Comments on: Router Hacking Challenge

By: Nek

Nek — Wed, 10 Mar 2010 07:48:40 +0000

Hello, good day, does any know how to get the password of linksys router WRT300N V1.1 with out doing hard rest, hope im not bothering you guys. have a great day :)

By: Ender

Ender — Sat, 19 Dec 2009 02:38:11 +0000

Is it possible to decode a TP-LINK TL-WR542G config.bin file to recover the admin password, wireless password and pppoe password because if I reset it I loose all settings and if I reload the fies the admin ppassword is also loaded

By: Pritush

Pritush — Wed, 21 Oct 2009 06:34:29 +0000

Is there any hack for TP Link routers ?

By: [blog.rayfoo] » Changing internal network IP address range

[blog.rayfoo] » Changing internal network IP address range — Tue, 13 Oct 2009 18:22:08 +0000

[...] home routers, for those who’re interested: GNUCITIZEN: BT HOME FLUB: PWNIN THE BT HOME HUB GNUCITIZEN: ROUTER HACKING CHALLENGE Share and [...]

By: url.lst.20090722 coll « rogeraaut

url.lst.20090722 coll « rogeraaut — Thu, 23 Jul 2009 17:54:12 +0000

[...] Router Hacking Challenge | GNUCITIZEN.desktop:URL || http://www.gnucitizen.org/proj.....challenge/ ryanfunduk.com Â» Doing Cool Stuff w CouchDB-1.desktop:URL || [...]

By: Kevin

Kevin — Mon, 06 Jul 2009 21:00:11 +0000

hi, i was wondering if there is any way of hacking and retrieving a password from my D-Link dir 655.

PS. im a newbie when it comes to electronics so if you have any instructions for me, please make it simple. thx. :)

By: Squeeze

Squeeze — Sun, 05 Jul 2009 02:05:35 +0000

meanwhile i’ve been trying all i could… also this software (it says it can read/edit/save config.bin files): http://docsis.sourceforge.net/

i actually got no error message opening my config.bin, but the output is not undestandable to me …does it say anything to you:

Main
{
    GenericTLV TlvCode 68 TlvLength 76 TlvValue 0x423630333100070c010000000000010003000000000000400000032008de0000040132aa00ffc0
a89618ffffff000000000000000000ff7fffffefa7ffffffffffffffffffffffffffffffff;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    GenericTLV TlvCode 252 TlvLength 254 TlvValue 0xfffffffffffffffffffffffffffffffffffffffffffff7fbfff8f1ffffffffffffffffffffffdf
5b3d93c7e7f3fffffffffffffffffffffffffffffffffffffffffffffffffff7fbff1cfcfffffffff
fffffffffffffb7f355dfdbedfffffffffffffffffffffffffffffffffffffffffffffffffffff7fb
fff7a2ffffffffffffffffffffff97b363dfdce7f2f9fcfeffff7f7f5ffffffffffffffffffffffff
ffffffffffff7fbffeae8ffffffffffffffffffffff7ff3a58bc8f4f5f9fcfeffffffffffffffffff
fffffffffffffffffffffffffff7fbffd5feffffffffffffffffffffff772b2d9ccaf7f5f9fcfefff
fffffffffffffffffffffffff;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    GenericTLV TlvCode 191 TlvLength 255 TlvValue 0xdfa7a7e903fbe7fef7fcfeffff7fff1f5f8797a1a9d0d8f4fcfffeffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffff;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /* Pad */
    /* Pad */
    /* Pad */
    /* Pad */
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    DocsisTwoEnable 63;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    GenericTLV TlvCode 141 TlvLength 53 TlvValue 0x276faf9ffffffffffefcf9f5ffe5ff95ffffffffbf7ffffffdffffffffffffffffffffffff7fff
fffefdfdf1e6c48d35b3ff3fdfbf;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
    GenericTLV TlvCode 137 TlvLength 191 TlvValue 0xfffbc7bfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff;
    /*EndOfDataMkr*/
    /*EndOfDataMkr*/
}

By: Squeeze

Squeeze — Sat, 04 Jul 2009 04:36:01 +0000

please, anybody can help with reversing ? Kender, please don’t leave high and dry…

By: Squeeze

Squeeze — Thu, 18 Jun 2009 22:12:43 +0000

Kender,

when you think you have time to reverse engineer a config file,
please let me know and i’ll send you a right config.bin to analyze.

