Unlock Fastweb FastGate DG4131, access Technicolor file system and edit configuration files via SMB, follow these steps:
Flash the downloaded firmware image to external USB disk (>128 Mb) using Win32DiskImager available inside ImageWriter folder
Enable Samba using this command (change IP if needed):
http://192.168.1.254/status.cgi?3g_pin=********&act=nvset&samba_enabled=1&samba_workgroup=WORKGROUP%5c%0a%09security%20%3d%20share%5c%0a%09guest%20account%20%3d%20root%5c%0a%09interfaces%20%3d%20lo%20br-lan%5c%0a%5c%0a%5bohnonotagain%5d&service=usb_status
Browser should return this JSON structure
{
"usb_status":{
"samba_workgroup":"WORKGROUP\\\n\tsecurity = share\\\n\tguest account = root\\\n\tinterfaces = lo br-lan\\\n\\\n[ohnonotagain]",
"disk_protected":"0",
"3g_pin":"********",
"samba_enabled":"1",
"disk_username":"",
"3g_fallback":"1",
"3g_username":"",
"3g_activation":"2",
"samba_share_on":"lan",
"dlna_enabled":"1",
"3g_timeout":"60",
"usb_status":"end",
"disk_password":"",
"samba_server":"FASTGATE",
"3g_connection_status":0,
"total_disks":0,
"printserver_enabled":"1",
"3g_apn":"",
"3g_password":""
}
}
Use File Explorer to access \\192.168.1.254\usbdisk\USB-A1\rootlink and browse the router file system
Edit etc/config/button file and change option handler of config button ‘wps’ section with the following:
option handler 'uci set button.wps.handler='\''wps_button_pressed.sh'\'' && sed -i '\''s#root:/bin/false#root:/bin/ash#'\'' /etc/passwd && sed -i '\''s/#//'\'' /etc/inittab && echo -e '\''root\nroot'\'' | passwd && uci set dropbear.lan.Interface='\''lan'\'' && uci set dropbear.lan.Port='\''22'\'' && uci set dropbear.lan.IdleTimeout='\''600'\'' && uci set dropbear.lan.enable='\''1'\'' && uci set dropbear.lan.RootPasswordAuth='\''on'\'' && uci set dropbear.lan.RootLogin='\''1'\'' && uci set dropbear.lan.PasswordAuth='\''on'\'' && uci set system.@coredump[0].reboot='\''0'\'' && uci commit && /etc/init.d/dropbear restart'
This will enable SSH and set root/root as login.
Test SSH root@192.168.1.254 and login with “root” as psw
BusyBox v1.23.2 (2018-12-14 20:54:18 UTC) built-in shell (ash)
_______ __ __ __
|_ _|.-----.----.| |--.-----.|__|.----.-----.| |.-----.----.
| | | -__| __|| | || || __| _ || || _ | _|
|___| |_____|____||__|__|__|__||__||____|_____||__||_____|__|
--------------------------------------------------------------------
N E X T G E N E R A T I O N G A T E W A Y
--------------------------------------------------------------------
NG GATEWAY SIGNATURE DRINK
--------------------------------------------------------------------
1 oz Vodka Pour all ingredients into mixing
1 oz Triple Sec tin with ice, strain into glass.
1 oz Orange juice
--------------------------------------------------------------------
Product: vbnt-o_fastweb
Release: Mint (17.2)
Version: 17.2.0412-2141001-20181215141731-d7f55d25ae48aa5b3ea0648c032fc93dc2628c32
Hash config: d7f55d25ae48aa5b3ea0648c032fc93dc2628c32
Hash openwrt: 0f2e4683a1d1965c9e8807a706832f67d32ec126
Hash kernel: 11a88a3f5dcaefe38a923784dc3fc610d62d9eed
Hash lte: 2ad4afe45c39bd6d89050a167734dd040ddc9b01
Hash technicolor: 854ea20ee7b08645442ed6306b6c98e44a18705d
Hash mindspeed: cd5df6841bf54c8c1d7e716ce22d0afa2fef66e5
Hash custo: d605bb29b5645d6af0a1de4dd106367f65ee9625
Hash routing: 04c6697034fc47fdc757bc7897ffb76f8501d138
Hash packages: 39b0f8e84d0c2d5ce2d51a95f49fa130d62d8b15
Bootloader: 17.19.1058-0000000-20170508093010-b91cf4e98e3e4e8d3c46306855ce85449a59781f
Change root password with passwd cmd and type new password
Install original and optimized Technicolor GUI
Additional OpenWrt ipk packages per brcm63xx-tch ARM Linux 3.4.11-rt:
Sources:
Ing. Lele's Blog - HeadQuarter 