TC7210 Telnet Access

[joeyoropesa-dev]

Could someone help me to access telnet and root this device. I've tried many methods but didn't worked so I hope someone else can find out how to do this.

Firmware Name: TC7210-EF.01.36-171129-F-5FF.bin
Firmware Build Time: 14:50:59 Wed Nov 29 2017
HW Revision: 1.0
BOOT Revision: 2.5.0
SW Revision: STEF.01.36
Software Version: STEF.01.36
VENDOR: Technicolor

Thanks in advance to all devs and users who reads this and helps

[GoolaDev]

Try to download the config file and post a link to it. I think this may help:
https://www.hardreset.info/devices/technicolor-thomson/technicolor-thomson-tc7210-dnz/faq/backup/backup-data-router/

[joeyoropesa-dev]

Try to download the config file and post a link to it. I think this may help: https://www.hardreset.info/devices/technicolor-thomson/technicolor-thomson-tc7210-dnz/faq/backup/backup-data-router/

Thank you. Here's backup file: GatewaySettings.bin

[GoolaDev]

I don't think this CM has a ssh/telnet server . Check out the attached pdf. It should be the manual for your CM. It does not say anything about telnet or ssh.

28059998.pdf

[joeyoropesa-dev]

I don't think this CM has a ssh/telnet server . Check out the attached pdf. It should be the manual for your CM. It does not say anything about telnet or ssh.

28059998.pdf

That's correct - somehow cable provider is using it when it wants to change configurations about speed that is sent via cable from cable network to my router.

And it seems that only ISP knows logon for telnet that is active but it doesn't accept gateway login - it needs to be kind of root login.

If there is at least some kind of exploit available for this device so that I could look into password and logon name for telnet, that would gave me control over router.

After all, I didn't purchased this router - instead it's just part of cable network contract. ISP actually modified this router to connect to my subscription and I guess they also changed default telnet logon.

So, could you help me with this - exploiting this device so that I can use custom DDNS and modify configuration received by cable network (for speed optimization, subscription and so)

[GoolaDev]

"And it seems that only ISP knows logon for telnet that is active but it doesn't accept gateway login - it needs to be kind of root login."
How do you know that is telnet access ISP uses??

Bcm2cfg gave me nothing about TR-069 or telnet/ssh. Just bunch of wifis. Check the log. Sorry I could not be of more help.

tc7210.log

[joeyoropesa-dev]

"And it seems that only ISP knows logon for telnet that is active but it doesn't accept gateway login - it needs to be kind of root login."
How do you know that is telnet access ISP uses??

Bcm2cfg gave me nothing about TR-069 or telnet/ssh. Just bunch of wifis. Check the log. Sorry I could not be of more help.

tc7210.log

Since I found that telnet port is opened and I could access it's login console but nothing more than that. Simply every passport and username I've tried didn't work and usually block attempts after some mistakes until I reboot my router or wait for a day or two so that login ban can be lifted.

Yeah... bcm2cfg is also what I've tried but none of firmware related files we're shown to me - only gateway configurations that are clickable - that's how backup function works with this router. It doesn't backup actual firmware and firmware-related files/images

[Anonymous941]

The part that is relevant is the userif section, it might still not be backed up but it should contain the root password if it is. No firmware-related files are backed up using this feature

[joeyoropesa-dev]

The part that is relevant is the userif section, it might still not be backed up but it should contain the root password if it is. No firmware-related files are backed up using this feature

well userif doesn't exist in this dump and anyway I can't really dump any specific partition nor to update firmware without root access (access to telnet)

I've already tried to dump specific partitions but when tool tries to connect to modem it denied connection because it requires authentication (telnet logon 💀💀)

I would really be happy if there is some kind of malware/vuln for this firmware that can bypass that so I can get telnet logon and root this modem.

I've also tried smb trick with symlink (hack published on Google) to get read-only access to root filesystem and find these informations but it didn't worked for me. It seems that it's already patched on this firmware..

[Anonymous941]

well userif doesn't exist in this dump and anyway I can't really dump any specific partition nor to update firmware without root access (access to telnet)

Sounds like they disabled it, so bcm2cfg won't be helpful.

I would really be happy if there is some kind of malware/vuln for this firmware that can bypass that so I can get telnet logon and root this modem.

There doesn't seem to be much research into BFC unfortunately so there aren't very many public vulnerabilities. I've read that you can SNMP somehow to get information from the router, but I'm unable to find any instructions and couldn't figure how to use it on my router despite the manual claiming it supports it. Eventually I opened it up and found UART pins, which I use to this day for shell access.

Here are some ideas:

• Try disconnecting the coax cable and factory resetting the modem. Mine has a different password by default, and once it connects to my ISP for the first time they set their own password. But if you factory reset it and don't let it connect to the ISP, it will have a default configuration, which if you're lucky will have no password or maybe allow exporting the userif portion
• Does your manufacturer have any downloadable firmware updates? If so you can try to look in there for the password using the strings command, or more advanced techniques
• You can open your router's case and look for UART of some kind. I got really lucky because my DDW36C already had pins soldered to it.
• If all else fails then another way would be to read the flash chip directly by soldering to it, but obviously that has a risk of breaking the router with bad soldering or bent pins