0.1:37064 0.0.0.0:* udp 0 0 0.0.0.0:50000 0.0.0.0:* udp 0 0 0.0.0.0:1900 0.0.0.0:* udp 0 0 0.0.0.0:1900 0.0.0.0:* udp 0 0 0.0.0.0:38000 0.0.0.0:* udp 0 0 :::domain :::* udp 0 0 ::1:domain :::* raw 0 0 :::58 :::* 7 raw 0 0 :::58 :::* 7 raw 0 0 :::58 :::* 7
If you ever downloaded the configuration file from the hg658c router, you might have noticed that it is encrypted. Wouldn’t it be great if you were able to decrypt the file, make some changes and then upload it back onto the router? Now you can!
To decrypt a configuration file:
python hg658c_configtool.py decrypt input_file output_file
To encrypt a configuration file:
python hg658c_configtool.py encrypt input_file output_file
Download link => http://pastebin.com/8DPdK3V6
Fun with the Huawei HG658c 