THANK YOU

By: Squeeze

Squeeze — Wed, 10 Jun 2009 04:23:22 +0000

@ Kender
here other Firmware links, if needed:

ftp://ftp.dlink.de/di/di-524/driver_software/

and

ftp://ftp.dlink.co.uk/di_broad.....ys/di-524/

i do hope you will have the time to help me (it’s important to me)
thanks

By: Squeeze

Squeeze — Sun, 07 Jun 2009 05:14:02 +0000

about the effort to decode a D-Llink DI-524 config.bin: this is the Firmware version that matters http://tsd.dlink.com.tw/ModelD.....o=BDKDGDAD

i rely on your help!
THANKS A LOT

By: shumackers

shumackers — Thu, 04 Jun 2009 13:10:13 +0000

is there’s any chance that i can used my DSL even my DSL service turn “to Off service”.. i mean I didn’t pay my last 5 months bill due on some personal reasons, is there’s any other way that i can used or continue my service to my present DSL subscriber w/ tracing my IP… if possible maybe you can help me.. Thanks

By: Squeeze

Squeeze — Thu, 04 Jun 2009 04:31:13 +0000

Hi Kender, i read just now your answer… PLEASE don’t leave this way!!! take your time, i can wait a while but please help me find the way to read the config, it’s important to me! Let me know, when you can. Thanks!

PS:
the Firmware version is V2.04

By: Multiple vulnerabilities in LogMeIn web interface can be used to control your computer and steal arbitary files | SecureThoughts.com

Wed, 03 Jun 2009 02:51:04 +0000

[...] LogMeIn completely. Web Interfaces are historically known to be disastrous (e.g. uTorrent Pwn3d, Router Hacking Challenge), so make sure you know what get installed on your computer :). Share:Close Bookmark and Share [...]

By: Squeeze

Squeeze — Sun, 31 May 2009 16:19:22 +0000

hi, it’s me again…

i really need to find the way to read the config.bin cuz i need to retrieve the pwd, which i forgot since i’ve been using another router for a long time.: i just cannot reset to factory defualt, since i can’t remember the configuration i set and, at the meantime, i also need to change some settings according to my new provider!…both can be done ONLY with admin pwd!

i’m quite sure that the whole file (config.bin) is encrypted but i got no idea how to decode it. please help!

By: Squeeze

Squeeze — Sun, 31 May 2009 02:24:04 +0000

here’s a sample config.bin (if needed) http://rapidshare.com/files/23.....g.bin.html

By: Kender

Kender — Thu, 28 May 2009 05:55:38 +0000

I’m sorry. I just don’t have the time to download the firmware for that device and reverse engineer it to figure out how it loads that config.bin. You’re probably better off just resetting the router to it’s default (blank) password: http://technicallyeasy.net/200.....-wireless/

By: Squeeze

Squeeze — Wed, 27 May 2009 04:01:15 +0000

Kender, can you help me?

i add some infos, if useful: i tried to open it with text/hex editor, but all i can see is mostly “FF” and other unreadeble characters throughout. The only readable characters are ““DLB6031″ (at the beginning) and “Li” (at the end)… thanks in advance for any hits/suggestions!

Mark

By: Squeeze

Squeeze — Tue, 26 May 2009 07:37:37 +0000

hi, i’m a newbie

i’ve been reading this blog with attention (altough i’m not able to understand everything). i got a problem: i downloaded the “config.bin” file from a D-Link DI-524 router, but i’m not able to read it… i guess this DI-524 “.bin” file is a kinda “compressed .xml” file…

Anybody can help me (i need to retrieve admin pwd from this cnfig.bin)

By: pandahuge

pandahuge — Wed, 06 May 2009 06:58:04 +0000

hi guys. been reading and it’s fun knowing their weakness of some routers. the router default username and password couldn’t find it. i’d like the wifi to be working. anyways i just like to ask whats the best way to know the username and password of taiwan router. no brand but i got some info about this router

http://www.alibaba.com/product.....outer.html

right know trying to do the sniffing. hope it works.
feel free to tell me what i can do with it.
thanks for reading and for the help
pandahuge